nanocore | b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
Size 203KB
Sample230215-ev5ddahf5y
SHA256 b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1
MD5 2a29203e8e3a737ae594cf297934f774
SHA1 fd16de17cefc29fb52f688984d833a59ea59c87b
SHA512 e1f4753649c9856aae34534102f6fb026de5ffd05029ebe0100ade7de7030b5cb61f530491419ec94565dcffdf8cdeb30732338e4284f08a91676a664428f5b2
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIULPAGTwjgaxODOeSQcY/UShKT:sLV6Bta6dtJmakIM5dr8PxtPY/1KT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Manager = "C:\\Program Files (x86)\\DSL Manager\\dslmgr.exe"	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DSL Manager\dslmgr.exe	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
File opened for modification	C:\Program Files (x86)\DSL Manager\dslmgr.exe	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2596	schtasks.exe
3964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
Token: SeDebugPrivilege	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2596	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	82
PID 1020 wrote to memory of 2596	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	82
PID 1020 wrote to memory of 2596	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	82
PID 1020 wrote to memory of 3964	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	84
PID 1020 wrote to memory of 3964	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	84
PID 1020 wrote to memory of 3964	1020	b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe	84

C:\Users\Admin\AppData\Local\Temp\b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe
"C:\Users\Admin\AppData\Local\Temp\b672bd4c224065328f5370da54087782c044200421b400384d0dc93e1590efe1.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DSL Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp85CF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2596
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DSL Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp866C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp85CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp85CF.tmp
Size 1KB
SHA256 a2fd7169637cf71fc6fc7d8dcae5e8ae0720bb00ba430e1250e7479d63dc54a3
MD5 ae606a9aebf9e54b10ce6b0f38d7674c
SHA1 9f869e814a1be9ee994c7bd1b034bf2d3178da23
SHA512 21255805ee94a6406341c34b52aecf13f9b7f68142f34a877c268b4b851fadf56f4ae944fcf554abbe7c9874e06dbc25717f49db9b8c923b4c745d6452874cfe
MD5 SHA1 SHA512

Submit Download

tmp866C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp866C.tmp
Size 1KB
SHA256 099c4a82d8e8ddf5ff801a8f08fb5a143834506e936ce846b380a42eb24e888e
MD5 a0bcaf1694d4fcae2c44258530850f35
SHA1 99e9ccea3a9dca8d94808f6488fdc37c0b3bfe73
SHA512 ad3f2fbc09f7d57c24a35a62f00251c93d480e065f3b7fbc7133736cb144a3031fdc9f3e8be8a1c6dcdb8b3def654618faab416f66a28628ab71e55de4df0da3
MD5 SHA1 SHA512

Submit Download

memory/1020-132-0x0000000074E50000-0x0000000075401000-memory.dmp

Download

memory/1020-137-0x0000000074E50000-0x0000000075401000-memory.dmp

Download