nanocore | e6d99a83c9a9f307f08de2bd237b3d9ad6a104ec8901341943f5d92ebdd48587

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/02/2023, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x0006000000023161-187.exe
Size 203KB
Sample230222-ccptvsbc7v
SHA256 e6d99a83c9a9f307f08de2bd237b3d9ad6a104ec8901341943f5d92ebdd48587
MD5 ae5db5e672d91fb0f29857489c2a8cd3
SHA1 44067b00925afebb56a2b88489aa94aa25a4453e
SHA512 ff0853ee40d58154b06d0b7d2cc6d5896d1f4f5d2070660aa587872349f9b0ad553f693ad49ff8f9ce614fd31f0dc6fefc0f22cc09fea4537287b73272dccd5d
SSDEEP 3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HITAUHnWi8DnkE/pnQD/2uDEm+x:MLV6Bta6dtJmakIM5NoSDnkEuCuI1XS4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Monitor = "C:\\Program Files (x86)\\ISS Monitor\\issmon.exe"	0x0006000000023161-187.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0x0006000000023161-187.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ISS Monitor\issmon.exe	0x0006000000023161-187.exe
File opened for modification	C:\Program Files (x86)\ISS Monitor\issmon.exe	0x0006000000023161-187.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1596	schtasks.exe
300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	0x0006000000023161-187.exe
1468	0x0006000000023161-187.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1468	0x0006000000023161-187.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	0x0006000000023161-187.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1596	1468	0x0006000000023161-187.exe	27
PID 1468 wrote to memory of 1596	1468	0x0006000000023161-187.exe	27
PID 1468 wrote to memory of 1596	1468	0x0006000000023161-187.exe	27
PID 1468 wrote to memory of 1596	1468	0x0006000000023161-187.exe	27
PID 1468 wrote to memory of 300	1468	0x0006000000023161-187.exe	29
PID 1468 wrote to memory of 300	1468	0x0006000000023161-187.exe	29
PID 1468 wrote to memory of 300	1468	0x0006000000023161-187.exe	29
PID 1468 wrote to memory of 300	1468	0x0006000000023161-187.exe	29

C:\Users\Admin\AppData\Local\Temp\0x0006000000023161-187.exe
"C:\Users\Admin\AppData\Local\Temp\0x0006000000023161-187.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "ISS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4BA1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1596
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "ISS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4F3B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4BA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4BA1.tmp
Size 1KB
SHA256 6cea18285685dbd8260bf9bcd6668272040b51373e26a6a0d15b3440c7347d5e
MD5 562351f7536acd26e84b9b30dbd3e9b9
SHA1 fc7cd5a0765322b4156a9abcaf2d78752ece4022
SHA512 2a95ba720539386bcb07efc2f83e078e66296c8f1ac7f3ee37a56a24946e6ff49849652b9d9db47b74825c0ad9a068c270c42cdb78606f40110495a9e8ed13fb
MD5 SHA1 SHA512

Submit Download

tmp4F3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4F3B.tmp
Size 1KB
SHA256 937a440251a10c5a8921104975e5b7f166a34be5e48aa5c4ad344f8beadd1ad2
MD5 97ca1345e92062cecc79ad320a0e89b1
SHA1 9e696a4df86c685befe01d00a16611331ed7e763
SHA512 b7cce6586e4db4e387343c01977b0768fca8c4842098f1caf7e4240fa89273279b1ade5ed25aaf108102dd06c0ee945a24cf4786eb24de34520b4c11c2e82214
MD5 SHA1 SHA512

Submit Download

memory/1468-54-0x00000000009B0000-0x00000000009F0000-memory.dmp

Download

memory/1468-62-0x00000000009B0000-0x00000000009F0000-memory.dmp

Download