nanocore | b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
Size 203KB
Sample230215-ejr9nshe7y
SHA256 b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1
MD5 2a29203e8e3a737ae594cf297934f774
SHA1 fd16de17cefc29fb52f688984d833a59ea59c87b
SHA512 e1f4753649c9856aae34534102f6fb026de5ffd05029ebe0100ade7de7030b5cb61f530491419ec94565dcffdf8cdeb30732338e4284f08a91676a664428f5b2
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIULPAGTwjgaxODOeSQcY/UShKT:sLV6Bta6dtJmakIM5dr8PxtPY/1KT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe"	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
File opened for modification	C:\Program Files (x86)\DDP Manager\ddpmgr.exe	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4248	schtasks.exe
1516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
Token: SeDebugPrivilege	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4248	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	79
PID 1188 wrote to memory of 4248	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	79
PID 1188 wrote to memory of 4248	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	79
PID 1188 wrote to memory of 1516	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	81
PID 1188 wrote to memory of 1516	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	81
PID 1188 wrote to memory of 1516	1188	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	81

C:\Users\Admin\AppData\Local\Temp\b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
"C:\Users\Admin\AppData\Local\Temp\b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF2D1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4248
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF3FB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpF2D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF2D1.tmp
Size 1KB
SHA256 a2fd7169637cf71fc6fc7d8dcae5e8ae0720bb00ba430e1250e7479d63dc54a3
MD5 ae606a9aebf9e54b10ce6b0f38d7674c
SHA1 9f869e814a1be9ee994c7bd1b034bf2d3178da23
SHA512 21255805ee94a6406341c34b52aecf13f9b7f68142f34a877c268b4b851fadf56f4ae944fcf554abbe7c9874e06dbc25717f49db9b8c923b4c745d6452874cfe
MD5 SHA1 SHA512

Submit Download

tmpF3FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF3FB.tmp
Size 1KB
SHA256 8bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
MD5 677848190631e19222304d1982aa2e1b
SHA1 bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA512 f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
MD5 SHA1 SHA512

Submit Download

memory/1188-132-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1188-137-0x0000000075470000-0x0000000075A21000-memory.dmp

Download