nanocore | e6d99a83c9a9f307f08de2bd237b3d9ad6a104ec8901341943f5d92ebdd48587

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2023, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x0006000000023161-187.exe
Size 203KB
Sample230222-ccptvsbc7v
SHA256 e6d99a83c9a9f307f08de2bd237b3d9ad6a104ec8901341943f5d92ebdd48587
MD5 ae5db5e672d91fb0f29857489c2a8cd3
SHA1 44067b00925afebb56a2b88489aa94aa25a4453e
SHA512 ff0853ee40d58154b06d0b7d2cc6d5896d1f4f5d2070660aa587872349f9b0ad553f693ad49ff8f9ce614fd31f0dc6fefc0f22cc09fea4537287b73272dccd5d
SSDEEP 3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HITAUHnWi8DnkE/pnQD/2uDEm+x:MLV6Bta6dtJmakIM5NoSDnkEuCuI1XS4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Host = "C:\\Program Files (x86)\\DPI Host\\dpihost.exe"	0x0006000000023161-187.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0x0006000000023161-187.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Host\dpihost.exe	0x0006000000023161-187.exe
File opened for modification	C:\Program Files (x86)\DPI Host\dpihost.exe	0x0006000000023161-187.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2400	schtasks.exe
3280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
612	0x0006000000023161-187.exe
612	0x0006000000023161-187.exe
612	0x0006000000023161-187.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
612	0x0006000000023161-187.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	0x0006000000023161-187.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 2400	612	0x0006000000023161-187.exe	82
PID 612 wrote to memory of 2400	612	0x0006000000023161-187.exe	82
PID 612 wrote to memory of 2400	612	0x0006000000023161-187.exe	82
PID 612 wrote to memory of 3280	612	0x0006000000023161-187.exe	84
PID 612 wrote to memory of 3280	612	0x0006000000023161-187.exe	84
PID 612 wrote to memory of 3280	612	0x0006000000023161-187.exe	84

C:\Users\Admin\AppData\Local\Temp\0x0006000000023161-187.exe
"C:\Users\Admin\AppData\Local\Temp\0x0006000000023161-187.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DPI Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC086.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2400
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DPI Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpC086.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC086.tmp
Size 1KB
SHA256 6cea18285685dbd8260bf9bcd6668272040b51373e26a6a0d15b3440c7347d5e
MD5 562351f7536acd26e84b9b30dbd3e9b9
SHA1 fc7cd5a0765322b4156a9abcaf2d78752ece4022
SHA512 2a95ba720539386bcb07efc2f83e078e66296c8f1ac7f3ee37a56a24946e6ff49849652b9d9db47b74825c0ad9a068c270c42cdb78606f40110495a9e8ed13fb
MD5 SHA1 SHA512

Submit Download

tmpC1DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC1DF.tmp
Size 1KB
SHA256 3ee6ae0dca5c4564f13e70f2a70ecbe979c9d9d575cd9762f15039aaa3823a86
MD5 acd483df2f8ed28b2ad2bbcfe774f43f
SHA1 e89d74ed4ba3824e652e1f4267bb8b60e3b50581
SHA512 59a9003c18f714c1ab14238bf2891b602ae3d8de49785a72e629648240176b29aabc741d7bdd244f06d5fe1a52c905b6288a0fe401f49df342200749a7de2092
MD5 SHA1 SHA512

Submit Download

memory/612-136-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Download

memory/612-141-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Download

memory/612-142-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Download

memory/612-143-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Download