nanocore | 1f6b100b68c412b9a6c4289ce2e387bc13805bc9cc46141c3bf2bf497cff3649

General

Target
Orden CW62125Q, pdf.exe
Size 916KB
Sample201023-m5sw4ynrb6
SHA256 1f6b100b68c412b9a6c4289ce2e387bc13805bc9cc46141c3bf2bf497cff3649
MD5 35e252d3d45b4b168cb632d287263ee6
SHA1 9af37bad68605a67a805847498f725d83ee39531
SHA512 05259211368515c0bbf18a6dd349c3d18e74b148c904c7b599f3e0360c8213fe7a80589174a24df1ee6806f8602a5384cbec117b778543571795556b12ad3f67
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAAS Manager = "C:\\Program Files (x86)\\SAAS Manager\\saasmgr.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3872 set thread context of 2008	3872	Orden CW62125Q, pdf.exe	76

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SAAS Manager\saasmgr.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\SAAS Manager\saasmgr.exe	MSBuild.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	Orden CW62125Q, pdf.exe
Token: SeDebugPrivilege	2008	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1628	3872	Orden CW62125Q, pdf.exe	74
PID 3872 wrote to memory of 1628	3872	Orden CW62125Q, pdf.exe	74
PID 3872 wrote to memory of 1628	3872	Orden CW62125Q, pdf.exe	74
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76
PID 3872 wrote to memory of 2008	3872	Orden CW62125Q, pdf.exe	76

C:\Users\Admin\AppData\Local\Temp\Orden CW62125Q, pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Orden CW62125Q, pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CWoHGdicxt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF301.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1628
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2008