nanocore | f14e866d2cafc4a365f8c5bd013e95a858026d7f58de438596f873cbf0ab85c9

Analysis

max time kernel
86s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/02/2023, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x00090000000122fc-64.exe
Size 203KB
Sample230220-pt81aaba65
SHA256 f14e866d2cafc4a365f8c5bd013e95a858026d7f58de438596f873cbf0ab85c9
MD5 eb9d21375344239c90eaf8644568b487
SHA1 612dfcef8af6153ab456b6207aa918a2123c9e49
SHA512 8132b87dec1eb707b829bd431c3f6e7da9ddf48f3e1f8c2c332403e24c6b4af01b2f9bd449d16fa4968e02cb184a8e24b3741e480669fca97f2e5b2ee401b61a
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIZ1iT05t4Ziu8hBVv4TPcXQZq3:sLV6Bta6dtJmakIM5pGtMMnEcXs7hml
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	0x00090000000122fc-64.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0x00090000000122fc-64.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	0x00090000000122fc-64.exe
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	0x00090000000122fc-64.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1940	schtasks.exe
672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1156	0x00090000000122fc-64.exe
1156	0x00090000000122fc-64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1156	0x00090000000122fc-64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	0x00090000000122fc-64.exe
Token: SeDebugPrivilege	1156	0x00090000000122fc-64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1940	1156	0x00090000000122fc-64.exe	26
PID 1156 wrote to memory of 1940	1156	0x00090000000122fc-64.exe	26
PID 1156 wrote to memory of 1940	1156	0x00090000000122fc-64.exe	26
PID 1156 wrote to memory of 1940	1156	0x00090000000122fc-64.exe	26
PID 1156 wrote to memory of 672	1156	0x00090000000122fc-64.exe	28
PID 1156 wrote to memory of 672	1156	0x00090000000122fc-64.exe	28
PID 1156 wrote to memory of 672	1156	0x00090000000122fc-64.exe	28
PID 1156 wrote to memory of 672	1156	0x00090000000122fc-64.exe	28

C:\Users\Admin\AppData\Local\Temp\0x00090000000122fc-64.exe
"C:\Users\Admin\AppData\Local\Temp\0x00090000000122fc-64.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp69CB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1940
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6D55.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp69CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp69CB.tmp
Size 1KB
SHA256 ddf799ce1065a6bbbf0e030d9cd0e5784129f6ba03f419109bbfa9e5e6520427
MD5 21de5c5ca5a27114a7d9ad18962a5803
SHA1 ed66ceaf7e7bd3e5948758b9999ba2d212cf9383
SHA512 65263b115d2e097c9834aa5e58d310b482436074b7df36aecec53bd7b3e7ca7348372e75022550960c107cddbba60afb802e8836f80d49e23d242a9fca750d6f
MD5 SHA1 SHA512

Submit Download

tmp6D55.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6D55.tmp
Size 1KB
SHA256 38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
MD5 0a24db62cb5b84309c4803346caaa25d
SHA1 67660778f61bb44168c33ed3fe56ed86cf9583e8
SHA512 d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
MD5 SHA1 SHA512

Submit Download

memory/1156-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Download

memory/1156-55-0x0000000074290000-0x000000007483B000-memory.dmp

Download

memory/1156-60-0x0000000074290000-0x000000007483B000-memory.dmp

Download