nanocore | 9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3

General

Target
9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe
Size 454KB
Sample221119-kl9vdsce64
SHA256 9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3
MD5 1b640c9d8fc4fda1f4b3212115289330
SHA1 b0fcc65c890a6396f84f6df6d93e39698b8b7d33
SHA512 6f5a919ade266eedf58db633ba726cf981b1f6840049f12da94780143f53b495d81f88a2de72592079bd98766f5eac4ea8e6e94a5381f3c73d5260a444cba528
SSDEEP 6144:QX59ZTk+piRo6b4Ygg3vpncqNn5Llhci5PHn5zT:QX50RoC/pcqNf6s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
buffer_size
0
build_time
0001-01-01T00:00:00Z
bypass_user_account_control
false
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
0
connection_port
0
default_group
enable_debug_mode
false
gc_threshold
0
keep_alive_timeout
0
keyboard_logging
false
lan_timeout
0
max_packet_size
0
mutex
mutex_timeout
0
prevent_system_sleep
false
primary_connection_host
primary_dns_server
request_elevation
false
restart_delay
0
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
0
use_custom_dns_server
false
version
wan_timeout
0

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\file.exe"	reg.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
2696	svhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	svhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	svhost.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	svhost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe
2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe
2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe
2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe
2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 116	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	82
PID 2024 wrote to memory of 116	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	82
PID 2024 wrote to memory of 116	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	82
PID 116 wrote to memory of 2432	116	cmd.exe	84
PID 116 wrote to memory of 2432	116	cmd.exe	84
PID 116 wrote to memory of 2432	116	cmd.exe	84
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85
PID 2024 wrote to memory of 2696	2024	9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe	85

C:\Users\Admin\AppData\Local\Temp\9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe
"C:\Users\Admin\AppData\Local\Temp\9bc2bba318aecc1ef57689961d368e43b83fb59b39095d08525a3471727fc7c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderName\file.exe" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2432
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  C:\Users\Admin\AppData\Local\Temp\svhost.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  PID:2696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 52KB
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 52KB
SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
MD5 a64daca3cfbcd039df3ec29d3eddd001
SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2024-133-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

memory/2024-140-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

memory/2696-136-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2696-139-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

memory/2696-141-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads