nanocore | 8293f8ec81938cfd92083ba744826f3077846f3482777cc7c6ea46cfbd2fc73c

General

Target

25ab25ebbc71a46070104c1d785b62ac.exe
Size

301KB
MD5

25ab25ebbc71a46070104c1d785b62ac
SHA1

6444155774547189adbc93ce13334ef8570910c2
SHA256

8293f8ec81938cfd92083ba744826f3077846f3482777cc7c6ea46cfbd2fc73c
SHA512

35dbdb10e46ecfce4a39f1e0131a0411fcf2f89473f47a00bca77047648f218b59aa89963d45462f99ddcefee6907d12408053313a7cdf642a38025a6f210a77
SSDEEP

6144:aLV6Bta6dtJmakIM5oZ0lGKhnz0mJ+zAapxe:aLV6BtpmkZZ0lGKhnz0AAzpxe

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Manager = "C:\\Program Files (x86)\\AGP Manager\\agpmgr.exe"	25ab25ebbc71a46070104c1d785b62ac.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	25ab25ebbc71a46070104c1d785b62ac.exe

Drops file in Program Files directory 2 IoCs

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

description	ioc	process
File created	C:\Program Files (x86)\AGP Manager\agpmgr.exe	25ab25ebbc71a46070104c1d785b62ac.exe
File opened for modification	C:\Program Files (x86)\AGP Manager\agpmgr.exe	25ab25ebbc71a46070104c1d785b62ac.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1972 schtasks.exe
1272 schtasks.exe

pid	process
1972	schtasks.exe
1272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

pid	process
832	25ab25ebbc71a46070104c1d785b62ac.exe
832	25ab25ebbc71a46070104c1d785b62ac.exe
832	25ab25ebbc71a46070104c1d785b62ac.exe
832	25ab25ebbc71a46070104c1d785b62ac.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

pid process

832 25ab25ebbc71a46070104c1d785b62ac.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

description pid process

Token: SeDebugPrivilege 832 25ab25ebbc71a46070104c1d785b62ac.exe
Token: SeDebugPrivilege 832 25ab25ebbc71a46070104c1d785b62ac.exe

description	pid	process
Token: SeDebugPrivilege	832	25ab25ebbc71a46070104c1d785b62ac.exe
Token: SeDebugPrivilege	832	25ab25ebbc71a46070104c1d785b62ac.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

25ab25ebbc71a46070104c1d785b62ac.exe

description	pid	process	target process
PID 832 wrote to memory of 1272	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1272	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1272	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1272	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1972	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1972	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1972	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe
PID 832 wrote to memory of 1972	832	25ab25ebbc71a46070104c1d785b62ac.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\25ab25ebbc71a46070104c1d785b62ac.exe
"C:\Users\Admin\AppData\Local\Temp\25ab25ebbc71a46070104c1d785b62ac.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF558.tmp"
2⤵
- Creates scheduled task(s)
PID:1272

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "AGP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF8E1.tmp"
2⤵
- Creates scheduled task(s)
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF558.tmp
Filesize
1KB

MD5
17fa6cd12662dd40c1dfa48f0c461c16

SHA1
c48a18b08ffcb22beb1821b317efdd5cea2fea6f

SHA256
179728606d634eff798ef12c4ab3a1d83a4943267435f7bbc39f3c4f64e1dc02

SHA512
fcbf46fb84103c518217ef1d92bfa1f6b60973fef83c9b894593caa41ccadde61946a81ed33f1a4de85f35f5a46007739607648b12d3a7dbe1a595b0b71d72ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF8E1.tmp
Filesize
1KB

MD5
885d6dd30570594e167fadb59d9ca0ea

SHA1
9981e583644c4eb9cf5056615a0e1c2913c8983b

SHA256
7155bc082d1713d77c2797575ee0ade8467fb7012f5376c1d6f4aa618141a7d2

SHA512
1623218143c2c25a7c85fa9da8e0f251f04a5eb848c4d0aa10bfb78688518b82393a2b3c7f287a9dc06a366ef9f46d0d4e2d246ad4cef4554a74c0bb6ff9dd2a

Download Submit
memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/832-58-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/832-60-0x0000000074F90000-0x000000007553B000-memory.dmp

Filesize
5.7MB

Download
memory/1272-55-0x0000000000000000-mapping.dmp

Download
memory/1972-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads