nanocore | f14e866d2cafc4a365f8c5bd013e95a858026d7f58de438596f873cbf0ab85c9

Analysis

max time kernel
72s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2023, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x00090000000122fc-64.exe
Size 203KB
Sample230220-pt81aaba65
SHA256 f14e866d2cafc4a365f8c5bd013e95a858026d7f58de438596f873cbf0ab85c9
MD5 eb9d21375344239c90eaf8644568b487
SHA1 612dfcef8af6153ab456b6207aa918a2123c9e49
SHA512 8132b87dec1eb707b829bd431c3f6e7da9ddf48f3e1f8c2c332403e24c6b4af01b2f9bd449d16fa4968e02cb184a8e24b3741e480669fca97f2e5b2ee401b61a
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIZ1iT05t4Ziu8hBVv4TPcXQZq3:sLV6Bta6dtJmakIM5pGtMMnEcXs7hml
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe"	0x00090000000122fc-64.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0x00090000000122fc-64.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Host\ddphost.exe	0x00090000000122fc-64.exe
File opened for modification	C:\Program Files (x86)\DDP Host\ddphost.exe	0x00090000000122fc-64.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1116	schtasks.exe
3364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2484	0x00090000000122fc-64.exe
2484	0x00090000000122fc-64.exe
2484	0x00090000000122fc-64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2484	0x00090000000122fc-64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	0x00090000000122fc-64.exe
Token: SeDebugPrivilege	2484	0x00090000000122fc-64.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1116	2484	0x00090000000122fc-64.exe	80
PID 2484 wrote to memory of 1116	2484	0x00090000000122fc-64.exe	80
PID 2484 wrote to memory of 1116	2484	0x00090000000122fc-64.exe	80
PID 2484 wrote to memory of 3364	2484	0x00090000000122fc-64.exe	82
PID 2484 wrote to memory of 3364	2484	0x00090000000122fc-64.exe	82
PID 2484 wrote to memory of 3364	2484	0x00090000000122fc-64.exe	82

C:\Users\Admin\AppData\Local\Temp\0x00090000000122fc-64.exe
"C:\Users\Admin\AppData\Local\Temp\0x00090000000122fc-64.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp96E6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1116
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp989C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp96E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp96E6.tmp
Size 1KB
SHA256 ddf799ce1065a6bbbf0e030d9cd0e5784129f6ba03f419109bbfa9e5e6520427
MD5 21de5c5ca5a27114a7d9ad18962a5803
SHA1 ed66ceaf7e7bd3e5948758b9999ba2d212cf9383
SHA512 65263b115d2e097c9834aa5e58d310b482436074b7df36aecec53bd7b3e7ca7348372e75022550960c107cddbba60afb802e8836f80d49e23d242a9fca750d6f
MD5 SHA1 SHA512

Submit Download

tmp989C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp989C.tmp
Size 1KB
SHA256 7aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
MD5 2271642ca970891700e3f48439739ed8
SHA1 cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA512 4669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
MD5 SHA1 SHA512

Submit Download

memory/2484-135-0x0000000074E50000-0x0000000075401000-memory.dmp

Download

memory/2484-140-0x0000000074E50000-0x0000000075401000-memory.dmp

Download