nanocore | b3cc4d8429cfa934b85dd933dd9848adce458907bf5e3bab5e99e8a83c1966d4

General

Target
Purchase Order PDF pdf.exe
Size 959KB
Sample201027-aaa96rv3ca
SHA256 b3cc4d8429cfa934b85dd933dd9848adce458907bf5e3bab5e99e8a83c1966d4
MD5 7ed7d1587399852632f2f7ae486b6e87
SHA1 463454bae2db9f9b7d7f345e9c166c98c5a2c493
SHA512 076debeb89b5a1707221a996e012d6a710e7d516aca7dbf1c816e715de45626b76c4d32dfd71478f6a91e4a746f9d338796f3e0b4369cc18ad418280f184019c
MD5 SHA1 SHA512

Score

10^/10

Family

Version

C2

Mutex

Attributes

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAAS Manager = "C:\\Program Files (x86)\\SAAS Manager\\saasmgr.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1820 set thread context of 188	1820	Purchase Order PDF pdf.exe	79

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SAAS Manager\saasmgr.exe	MSBuild.exe
File opened for modification	C:\Program Files (x86)\SAAS Manager\saasmgr.exe	MSBuild.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
188	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	Purchase Order PDF pdf.exe
Token: SeDebugPrivilege	188	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4004	1820	Purchase Order PDF pdf.exe	77
PID 1820 wrote to memory of 4004	1820	Purchase Order PDF pdf.exe	77
PID 1820 wrote to memory of 4004	1820	Purchase Order PDF pdf.exe	77
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79
PID 1820 wrote to memory of 188	1820	Purchase Order PDF pdf.exe	79

C:\Users\Admin\AppData\Local\Temp\Purchase Order PDF pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order PDF pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CuqzAPPdXD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF523.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4004
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:188