nanocore | dc5a63b06f0be5f96267b2ebfe28a4e7644de021cce402dd666f7454233bd96b

Analysis

max time kernel
135s
max time network
125s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/05/2022, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XUY.exe
Size 869KB
Sample220524-prq2padher
SHA256 dc5a63b06f0be5f96267b2ebfe28a4e7644de021cce402dd666f7454233bd96b
MD5 1d43452837e9f7c03353b92a317fef5f
SHA1 5223c5999ad3ab8adda7a80579687dba58d8459a
SHA512 08f565fbf2d21775ea268a9f49a9a8718b47957c1f85f0d71799af2541386e62dff8599618eb93024a4d80824e7c5efafba351f7cd0aa3db213fee73b326f0bc
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer suricata trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Service = "C:\\Program Files (x86)\\ARP Service\\arpsvc.exe"	XUY.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XUY.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 556 set thread context of 900	556	XUY.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ARP Service\arpsvc.exe	XUY.exe
File opened for modification	C:\Program Files (x86)\ARP Service\arpsvc.exe	XUY.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
624	schtasks.exe
540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
900	XUY.exe
900	XUY.exe
900	XUY.exe
900	XUY.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
900	XUY.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	XUY.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 556 wrote to memory of 900	556	XUY.exe	30
PID 900 wrote to memory of 624	900	XUY.exe	28
PID 900 wrote to memory of 624	900	XUY.exe	28
PID 900 wrote to memory of 624	900	XUY.exe	28
PID 900 wrote to memory of 624	900	XUY.exe	28
PID 900 wrote to memory of 540	900	XUY.exe	31
PID 900 wrote to memory of 540	900	XUY.exe	31
PID 900 wrote to memory of 540	900	XUY.exe	31
PID 900 wrote to memory of 540	900	XUY.exe	31

C:\Users\Admin\AppData\Local\Temp\XUY.exe
"C:\Users\Admin\AppData\Local\Temp\XUY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\XUY.exe
  "C:\Users\Admin\AppData\Local\Temp\XUY.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "ARP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9974.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:540

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9648.tmp"
1⤵
- Creates scheduled task(s)
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp9648.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9648.tmp
Size 1KB
SHA256 53c0386917f5858aaaef8ac1a58972d7a79f69360ac2380ed9eef96cbd9faebb
MD5 4c46754d466a774821743e0933b484b9
SHA1 2795c9421ea907699b9a5c14705bfba45d01a4d2
SHA512 676f5ee70eaeed7280b1a0aa42ba89f5d4661fdcb1dbebe1e65e7d9adaf3d6f37ba1c3158c3a412ab0a21a97bc9a4a2dae6535baf2fdc668510f5a0d70bc3c23
MD5 SHA1 SHA512

Submit Download

tmp9974.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9974.tmp
Size 1KB
SHA256 6259ac4e6859a1b528d77ccea12b378f7dfa1eff359d9b8899414b4b1c484699
MD5 1badb6e2b29a1c4bfff3c179d53ab96b
SHA1 4b2ad3e5f3826d252d1c8bf1c8f0702f39129fa1
SHA512 36338e2a74fd85c5f2c84be009981a7260692c1bcb121a42018209031082da69bf65640702d53e28b54871f9d44e65fdbebaf4771c530699c3e93981b58129b4
MD5 SHA1 SHA512

Submit Download

memory/556-55-0x00000000755C1000-0x00000000755C3000-memory.dmp

Download

memory/556-56-0x0000000000310000-0x0000000000326000-memory.dmp

Download

memory/556-57-0x0000000004E30000-0x0000000004EC6000-memory.dmp

Download

memory/556-58-0x0000000004ED0000-0x0000000004F0A000-memory.dmp

Download

memory/556-54-0x0000000000F10000-0x0000000000FF0000-memory.dmp

Download

memory/900-65-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-80-0x0000000000A00000-0x0000000000A1A000-memory.dmp

Download

memory/900-59-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-63-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-68-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-70-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-62-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-76-0x0000000000850000-0x000000000085A000-memory.dmp

Download

memory/900-77-0x0000000000960000-0x000000000097E000-memory.dmp

Download

memory/900-78-0x0000000000980000-0x000000000098A000-memory.dmp

Download

memory/900-60-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-79-0x00000000009F0000-0x0000000000A02000-memory.dmp

Download

memory/900-82-0x0000000000BB0000-0x0000000000BC2000-memory.dmp

Download

memory/900-84-0x0000000000BD0000-0x0000000000BDE000-memory.dmp

Download

memory/900-86-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/900-85-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

Download

memory/900-83-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Download

memory/900-81-0x0000000000A30000-0x0000000000A3E000-memory.dmp

Download

memory/900-87-0x0000000000C40000-0x0000000000C54000-memory.dmp

Download

memory/900-89-0x0000000000CB0000-0x0000000000CDE000-memory.dmp

Download

memory/900-88-0x0000000000C50000-0x0000000000C5E000-memory.dmp

Download

memory/900-90-0x0000000000CE0000-0x0000000000CF4000-memory.dmp

Download