nanocore | 693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5

General

Target

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
Size

164KB
MD5

5a1b5e4d63c21989d4fdb2fe360a66b0
SHA1

b2bb61777f900476928d411b39afab9dedee6932
SHA256

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5
SHA512

5a68446ecae76c03c203bddb36bbb095336524721b7757dfc72b7483a6368fdb648bb9cf23046788bebb33159c2bfea5e6f0ab71d7d0379f3ba579e89e94efc5
SSDEEP

3072:OtZOOh8ZIzKuKfeaUbOL72TKBb4npuou3MwQpGV2qh7cz9qX:4ZTqvpePi72TBob3M4cz9

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dongo = "C:\\Users\\Admin\\AppData\\Roamingtooniee.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	pid	process	target process
PID 4092 set thread context of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	pid	process
Token: SeDebugPrivilege	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
Token: SeDebugPrivilege	2372	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

description	pid	process	target process
PID 4092 wrote to memory of 4664	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 4092 wrote to memory of 4664	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 4092 wrote to memory of 4664	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	reg.exe
PID 4092 wrote to memory of 3668	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 4092 wrote to memory of 3668	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 4092 wrote to memory of 3668	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	WScript.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
PID 4092 wrote to memory of 2372	4092	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe	693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe

C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
"C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "dongo" /t REG_SZ /d "C:\Users\Admin\AppData\Roamingtooniee.exe" /f
2⤵
- Adds Run key to start application
PID:4664

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ttpxliobwshpmvb_vnkxnixzev1.vbs"
2⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe
"C:\Users\Admin\AppData\Local\Temp\693b52fdc63a82b49cfe7ce12a98cafc9e28b1f0607f1ad6e5924ce2c4af99e5.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ttpxliobwshpmvb_vnkxnixzev1.vbs
Filesize
397B

MD5
a673165db181adc2712865ce06042507

SHA1
c0a86470500cdf1ee822fe1d9811346830fa75d8

SHA256
1ecb449e2f449abd148aaa35dbdfdad7d4c4adddb17615c1a92356ec6189f31c

SHA512
196942ca50c3463e03eb4ac8071444de04c910f35084df690a2779334f788c808c40fee7aef30526b6ddc06e668fb501408a5939c27d399d9ff90507551ed90e

Download Submit
memory/2372-136-0x0000000000000000-mapping.dmp

Download
memory/2372-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2372-138-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/2372-140-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/3668-135-0x0000000000000000-mapping.dmp

Download
memory/4092-132-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/4092-133-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/4664-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads