nanocore | 14c87644c759f663c02774c31adb0e8ea00c557dd659c5693fe6563b75dea250

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe
Size 203KB
Sample230321-yy8dzsch92
SHA256 540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1
MD5 702681c442d61dc4a9719bd3e377dc17
SHA1 7d191d6a62e3abdd7d45d5d50fcce0abd421ea9e
SHA512 2dc0ccf469987567cf4f962cf82d412c16e61a4b9e9ca12f62d8a08897db6cbe39fab4c6f839ff19ec1a5676e52b452f444fee2f6f403856fd1ce3ec73205123
SSDEEP 6144:sLV6Bta6dtJmakIM53n/kAflqT1une7R0s1e2:sLV6Btpmkc/FU5e2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Host = "C:\\Program Files (x86)\\DPI Host\\dpihost.exe"	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Host\dpihost.exe	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe
File opened for modification	C:\Program Files (x86)\DPI Host\dpihost.exe	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4416	schtasks.exe
2080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe
3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe
3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2080	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe	86
PID 3116 wrote to memory of 2080	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe	86
PID 3116 wrote to memory of 2080	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe	86
PID 3116 wrote to memory of 4416	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe	88
PID 3116 wrote to memory of 4416	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe	88
PID 3116 wrote to memory of 4416	3116	540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe	88

C:\Users\Admin\AppData\Local\Temp\540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe
"C:\Users\Admin\AppData\Local\Temp\540003093308be1893002f0a75e73be010488151d91e36d4a19b8260557e68f1.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DPI Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8B4D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2080
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DPI Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp904F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8B4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8B4D.tmp
Size 1KB
SHA256 5a8ead83b5f748e5dc8e854c5f1eb8d3aebd0529aef6753c3b72dc1c9e820509
MD5 e8ab067ce435e2de2db97623909269d4
SHA1 2257a6f8de044c4bc6cc1d50af0504ecca064198
SHA512 0101c06c1323b5be0ccec7f445b71e80e0628243c58cbda9afbf1cffb6af7c82efece95bfc57274469410263cff019589b64287b6124e4bcd6ddfe3f3315018a
MD5 SHA1 SHA512

Submit Download

tmp904F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp904F.tmp
Size 1KB
SHA256 3ee6ae0dca5c4564f13e70f2a70ecbe979c9d9d575cd9762f15039aaa3823a86
MD5 acd483df2f8ed28b2ad2bbcfe774f43f
SHA1 e89d74ed4ba3824e652e1f4267bb8b60e3b50581
SHA512 59a9003c18f714c1ab14238bf2891b602ae3d8de49785a72e629648240176b29aabc741d7bdd244f06d5fe1a52c905b6288a0fe401f49df342200749a7de2092
MD5 SHA1 SHA512

Submit Download

memory/3116-133-0x0000000001940000-0x0000000001950000-memory.dmp

Download

memory/3116-141-0x0000000001940000-0x0000000001950000-memory.dmp

Download

memory/3116-142-0x0000000001940000-0x0000000001950000-memory.dmp

Download

memory/3116-143-0x0000000001940000-0x0000000001950000-memory.dmp

Download