nanocore | dc5a63b06f0be5f96267b2ebfe28a4e7644de021cce402dd666f7454233bd96b

Analysis

max time kernel
77s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/05/2022, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XUY.exe
Size 869KB
Sample220524-prq2padher
SHA256 dc5a63b06f0be5f96267b2ebfe28a4e7644de021cce402dd666f7454233bd96b
MD5 1d43452837e9f7c03353b92a317fef5f
SHA1 5223c5999ad3ab8adda7a80579687dba58d8459a
SHA512 08f565fbf2d21775ea268a9f49a9a8718b47957c1f85f0d71799af2541386e62dff8599618eb93024a4d80824e7c5efafba351f7cd0aa3db213fee73b326f0bc
MD5 SHA1 SHA512

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe"	XUY.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XUY.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3692 set thread context of 1888	3692	XUY.exe	86

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Service\tcpsvc.exe	XUY.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsvc.exe	XUY.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1104	schtasks.exe
556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3692	XUY.exe
3692	XUY.exe
1888	XUY.exe
1888	XUY.exe
1888	XUY.exe
1888	XUY.exe
1888	XUY.exe
1888	XUY.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1888	XUY.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	XUY.exe
Token: SeDebugPrivilege	1888	XUY.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4844	3692	XUY.exe	85
PID 3692 wrote to memory of 4844	3692	XUY.exe	85
PID 3692 wrote to memory of 4844	3692	XUY.exe	85
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 3692 wrote to memory of 1888	3692	XUY.exe	86
PID 1888 wrote to memory of 1104	1888	XUY.exe	88
PID 1888 wrote to memory of 1104	1888	XUY.exe	88
PID 1888 wrote to memory of 1104	1888	XUY.exe	88
PID 1888 wrote to memory of 556	1888	XUY.exe	90
PID 1888 wrote to memory of 556	1888	XUY.exe	90
PID 1888 wrote to memory of 556	1888	XUY.exe	90

C:\Users\Admin\AppData\Local\Temp\XUY.exe
"C:\Users\Admin\AppData\Local\Temp\XUY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Local\Temp\XUY.exe
  "C:\Users\Admin\AppData\Local\Temp\XUY.exe"
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\XUY.exe
  "C:\Users\Admin\AppData\Local\Temp\XUY.exe"
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp19F0.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1104
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1ABD.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XUY.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XUY.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

tmp19F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp19F0.tmp
Size 1KB
SHA256 53c0386917f5858aaaef8ac1a58972d7a79f69360ac2380ed9eef96cbd9faebb
MD5 4c46754d466a774821743e0933b484b9
SHA1 2795c9421ea907699b9a5c14705bfba45d01a4d2
SHA512 676f5ee70eaeed7280b1a0aa42ba89f5d4661fdcb1dbebe1e65e7d9adaf3d6f37ba1c3158c3a412ab0a21a97bc9a4a2dae6535baf2fdc668510f5a0d70bc3c23
MD5 SHA1 SHA512

Submit Download

tmp1ABD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1ABD.tmp
Size 1KB
SHA256 9911b4513e44521c90c020ddcddea1ddc58095055a72ec638b593bf9ee23aa72
MD5 9db6095f31f8b4ae8173fe11424a8dfe
SHA1 4b0655ae95def24a41710ca137649d93bfa49407
SHA512 5bee977264545a30a2d53e674f54a4066d4529dc9162d46911b9cac957052cdc1ea7c8d60f9c57d3f33db6cb964b1e6bb2347d0e0e2af0a32ac98938c02ffc1c
MD5 SHA1 SHA512

Submit Download

memory/1888-138-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3692-133-0x0000000004F10000-0x0000000004F1A000-memory.dmp

Download

memory/3692-135-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/3692-134-0x0000000005AE0000-0x0000000005B7C000-memory.dmp

Download

memory/3692-130-0x00000000004B0000-0x0000000000590000-memory.dmp

Download

memory/3692-132-0x0000000004F80000-0x0000000005012000-memory.dmp

Download

memory/3692-131-0x0000000005530000-0x0000000005AD4000-memory.dmp

Download