nanocore | f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333

General

Target

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
Size

220KB
MD5

31a3abe2824e6e4cce48e207df6b3aa5
SHA1

cd1466b5c1e964c53ade0acdcd3ad6ecf2fc8505
SHA256

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333
SHA512

c93a1310ebcfe3472e68a4db45d1dabfabaa18711997286d9f2986bae1d63d66f3e09a397c6bde3c12d11e4669b6e9a699fa6ad09a657d603c1749e45971e7e2
SSDEEP

3072:xKNQHcGBMVpXUxRVE+FXeRiD1zuO9T1eRp7VFtJW6uVRK0q/3/v:xK5+MVpWRVyR6uI1eP7VFtJkwv

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exewinlogon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	winlogon.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winlogon.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

winlogon.exe

description pid process target process

PID 4604 set thread context of 3912 4604 winlogon.exe winlogon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

description	pid	process	target process
PID 4604 set thread context of 3912	4604	winlogon.exe	winlogon.exe

Drops file in Program Files directory 2 IoCs

Processes:

winlogon.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	winlogon.exe
File opened for modification	C:\Program Files (x86)\TCP Subsystem\tcpss.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

winlogon.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winlogon.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exewinlogon.exe

pid	process
4620	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
4620	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe
4604	winlogon.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe

pid process

4620 f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exewinlogon.exe

description	pid	process
Token: SeDebugPrivilege	4620	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
Token: SeDebugPrivilege	4604	winlogon.exe
Token: SeDebugPrivilege	4604	winlogon.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exewinlogon.exe

description	pid	process	target process
PID 4620 wrote to memory of 4604	4620	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe	winlogon.exe
PID 4620 wrote to memory of 4604	4620	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe	winlogon.exe
PID 4620 wrote to memory of 4604	4620	f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe	winlogon.exe
PID 4604 wrote to memory of 1976	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 1976	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 1976	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe
PID 4604 wrote to memory of 3912	4604	winlogon.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe
"C:\Users\Admin\AppData\Local\Temp\f1fdc6b05605137aabff3b59e49b489866673a93706d52247a74f1c6441ed333.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
3⤵
PID:1976

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
3⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:3912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3912-136-0x0000000000000000-mapping.dmp

Download
memory/3912-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3912-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3912-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3912-141-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/3912-143-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/4604-134-0x0000000000000000-mapping.dmp

Download
memory/4604-142-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/4604-144-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/4620-133-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download
memory/4620-135-0x00000000751A0000-0x0000000075751000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads