nanocore | 3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
Size 210KB
Sample221126-2zpvtafa7v
SHA256 3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b
MD5 e2783bd34e44f6de337f04e88f73249c
SHA1 6f7f92dc471b1dbb2b2b9392eea0e1375b384eee
SHA512 f567322e4a910e1c864dc65ab38afc994be204d34457a8c89a77eb7d0126718af3b0f70f304e48b99ef7f40dceb4b9a8a7cdab5986bb4327e7a2313816eafe59
SSDEEP 3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIpO9nxTY8Rt9cAP5o4iDFC11/v:QLV6Bta6dtJmakIM5JxbEzDwj9rCkr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Subsystem = "C:\\Program Files (x86)\\DHCP Subsystem\\dhcpss.exe"	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
File opened for modification	C:\Program Files (x86)\DHCP Subsystem\dhcpss.exe	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
372	schtasks.exe
4660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 372	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe	81
PID 1508 wrote to memory of 372	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe	81
PID 1508 wrote to memory of 372	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe	81
PID 1508 wrote to memory of 4660	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe	83
PID 1508 wrote to memory of 4660	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe	83
PID 1508 wrote to memory of 4660	1508	3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe	83

C:\Users\Admin\AppData\Local\Temp\3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
"C:\Users\Admin\AppData\Local\Temp\3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAD7B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:372
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAED4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpAD7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAD7B.tmp
Size 1KB
SHA256 a8b0fcd21f2cd626bd19bca8900f6fa993ce554378cb48e670e90a6388e368a2
MD5 37e353043872dd9871820b5a1b667a3c
SHA1 d957a0d83dad1fd90156b80260ed980c2215c2b3
SHA512 b76d8e64de10c2df82248896adba3b01439f0fb71b3b890d4fcf0eef46a7cb60be7375b633a9daf2130696a4280131a82e34514c0e0cf7a6573227dd2e013fb2
MD5 SHA1 SHA512

Submit Download

tmpAED4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAED4.tmp
Size 1KB
SHA256 99a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa
MD5 2f26d92c1eeead3896820e56ec46f6f1
SHA1 d95533b61eed7d89e4ada56bc566d60e42ac1f61
SHA512 6c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892
MD5 SHA1 SHA512

Submit Download

memory/1508-136-0x00000000750E0000-0x0000000075691000-memory.dmp

Download

memory/1508-140-0x00000000750E0000-0x0000000075691000-memory.dmp

Download