nanocore | 384adbc413173598ae36874969fe270ba41afa49f7047e73375d59297b81a437

General

Target

0ec24eaee9d1d498d1c3dff8f558579e.exe
Size

371KB
MD5

0ec24eaee9d1d498d1c3dff8f558579e
SHA1

7906c183a506a3de3ba6a9c2245d27636edf072d
SHA256

384adbc413173598ae36874969fe270ba41afa49f7047e73375d59297b81a437
SHA512

de40f805cb3cab5fbe35f5ae697228858d3a7a2db8135560eb74c3d831e2007d484935e4dd3761f690af3b0f281d1a4016c34021f0cae20c5a64f56fb9176410
SSDEEP

6144:jLV6Bta6dtJmakIM5dPanJkZNPieC7yoIA1L8wG:jLV6Btpmk6aJk7aX7yVF

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe"	0ec24eaee9d1d498d1c3dff8f558579e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0ec24eaee9d1d498d1c3dff8f558579e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	0ec24eaee9d1d498d1c3dff8f558579e.exe
File opened for modification	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	0ec24eaee9d1d498d1c3dff8f558579e.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1520	schtasks.exe
1148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	0ec24eaee9d1d498d1c3dff8f558579e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe
Token: SeDebugPrivilege	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1520	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	27
PID 1944 wrote to memory of 1520	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	27
PID 1944 wrote to memory of 1520	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	27
PID 1944 wrote to memory of 1520	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	27
PID 1944 wrote to memory of 1148	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	29
PID 1944 wrote to memory of 1148	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	29
PID 1944 wrote to memory of 1148	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	29
PID 1944 wrote to memory of 1148	1944	0ec24eaee9d1d498d1c3dff8f558579e.exe	29

C:\Users\Admin\AppData\Local\Temp\0ec24eaee9d1d498d1c3dff8f558579e.exe
"C:\Users\Admin\AppData\Local\Temp\0ec24eaee9d1d498d1c3dff8f558579e.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1520
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2E62.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2E62.tmp

Filesize
1KB

MD5
981e126601526eaa5b0ad45c496c4465

SHA1
d610d6a21a8420cc73fcd3e54ddae75a5897b28b

SHA256
11ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527

SHA512
a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7E.tmp

Filesize
1KB

MD5
1f4a62c023c8a1f58de20fa15e3c7857

SHA1
9a817d44995d049f63c3316abc612376846cb329

SHA256
b9a79cbabc7126cd7e57e61b5ed9036c9d32184bac2b8928b8bc1a7720fe5d3a

SHA512
fb96eb7ed09c20ddd1413f1ff35d213d3e79c187f966f22627ea92fb553c29f3c72bcf1ff28491ae0ef97fc092fbf99a435a1a8aed1048c1c444c9ce0dbc62ae

Download Submit
memory/1944-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1944-55-0x0000000075040000-0x00000000755EB000-memory.dmp

Filesize
5.7MB

Download
memory/1944-59-0x0000000075040000-0x00000000755EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads