nanocore | 4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2022, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe
Size 203KB
Sample221110-rbttraadc7
SHA256 4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae
MD5 0f678c9be234b142a4a23041f6a2e419
SHA1 8f96cd47aef8118c0839990f7f6a67d9ec9831c1
SHA512 a0c6b8c851e9ea96bd4026d26b0cc167ec750c1c1563bdf1a87cf53afdc507e12e8530bc179aa3a8d216ee40b255b194e02e3b859616e49c89e475bb5df3bbca
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/xESwt6zj41CHDbVJzD7+cwu7:sLV6Bta6dtJmakIM5A7wtiwCbVJ3fz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe"	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe
File opened for modification	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4768	schtasks.exe
1008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe
1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe
1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4768	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe	83
PID 1368 wrote to memory of 4768	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe	83
PID 1368 wrote to memory of 4768	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe	83
PID 1368 wrote to memory of 1008	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe	85
PID 1368 wrote to memory of 1008	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe	85
PID 1368 wrote to memory of 1008	1368	4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe	85

C:\Users\Admin\AppData\Local\Temp\4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe
"C:\Users\Admin\AppData\Local\Temp\4def8f74ceadc735fcadf2cc6435efc5c5161760fef38dffb510f723bf2c3aae.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE072.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4768
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE16D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpE072.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE072.tmp
Size 1KB
SHA256 2f455cc948962bd348b83f4c0e7c2f939c9a4482a774582b17895acfb5d03698
MD5 40cb9f1d38dda7bd2ba1c932ee3626da
SHA1 ee2db1d9e8ad579dc7fd5f3e70893accf7e18a53
SHA512 71b4646dfbe4079a889a21f456f8e05fc9ad2efe1ad45a137a169fbe74b496c3656e8d880b4abe4e36358b61aae9793feff4f8352cbdc079c797fd277bbc5e7a
MD5 SHA1 SHA512

Submit Download

tmpE16D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE16D.tmp
Size 1KB
SHA256 99a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
MD5 2f26d92c1eeead3896820e56ec46f6f1
SHA1 d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA512 6c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
MD5 SHA1 SHA512

Submit Download

memory/1368-132-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1368-137-0x00000000752A0000-0x0000000075851000-memory.dmp

Download