nanocore | 693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5

General

Target

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
Size

164KB
MD5

5a1b5e4d63c21989d4fdb2fe360a66b0
SHA1

b2bb61777f900476928d411b39afab9dedee6932
SHA256

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5
SHA512

5a68446ecae76c03c203bddb36bbb095336524721b7757dfc72b7483a6368fdb648bb9cf23046788bebb33159c2bfea5e6f0ab71d7d0379f3ba579e89e94efc5
SSDEEP

3072:OtZOOh8ZIzKuKfeaUbOL72TKBb4npuou3MwQpGV2qh7cz9qX:4ZTqvpePi72TBob3M4cz9

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\dongo = "C:\\Users\\Admin\\AppData\\Roamingtooniee.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	pid	process	target process
PID 1036 set thread context of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	pid	process
Token: SeDebugPrivilege	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
Token: SeDebugPrivilege	1008	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	pid	process	target process
PID 1036 wrote to memory of 2008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 1036 wrote to memory of 2008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 1036 wrote to memory of 2008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 1036 wrote to memory of 2008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 1036 wrote to memory of 1992	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 1036 wrote to memory of 1992	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 1036 wrote to memory of 1992	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 1036 wrote to memory of 1992	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 1036 wrote to memory of 1008	1036	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
"C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "dongo" /t REG_SZ /d "C:\Users\Admin\AppData\Roamingtooniee.exe" /f
2⤵
- Adds Run key to start application
PID:2008

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ttpxliobwshpmvb_vnkxnixzev1.vbs"
2⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
"C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ttpxliobwshpmvb_vnkxnixzev1.vbs

Filesize
397B

MD5
a673165db181adc2712865ce06042507

SHA1
c0a86470500cdf1ee822fe1d9811346830fa75d8

SHA256
1ecb449e2f449abd148aaa35dbdfdad7d4c4adddb17615c1a92356ec6189f31c

SHA512
196942ca50c3463e03eb4ac8071444de04c910f35084df690a2779334f788c808c40fee7aef30526b6ddc06e668fb501408a5939c27d399d9ff90507551ed90e

Download Submit
memory/1008-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-75-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1008-74-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1008-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-66-0x00000000004160BA-mapping.dmp

Download
memory/1036-56-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1036-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1036-55-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-58-0x0000000000000000-mapping.dmp

Download
memory/2008-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads