nanocore | 52c0b7d7bda6a4ec4e97c7be75aa098c3399768478bf798034b1d3851d37b5a5

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x002a00000000f66c-1394.exe
Size

203KB
MD5

0f6c959105b95ab977bf1539cfe7286a
SHA1

834065fe82965a1d452dc85e0b6dba34cbf8e19a
SHA256

52c0b7d7bda6a4ec4e97c7be75aa098c3399768478bf798034b1d3851d37b5a5
SHA512

81b0dd7ad5e27d40747ce28dcad1850842ba653cb5d98f14baa33543671eb2d85b4c9d20863e331b90362ac6502c5526a5a550be88868f45566673387ace4cbc
SSDEEP

6144:sLV6Bta6dtJmakIM5DPjoWNdOPgZpqS0J:sLV6Btpmk7EdOPQpG

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DOS Monitor = "C:\\Program Files (x86)\\DOS Monitor\\dosmon.exe"	0x002a00000000f66c-1394.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0x002a00000000f66c-1394.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DOS Monitor\dosmon.exe	0x002a00000000f66c-1394.exe
File opened for modification	C:\Program Files (x86)\DOS Monitor\dosmon.exe	0x002a00000000f66c-1394.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1612	schtasks.exe
2268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4896	0x002a00000000f66c-1394.exe
4896	0x002a00000000f66c-1394.exe
4896	0x002a00000000f66c-1394.exe
4896	0x002a00000000f66c-1394.exe
4896	0x002a00000000f66c-1394.exe
4896	0x002a00000000f66c-1394.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	0x002a00000000f66c-1394.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	0x002a00000000f66c-1394.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1612	4896	0x002a00000000f66c-1394.exe	85
PID 4896 wrote to memory of 1612	4896	0x002a00000000f66c-1394.exe	85
PID 4896 wrote to memory of 1612	4896	0x002a00000000f66c-1394.exe	85
PID 4896 wrote to memory of 2268	4896	0x002a00000000f66c-1394.exe	87
PID 4896 wrote to memory of 2268	4896	0x002a00000000f66c-1394.exe	87
PID 4896 wrote to memory of 2268	4896	0x002a00000000f66c-1394.exe	87

C:\Users\Admin\AppData\Local\Temp\0x002a00000000f66c-1394.exe
"C:\Users\Admin\AppData\Local\Temp\0x002a00000000f66c-1394.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DOS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7FDE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1612
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DOS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp80BA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7FDE.tmp

Filesize
1KB

MD5
d376adb95e4dbeed9b3e42e3670747e4

SHA1
ab493fafb570e9c5ba0d0074f28c8ee27b44dfd8

SHA256
e1b519868da46cdddeaf034065a3ce42d48efd6cc4e94d53a95436d8637ed679

SHA512
4efaee890a09d7afd49b4df76e4d85f4c2b79188dee176251670ad521f022d2763135f9f2af544f92742081d313af6c5b6d7dbcf2c051333678ba54a71d92e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp80BA.tmp

Filesize
1KB

MD5
b167179960db9fca3a7c0fa38c6f4cf7

SHA1
bd26271dc26fde6e47f87624100dc31c3e710226

SHA256
e8c60ac3403e13489278a82b5ece6bc092c27a69b6f5359275bc6b1c57bd1f13

SHA512
2d4a7bdab2e4a67ef6092f42b373a81f53800ff7772736cd2828d376159ddb4eebc29a3a12007fe70dc2c63712a9ac1a1a31a45b5d401a6fc01d4690dbbb75cc

Download Submit
memory/4896-133-0x0000000075000000-0x00000000755B1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-134-0x0000000075000000-0x00000000755B1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-135-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download
memory/4896-143-0x0000000075000000-0x00000000755B1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-144-0x0000000075000000-0x00000000755B1000-memory.dmp

Filesize
5.7MB

Download
memory/4896-145-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download