nanocore | b3cc4d8429cfa934b85dd933dd9848adce458907bf5e3bab5e99e8a83c1966d4

General

Target
Purchase Order PDF pdf.exe
Size 959KB
Sample201027-aaa96rv3ca
SHA256 b3cc4d8429cfa934b85dd933dd9848adce458907bf5e3bab5e99e8a83c1966d4
MD5 7ed7d1587399852632f2f7ae486b6e87
SHA1 463454bae2db9f9b7d7f345e9c166c98c5a2c493
SHA512 076debeb89b5a1707221a996e012d6a710e7d516aca7dbf1c816e715de45626b76c4d32dfd71478f6a91e4a746f9d338796f3e0b4369cc18ad418280f184019c
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 1936	1084	Purchase Order PDF pdf.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	MSBuild.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	MSBuild.exe
1936	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1936	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1748	1084	Purchase Order PDF pdf.exe	28
PID 1084 wrote to memory of 1748	1084	Purchase Order PDF pdf.exe	28
PID 1084 wrote to memory of 1748	1084	Purchase Order PDF pdf.exe	28
PID 1084 wrote to memory of 1748	1084	Purchase Order PDF pdf.exe	28
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30
PID 1084 wrote to memory of 1936	1084	Purchase Order PDF pdf.exe	30

C:\Users\Admin\AppData\Local\Temp\Purchase Order PDF pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order PDF pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CuqzAPPdXD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE659.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1748
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1936