nanocore | d91912b4b945e88e881e54573390e6723cfc41916b6546453b59e60f9beee337

Analysis

max time kernel
1804s
max time network
1794s
platform
windows10_x64
resource
win10v20201028
submitted
20-11-2020 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c01b007729230c415420ad641ad92eb.exe

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

odm.exeodm.exe

pid process

3652 odm.exe
728 odm.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

odm.exeRegSvcs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

odm.exe

description pid process target process

PID 728 set thread context of 3876 728 odm.exe RegSvcs.exe
PID 728 set thread context of 3968 728 odm.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4076 3876 WerFault.exe RegSvcs.exe

description	pid	process	target process
PID 728 set thread context of 3876	728	odm.exe	RegSvcs.exe
PID 728 set thread context of 3968	728	odm.exe	RegSvcs.exe

pid	pid_target	process	target process
4076	3876	WerFault.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

odm.exeRegSvcs.exe

pid	process
3652	odm.exe
3652	odm.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe
3968	RegSvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

2c01b007729230c415420ad641ad92eb.exeodm.exeodm.exe

description	pid	process	target process
PID 640 wrote to memory of 3652	640	2c01b007729230c415420ad641ad92eb.exe	odm.exe
PID 640 wrote to memory of 3652	640	2c01b007729230c415420ad641ad92eb.exe	odm.exe
PID 640 wrote to memory of 3652	640	2c01b007729230c415420ad641ad92eb.exe	odm.exe
PID 3652 wrote to memory of 728	3652	odm.exe	odm.exe
PID 3652 wrote to memory of 728	3652	odm.exe	odm.exe
PID 3652 wrote to memory of 728	3652	odm.exe	odm.exe
PID 728 wrote to memory of 3876	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3876	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3876	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3876	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3968	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3968	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3968	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3968	728	odm.exe	RegSvcs.exe
PID 728 wrote to memory of 3968	728	odm.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe
"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CMWLB
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 88
        5⤵
        Program crash
        
        PID:4076
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\CMWLB
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:3968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wou\CMWLB

Download Submit
C:\Users\Admin\AppData\Roaming\wou\kja-pex

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Download Submit
C:\Users\Admin\AppData\Roaming\wou\rid.ico

Download Submit
C:\Users\Admin\AppData\Roaming\wou\spd

Download Submit
memory/728-11-0x00000000745E0000-0x0000000074673000-memory.dmp

Filesize
588KB

Download
memory/728-9-0x0000000000000000-mapping.dmp

Download
memory/3652-2-0x0000000000000000-mapping.dmp

Download
memory/3652-5-0x00000000745E0000-0x0000000074673000-memory.dmp

Filesize
588KB

Download
memory/3876-14-0x000000000047EAEE-mapping.dmp

Download
memory/3968-16-0x0000000000830000-0x00000000008FC000-memory.dmp

Filesize
816KB

Download
memory/3968-17-0x00000000008464E1-mapping.dmp

Download
memory/3968-18-0x0000000000830000-0x00000000008FC000-memory.dmp

Filesize
816KB

Download
memory/4076-15-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download