nanocore | 60e043d0e9b384af13ce6b204353d5f476643ce0bddc6525ec82a02b1c5a007d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x0007000000005c50-55.exe
Size

202KB
MD5

e54dc692fc878604d4492d153f9f2b33
SHA1

07f5669492ee017da27bd1d2acfe22e414594d54
SHA256

60e043d0e9b384af13ce6b204353d5f476643ce0bddc6525ec82a02b1c5a007d
SHA512

0a350ad78030711ad3af4c1a8f71a33da56912e066b09e896ad8c24287538a185f151c6c05eef550a965cfc621848c0fdf47c12e965cfdff190be84b1e87d6a4
SSDEEP

6144:wLV6Bta6dtJmakIM5plWUu5LYkO0TrWSQ:wLV6Btpmk2lM5LYkO0TKZ

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0x0007000000005c50-55.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe"	0x0007000000005c50-55.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

0x0007000000005c50-55.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0x0007000000005c50-55.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0x0007000000005c50-55.exe

Drops file in Program Files directory 2 IoCs

Processes:

0x0007000000005c50-55.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	0x0007000000005c50-55.exe
File opened for modification	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	0x0007000000005c50-55.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

0x0007000000005c50-55.exe

pid process

4832 0x0007000000005c50-55.exe
4832 0x0007000000005c50-55.exe
4832 0x0007000000005c50-55.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

0x0007000000005c50-55.exe

pid process

4832 0x0007000000005c50-55.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0x0007000000005c50-55.exe

description pid process

Token: SeDebugPrivilege 4832 0x0007000000005c50-55.exe

pid	process
4832	0x0007000000005c50-55.exe
4832	0x0007000000005c50-55.exe
4832	0x0007000000005c50-55.exe

pid	process
4832	0x0007000000005c50-55.exe

description	pid	process
Token: SeDebugPrivilege	4832	0x0007000000005c50-55.exe

C:\Users\Admin\AppData\Local\Temp\0x0007000000005c50-55.exe
"C:\Users\Admin\AppData\Local\Temp\0x0007000000005c50-55.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-132-0x0000000074AB0000-0x0000000075061000-memory.dmp

Filesize
5.7MB

Download
memory/4832-133-0x0000000074AB0000-0x0000000075061000-memory.dmp

Filesize
5.7MB

Download