nanocore | 3c0512176cbca3ce1b0abc5f505a3abbcd39909c20095d995f019197f42439d3

Analysis

max time kernel
139s
max time network
154s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
05-08-2022 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
Size

181KB
MD5

19230db458718df6fa70d9817925ac7a
SHA1

04eba42e98b996b5b9e1783e37de8b45c42d56f4
SHA256

3c0512176cbca3ce1b0abc5f505a3abbcd39909c20095d995f019197f42439d3
SHA512

81b7c7e56d37ac11294ec815ca90e84c528385941caf410f205ae6c181ca5e7a47e4dd8d572df9e5e6ac3a0caf58768d6049755c030aa67b8b2101b7af401712

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ARP Monitor = "C:\\Program Files\\ARP Monitor\\arpmon.exe"	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

Drops file in Program Files directory 2 IoCs

Processes:

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

description	ioc	process
File created	C:\Program Files\ARP Monitor\arpmon.exe	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
File opened for modification	C:\Program Files\ARP Monitor\arpmon.exe	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

pid process

996 3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
996 3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

pid process

996 3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

pid	process
996	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
996	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

pid	process
996	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

description	pid	process
Token: SeDebugPrivilege	996	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
Token: SeDebugPrivilege	996	3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe

C:\Users\Admin\AppData\Local\Temp\3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe
"C:\Users\Admin\AppData\Local\Temp\3C0512176CBCA3CE1B0ABC5F505A3ABBCD39909C20095.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-54-0x000007FEF3310000-0x000007FEF3D33000-memory.dmp

Filesize
10.1MB

Download
memory/996-55-0x000007FEF2270000-0x000007FEF3306000-memory.dmp

Filesize
16.6MB

Download
memory/996-56-0x0000000001E96000-0x0000000001EB5000-memory.dmp

Filesize
124KB

Download