nanocore | 1fa01c5bc146dad0626756cf1e49065ed9934b3b1a12b75f2ba20daa213fb8c8

General

Target

hellsing (desync).exe
Size

210KB
MD5

d5e1f1c116ec87d5a87cd658a1f5ea14
SHA1

fb504851b1c844ef54f0bb0de6e169b7d70a8e99
SHA256

1fa01c5bc146dad0626756cf1e49065ed9934b3b1a12b75f2ba20daa213fb8c8
SHA512

dc0b0b5f4dc902d5e2992a8de19aa0fbda1f86b9075abf84a501ed5a64d1fc8f4d0fbbfcc40ec8187f5c65f1148f7bf65d6941e3d690a25d778c7032a04e01d7
SSDEEP

6144:SLV6Bta6dtJmakIM5ClRJg66MRyxF8DVI2d3F:SLV6BtpmkXuEUGVImV

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AGP Subsystem = "C:\\Program Files\\AGP Subsystem\\agpss.exe"	hellsing (desync).exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hellsing (desync).exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\AGP Subsystem\agpss.exe	hellsing (desync).exe
File opened for modification	C:\Program Files\AGP Subsystem\agpss.exe	hellsing (desync).exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2160	schtasks.exe
2244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3344	hellsing (desync).exe
3344	hellsing (desync).exe
3344	hellsing (desync).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3344	hellsing (desync).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	hellsing (desync).exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2160	3344	hellsing (desync).exe	87
PID 3344 wrote to memory of 2160	3344	hellsing (desync).exe	87
PID 3344 wrote to memory of 2244	3344	hellsing (desync).exe	89
PID 3344 wrote to memory of 2244	3344	hellsing (desync).exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\hellsing (desync).exe
"C:\Users\Admin\AppData\Local\Temp\hellsing (desync).exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "AGP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8CFE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2160
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "AGP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8E76.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8CFE.tmp

Filesize
1KB

MD5
9e8e91cc3350c7392200313dc77cf585

SHA1
6fa1974f4c462f051d2274c2c7067a54e6a87b7e

SHA256
ba956e40f7b63266274a3e89623628756495b44361757ce3f36db1bbe662202c

SHA512
873692bab1f22dafbade9b65ddec98588a776f9b5a74199b285ee9b432487e22a85cf8f5d7a20b3a27787268efedc42eb6856dd7586955185c0fdd995df693b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8E76.tmp

Filesize
1KB

MD5
939c174b0103a84ef8e847bfd6ffba03

SHA1
2365d289c56ec180ba69940b8b09a739f78e6518

SHA256
caa9f74b043d7e7b7e84d465b99e8c95f0c71e586be0e4bfdf0f9ce1e10cd840

SHA512
c19588c4e399b7b7120fb5ededb84c6e7ecbb3a644cc641af787c8cca9c91f1d6e567f83f03d2ceccffbead2120f6250b51bbd3595a38d3b716ebf03759376eb

Download Submit
memory/3344-17-0x000000001D1F0000-0x000000001D1FA000-memory.dmp

Filesize
40KB

Download
memory/3344-18-0x000000001CB20000-0x000000001CB2C000-memory.dmp

Filesize
48KB

Download
memory/3344-4-0x00007FF899220000-0x00007FF899BC1000-memory.dmp

Filesize
9.6MB

Download
memory/3344-5-0x000000001C890000-0x000000001C936000-memory.dmp

Filesize
664KB

Download
memory/3344-6-0x0000000001640000-0x0000000001648000-memory.dmp

Filesize
32KB

Download
memory/3344-7-0x0000000001650000-0x0000000001660000-memory.dmp

Filesize
64KB

Download
memory/3344-9-0x000000001CB30000-0x000000001CC30000-memory.dmp

Filesize
1024KB

Download
memory/3344-10-0x0000000001650000-0x0000000001660000-memory.dmp

Filesize
64KB

Download
memory/3344-2-0x0000000001650000-0x0000000001660000-memory.dmp

Filesize
64KB

Download
memory/3344-19-0x000000001D400000-0x000000001D41E000-memory.dmp

Filesize
120KB

Download
memory/3344-3-0x000000001BC70000-0x000000001BD0C000-memory.dmp

Filesize
624KB

Download
memory/3344-0-0x000000001C210000-0x000000001C6DE000-memory.dmp

Filesize
4.8MB

Download
memory/3344-1-0x00007FF899220000-0x00007FF899BC1000-memory.dmp

Filesize
9.6MB

Download
memory/3344-20-0x000000001D920000-0x000000001D92A000-memory.dmp

Filesize
40KB

Download
memory/3344-21-0x000000001CB30000-0x000000001CC30000-memory.dmp

Filesize
1024KB

Download
memory/3344-22-0x00007FF899220000-0x00007FF899BC1000-memory.dmp

Filesize
9.6MB

Download
memory/3344-23-0x0000000001650000-0x0000000001660000-memory.dmp

Filesize
64KB

Download
memory/3344-24-0x00007FF899220000-0x00007FF899BC1000-memory.dmp

Filesize
9.6MB

Download
memory/3344-25-0x0000000001650000-0x0000000001660000-memory.dmp

Filesize
64KB

Download
memory/3344-26-0x000000001CB30000-0x000000001CC30000-memory.dmp

Filesize
1024KB

Download
memory/3344-27-0x0000000001650000-0x0000000001660000-memory.dmp

Filesize
64KB

Download
memory/3344-28-0x000000001CB30000-0x000000001CC30000-memory.dmp

Filesize
1024KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads