nanocore | b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377

Analysis

max time kernel
167s
max time network
184s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe
Size 202KB
Sample221127-aaf3tsec94
SHA256 b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377
MD5 5472c2a0a95951ca53aed7b89a93a87c
SHA1 73fe78c867e80c26280f4cd82c2dec7bfb86b392
SHA512 83fc0ac76280a45f10cb71e7692f8ec66538555a4cf02ec05060b977c7fd6c9a9f13c57399cc0d070f516347c8d1c6dcb3356f3f1c712f1953d23fa21c8453c6
SSDEEP 6144:gLV6Bta6dtJmakIM56HBwffWIF5xDXFmyZe:gLV6BtpmktshrDXhZe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe"	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SCSI Service\scsisvc.exe	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe
File created	C:\Program Files (x86)\SCSI Service\scsisvc.exe	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1976	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe
1976	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe

C:\Users\Admin\AppData\Local\Temp\b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe
"C:\Users\Admin\AppData\Local\Temp\b4f5c995616b6fcf2365f902247d36552179b8cfd7a3895a1e9222bc37db0377.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000076321000-0x0000000076323000-memory.dmp

Download

memory/1976-55-0x0000000074830000-0x0000000074DDB000-memory.dmp

Download

memory/1976-56-0x0000000074830000-0x0000000074DDB000-memory.dmp

Download