nanocore | 1fa01c5bc146dad0626756cf1e49065ed9934b3b1a12b75f2ba20daa213fb8c8

Resubmissions

11/11/2023, 19:31

231111-x8drpabc5z 10

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

hellsing (desync).exe
Size

210KB
MD5

d5e1f1c116ec87d5a87cd658a1f5ea14
SHA1

fb504851b1c844ef54f0bb0de6e169b7d70a8e99
SHA256

1fa01c5bc146dad0626756cf1e49065ed9934b3b1a12b75f2ba20daa213fb8c8
SHA512

dc0b0b5f4dc902d5e2992a8de19aa0fbda1f86b9075abf84a501ed5a64d1fc8f4d0fbbfcc40ec8187f5c65f1148f7bf65d6941e3d690a25d778c7032a04e01d7
SSDEEP

6144:SLV6Bta6dtJmakIM5ClRJg66MRyxF8DVI2d3F:SLV6BtpmkXuEUGVImV

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCP Manager = "C:\\Program Files\\TCP Manager\\tcpmgr.exe"	hellsing (desync).exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hellsing (desync).exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\TCP Manager\tcpmgr.exe	hellsing (desync).exe
File opened for modification	C:\Program Files\TCP Manager\tcpmgr.exe	hellsing (desync).exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2992	schtasks.exe
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	hellsing (desync).exe
1724	hellsing (desync).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1724	hellsing (desync).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	hellsing (desync).exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2992	1724	hellsing (desync).exe	28
PID 1724 wrote to memory of 2992	1724	hellsing (desync).exe	28
PID 1724 wrote to memory of 2992	1724	hellsing (desync).exe	28
PID 1724 wrote to memory of 2604	1724	hellsing (desync).exe	30
PID 1724 wrote to memory of 2604	1724	hellsing (desync).exe	30
PID 1724 wrote to memory of 2604	1724	hellsing (desync).exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\hellsing (desync).exe
"C:\Users\Admin\AppData\Local\Temp\hellsing (desync).exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /f /tn "TCP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7A00.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2992
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /f /tn "TCP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp894D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7A00.tmp

Filesize
1KB

MD5
9e8e91cc3350c7392200313dc77cf585

SHA1
6fa1974f4c462f051d2274c2c7067a54e6a87b7e

SHA256
ba956e40f7b63266274a3e89623628756495b44361757ce3f36db1bbe662202c

SHA512
873692bab1f22dafbade9b65ddec98588a776f9b5a74199b285ee9b432487e22a85cf8f5d7a20b3a27787268efedc42eb6856dd7586955185c0fdd995df693b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp894D.tmp

Filesize
1KB

MD5
112800c9e4e657831029fcec32627580

SHA1
034416597bd5d227f23149788cbfb183083c2afc

SHA256
beefa06238552287f2eeedc9851b5c2147b187c221ff7db639359c8a8e5e3cd2

SHA512
daa1050d3cbda6d9637952bf31ddc0aa2db626703f691bc97b59b31cf5b7e490caa4aedbeec6090a5fc66992ee7b000af9f55ff7b0549ae4d54a6be67674539d

Download Submit
memory/1724-11-0x0000000000790000-0x000000000079A000-memory.dmp

Filesize
40KB

Download
memory/1724-4-0x000007FEF5160000-0x000007FEF5AFD000-memory.dmp

Filesize
9.6MB

Download
memory/1724-2-0x0000000001FD0000-0x0000000002050000-memory.dmp

Filesize
512KB

Download
memory/1724-1-0x0000000001FD0000-0x0000000002050000-memory.dmp

Filesize
512KB

Download
memory/1724-0-0x000007FEF5160000-0x000007FEF5AFD000-memory.dmp

Filesize
9.6MB

Download
memory/1724-13-0x0000000001FD0000-0x0000000002050000-memory.dmp

Filesize
512KB

Download
memory/1724-12-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/1724-14-0x0000000000710000-0x000000000072E000-memory.dmp

Filesize
120KB

Download
memory/1724-15-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/1724-16-0x0000000001FD0000-0x0000000002050000-memory.dmp

Filesize
512KB

Download
memory/1724-17-0x000007FEF5160000-0x000007FEF5AFD000-memory.dmp

Filesize
9.6MB

Download
memory/1724-18-0x0000000001FD0000-0x0000000002050000-memory.dmp

Filesize
512KB

Download
memory/1724-19-0x000007FEF5160000-0x000007FEF5AFD000-memory.dmp

Filesize
9.6MB

Download