nanocore | d61a1d0331d101743be750b79e620768b3d6fb3a01a8075806f6f3d063d89eb8

Analysis

max time kernel
146s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2022 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order#SQ031776.exe
Size

18KB
MD5

c2a18ada9607e7669fe7406261b83b43
SHA1

496cc34bb91df74c0832a098e1e0148194abc1bc
SHA256

d61a1d0331d101743be750b79e620768b3d6fb3a01a8075806f6f3d063d89eb8
SHA512

a8e1f87e33df47a3721712f2dcfefd55e51fd3379d6484a36910effed0be73610ed724d01a9d49c360c57b9f2d56a07e794b9cbafed03335cc61084473b04c79
SSDEEP

384:+Ypst0Uf+vAo/1b8XCt/z6ejVAFJL5jHaKDj0Ck3jso:1pWBf+vAoNWI/zpcNQC0Ck3F

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Order#SQ031776.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Order#SQ031776.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Order#SQ031776.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Order#SQ031776.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeOrder#SQ031776.exe

pid process

2012 powershell.exe
2012 powershell.exe
3816 Order#SQ031776.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order#SQ031776.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3816 Order#SQ031776.exe
Token: SeDebugPrivilege 2012 powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Order#SQ031776.exe

pid	process
2012	powershell.exe
2012	powershell.exe
3816	Order#SQ031776.exe

description	pid	process
Token: SeDebugPrivilege	3816	Order#SQ031776.exe
Token: SeDebugPrivilege	2012	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Order#SQ031776.exe

description	pid	process	target process
PID 3816 wrote to memory of 2012	3816	Order#SQ031776.exe	powershell.exe
PID 3816 wrote to memory of 2012	3816	Order#SQ031776.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Order#SQ031776.exe
"C:\Users\Admin\AppData\Local\Temp\Order#SQ031776.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-136-0x0000000000000000-mapping.dmp

Download
memory/2012-137-0x00007FFFE7F70000-0x00007FFFE8A31000-memory.dmp

Filesize
10.8MB

Download
memory/2012-138-0x00007FFFE7F70000-0x00007FFFE8A31000-memory.dmp

Filesize
10.8MB

Download
memory/2012-139-0x00007FFFE7F70000-0x00007FFFE8A31000-memory.dmp

Filesize
10.8MB

Download
memory/3816-132-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/3816-133-0x00007FFFE7F70000-0x00007FFFE8A31000-memory.dmp

Filesize
10.8MB

Download
memory/3816-134-0x00007FFFE7F70000-0x00007FFFE8A31000-memory.dmp

Filesize
10.8MB

Download
memory/3816-135-0x0000000002B80000-0x0000000002BA2000-memory.dmp

Filesize
136KB

Download