nanocore | e90ec79bd12ab12fe9f1fa7cf0d1914d9c1e996fb779ed3f034601f53512dbe5

Analysis

max time kernel
134s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
141692a757c19e19e62d238da4534ae8.exe
Size 203KB
Sample240206-nwp5hsgfgp
SHA256 e90ec79bd12ab12fe9f1fa7cf0d1914d9c1e996fb779ed3f034601f53512dbe5
MD5 141692a757c19e19e62d238da4534ae8
SHA1 f8b1b987caef5760d89e2bfdc5c84acd31eebf96
SHA512 64838a2d3c28a973c8dc8921413cb3b99da408ca16550a57d3a0cc9144c42c23f9045e1c7a22f8b79e61145de740ce2447b69892697043e2c17a9a21f71fb434
SSDEEP 3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIyqPAGTwjgaxODOeSQcY/UShKU:MLV6Bta6dtJmakIM5ar8PxtPY/1KU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	141692a757c19e19e62d238da4534ae8.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	141692a757c19e19e62d238da4534ae8.exe
2420	141692a757c19e19e62d238da4534ae8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	141692a757c19e19e62d238da4534ae8.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	141692a757c19e19e62d238da4534ae8.exe
Token: SeDebugPrivilege	2420	141692a757c19e19e62d238da4534ae8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1276	2420	141692a757c19e19e62d238da4534ae8.exe	28
PID 2420 wrote to memory of 1276	2420	141692a757c19e19e62d238da4534ae8.exe	28
PID 2420 wrote to memory of 1276	2420	141692a757c19e19e62d238da4534ae8.exe	28
PID 2420 wrote to memory of 1276	2420	141692a757c19e19e62d238da4534ae8.exe	28

C:\Users\Admin\AppData\Local\Temp\141692a757c19e19e62d238da4534ae8.exe
"C:\Users\Admin\AppData\Local\Temp\141692a757c19e19e62d238da4534ae8.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4338.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4338.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4338.tmp
Size 1KB
SHA256 6f6570a7caff2567b968cba11d9cb07feeb54f483c7527687d22915132240619
MD5 9616ce559020263e49183d9838d08777
SHA1 28d4694526a611aee5d7ac40e0a1a306d8626b4d
SHA512 55642c1a41cb46e67ce5a27667eba64b5e81781f6d0b761d565b7391ee9902e7650afa34998e11ec9cefb45de488ff7ad77c17885db62a29167bbf1c3934ee50
MD5 SHA1 SHA512

Submit Download

memory/2420-0-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Download

memory/2420-1-0x00000000009E0000-0x0000000000A20000-memory.dmp

Download

memory/2420-2-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Download

memory/2420-7-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Download

memory/2420-8-0x00000000009E0000-0x0000000000A20000-memory.dmp

Download

memory/2420-9-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Download