nanocore | 988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3dbd13c87a506bf0e97b7

General

Target

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
Size

203KB
MD5

4c342f040ad8b94e4f814e1f62e488ed
SHA1

f440ce00e772abd74f9e9e0ff8d227792b48712c
SHA256

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3dbd13c87a506bf0e97b7
SHA512

046adff832e07b7dbca40020a4c65412e5ed5e2d342b9d55219258b59f25a391752c0065e4ff9b1d504149a6f7226a6c8c4282aeb4a3fad3aeb68aa8f88e58cc

Score

10^/10

nanocore evasion keylogger persistence spyware stealer suricata trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe"	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

Drops file in Program Files directory 2 IoCs

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

description	ioc	process
File created	C:\Program Files (x86)\UDP Subsystem\udpss.exe	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
File opened for modification	C:\Program Files (x86)\UDP Subsystem\udpss.exe	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

516 schtasks.exe
992 schtasks.exe

pid	process
516	schtasks.exe
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

pid	process
680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

pid process

680 988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

description pid process

Token: SeDebugPrivilege 680 988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

description	pid	process
Token: SeDebugPrivilege	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe

description	pid	process	target process
PID 680 wrote to memory of 516	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 516	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 516	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 516	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 992	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 992	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 992	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe
PID 680 wrote to memory of 992	680	988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe
"C:\Users\Admin\AppData\Local\Temp\988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2CFA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:516
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2F5B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2CFA.tmp

MD5
1023da05db1a051437db9d4b3abbdb9e

SHA1
0316431d0f505092c6fc3878abd764b1ce20ae7a

SHA256
53e8d5471485ee4666659d4864cd88a24b0af51297e35045609d4b48eee3fa0a

SHA512
481f4b7752e230157c4112aa67e6d2ce3d496967a708cea4b2f72d7d58c4b40e31e16735bd88fc2cb2e95b78f7b75fe21e5b0d09ab61a9708d8fd2673edef111

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2F5B.tmp

MD5
c4aecdef99eba873119e79616df3f4b0

SHA1
b1b3af52655fb633eed909dfed05b64fbbfac37c

SHA256
24fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b

SHA512
e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4

Download Submit
memory/516-55-0x0000000000000000-mapping.dmp

Download
memory/680-54-0x0000000076B61000-0x0000000076B63000-memory.dmp

Filesize
8KB

Download
memory/680-57-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/992-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads