nanocore | 2894c28d4972a081f7d55a74a42b57eec8dab10ed4682be6f3f86b1393fc4aa2

General

Target
mHQHZZgkSaQEHrC.exe
Size 872KB
Sample201008-ste1jt8pmj
SHA256 2894c28d4972a081f7d55a74a42b57eec8dab10ed4682be6f3f86b1393fc4aa2
MD5 2261bf1be612cf03311e365514c33bfb
SHA1 360cd8ceb5af84fc320098f46ea4a36d2e085525
SHA512 a70a80cb531f67aafcd769e8a07e9d3693b5025db68fe6f14187231402d356cc23092e67509710a3eb606adf3949315e8a55db7a2757cedc3311f33bdb208782
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 2072	3068	mHQHZZgkSaQEHrC.exe	78

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DDP Subsystem\ddpss.exe	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	mHQHZZgkSaQEHrC.exe
Token: SeDebugPrivilege	2072	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1780	3068	mHQHZZgkSaQEHrC.exe	76
PID 3068 wrote to memory of 1780	3068	mHQHZZgkSaQEHrC.exe	76
PID 3068 wrote to memory of 1780	3068	mHQHZZgkSaQEHrC.exe	76
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78
PID 3068 wrote to memory of 2072	3068	mHQHZZgkSaQEHrC.exe	78

C:\Users\Admin\AppData\Local\Temp\mHQHZZgkSaQEHrC.exe
"C:\Users\Admin\AppData\Local\Temp\mHQHZZgkSaQEHrC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bnyfVBwT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC624.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2072