nanocore | f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7

Analysis

max time kernel
188s
max time network
238s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe
Size 204KB
Sample221127-wjt7psbf4x
SHA256 f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7
MD5 ece8ed492c7a2417b327aea0fbf3bac7
SHA1 2f2bc9e5145b1755f99c50f17a091f9261be9bd2
SHA512 5f3a0bb0d1631ec5e1a20eb62b92c21f04912fc723ba3101b0602dcd78fc6f4bbb3f085eff8216dc18f3e6d65023f64854d16d6c54f6e0f4f3a85b95d6ca6b4c
SSDEEP 3072:tbpZKxysDiVsd8fHyXORSksrHyReACFWTl+N9bB/FZX6E9X0TR/cjfIn31lxmd:tbpUyVszXOTsDyR4NZNfryR+fE1rmd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCI Subsystem = "C:\\Program Files\\PCI Subsystem\\pciss.exe"	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\PCI Subsystem\pciss.exe	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe
File opened for modification	C:\Program Files\PCI Subsystem\pciss.exe	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1256	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe
1256	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1256	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe

C:\Users\Admin\AppData\Local\Temp\f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe
"C:\Users\Admin\AppData\Local\Temp\f40e2c15d8a94598348cac1639f0a52f924abb178e41fc4b3515d9a9ec4044c7.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x000007FEF4500000-0x000007FEF4F23000-memory.dmp

Download

memory/1256-55-0x000007FEF3460000-0x000007FEF44F6000-memory.dmp

Download

memory/1256-56-0x0000000001F96000-0x0000000001FB5000-memory.dmp

Download

memory/1256-57-0x0000000001F96000-0x0000000001FB5000-memory.dmp

Download