nanocore | df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862

General

Target

df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exe
Size

312KB
MD5

5d00627acef34a061468495b8b122926
SHA1

1c22ab8f0fb40143f2695255da641d738b976d89
SHA256

df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862
SHA512

01e1ddfa3026293281e898e83fe9c717ec2ac04c200a2e5372e1328a0d99edc47f1183a70952faa9334f8322dd40d012a598ca14d53e5f3b02030d5f12d43acc
SSDEEP

6144:iBUKwblom4GBI4GdS12lZYp0kzrbWA0SCT1cACTfgjdlA:3xlom4G+4Go1MOxeA0z1kfgjdlA

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.execsrss.exe

pid process

4496 winlogon.exe
3424 winlogon.exe
4828 csrss.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exewinlogon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

csrss.exewinlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe"	csrss.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

winlogon.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winlogon.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

winlogon.exe

description pid process target process

PID 4496 set thread context of 3424 4496 winlogon.exe winlogon.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

winlogon.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

description	pid	process	target process
PID 4496 set thread context of 3424	4496	winlogon.exe	winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winlogon.execsrss.exewinlogon.exe

pid	process
4496	winlogon.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
3424	winlogon.exe
3424	winlogon.exe
3424	winlogon.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe
4828	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winlogon.exe

pid process

3424 winlogon.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

winlogon.execsrss.exewinlogon.exe

description pid process

Token: SeDebugPrivilege 4496 winlogon.exe
Token: SeDebugPrivilege 4828 csrss.exe
Token: SeDebugPrivilege 3424 winlogon.exe

pid	process
3424	winlogon.exe

description	pid	process
Token: SeDebugPrivilege	4496	winlogon.exe
Token: SeDebugPrivilege	4828	csrss.exe
Token: SeDebugPrivilege	3424	winlogon.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exewinlogon.exe

description	pid	process	target process
PID 1036 wrote to memory of 4496	1036	df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exe	winlogon.exe
PID 1036 wrote to memory of 4496	1036	df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 3424	4496	winlogon.exe	winlogon.exe
PID 4496 wrote to memory of 4828	4496	winlogon.exe	csrss.exe
PID 4496 wrote to memory of 4828	4496	winlogon.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exe
"C:\Users\Admin\AppData\Local\Temp\df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496

C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -keyhide -prochide 3424 -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 3424 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe
Filesize
4KB

MD5
e1190859ab4f21e58d1873afc1b3cff2

SHA1
50d4f9f444dba70b9918c4b812b5d9a098e0f867

SHA256
9b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73

SHA512
f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\winlogon.exe
Filesize
4KB

MD5
e1190859ab4f21e58d1873afc1b3cff2

SHA1
50d4f9f444dba70b9918c4b812b5d9a098e0f867

SHA256
9b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73

SHA512
f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
Filesize
312KB

MD5
5d00627acef34a061468495b8b122926

SHA1
1c22ab8f0fb40143f2695255da641d738b976d89

SHA256
df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862

SHA512
01e1ddfa3026293281e898e83fe9c717ec2ac04c200a2e5372e1328a0d99edc47f1183a70952faa9334f8322dd40d012a598ca14d53e5f3b02030d5f12d43acc

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe
Filesize
312KB

MD5
5d00627acef34a061468495b8b122926

SHA1
1c22ab8f0fb40143f2695255da641d738b976d89

SHA256
df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862

SHA512
01e1ddfa3026293281e898e83fe9c717ec2ac04c200a2e5372e1328a0d99edc47f1183a70952faa9334f8322dd40d012a598ca14d53e5f3b02030d5f12d43acc

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
Filesize
312KB

MD5
5d00627acef34a061468495b8b122926

SHA1
1c22ab8f0fb40143f2695255da641d738b976d89

SHA256
df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862

SHA512
01e1ddfa3026293281e898e83fe9c717ec2ac04c200a2e5372e1328a0d99edc47f1183a70952faa9334f8322dd40d012a598ca14d53e5f3b02030d5f12d43acc

Download Submit
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe
Filesize
312KB

MD5
5d00627acef34a061468495b8b122926

SHA1
1c22ab8f0fb40143f2695255da641d738b976d89

SHA256
df044df75d68bdc85e0ba0821df2574d128532837eca817e83a4412ce27fc862

SHA512
01e1ddfa3026293281e898e83fe9c717ec2ac04c200a2e5372e1328a0d99edc47f1183a70952faa9334f8322dd40d012a598ca14d53e5f3b02030d5f12d43acc

Download Submit
memory/1036-132-0x00007FFB7EA30000-0x00007FFB7F466000-memory.dmp

Filesize
10.2MB

Download
memory/3424-141-0x000000000041C01E-mapping.dmp

Download
memory/3424-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-148-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download
memory/3424-149-0x00000000745B0000-0x0000000074B61000-memory.dmp

Filesize
5.7MB

Download
memory/4496-136-0x00007FFB7EA30000-0x00007FFB7F466000-memory.dmp

Filesize
10.2MB

Download
memory/4496-133-0x0000000000000000-mapping.dmp

Download
memory/4828-144-0x0000000000000000-mapping.dmp

Download
memory/4828-147-0x00007FFB7EA30000-0x00007FFB7F466000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads