nanocore | e90ec79bd12ab12fe9f1fa7cf0d1914d9c1e996fb779ed3f034601f53512dbe5

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp.exe
Size 203KB
Sample240206-wk9c1secbj
SHA256 e90ec79bd12ab12fe9f1fa7cf0d1914d9c1e996fb779ed3f034601f53512dbe5
MD5 141692a757c19e19e62d238da4534ae8
SHA1 f8b1b987caef5760d89e2bfdc5c84acd31eebf96
SHA512 64838a2d3c28a973c8dc8921413cb3b99da408ca16550a57d3a0cc9144c42c23f9045e1c7a22f8b79e61145de740ce2447b69892697043e2c17a9a21f71fb434
SSDEEP 3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIyqPAGTwjgaxODOeSQcY/UShKU:MLV6Bta6dtJmakIM5ar8PxtPY/1KU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmp.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2192	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3816	tmp.exe
3816	tmp.exe
3816	tmp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3816	tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	tmp.exe
Token: SeDebugPrivilege	3816	tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2192	3816	tmp.exe	84
PID 3816 wrote to memory of 2192	3816	tmp.exe	84
PID 3816 wrote to memory of 2192	3816	tmp.exe	84

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "SMTP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7177.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7177.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7177.tmp
Size 1KB
SHA256 b8475eb97200b8a15eaf07e0a2cddc5c95e5bc3e7a98685364c9796480de57dc
MD5 3f4dcafa44c36f23e4db2b2315fd09da
SHA1 8c83089d6f6c887a77af9b42ca09969f3b2f83f6
SHA512 e0624dd6cf0d5e014e96a323d2f7ebe13b683af71bd6ddafa3005cdc2f3c764cfca509262d442fc844b4b390d241ccf3eb36d30043d3d6f6e955a2ee9f792678
MD5 SHA1 SHA512

Submit Download

memory/3816-0-0x0000000075510000-0x0000000075AC1000-memory.dmp

Download

memory/3816-1-0x0000000075510000-0x0000000075AC1000-memory.dmp

Download

memory/3816-2-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Download

memory/3816-7-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Download

memory/3816-8-0x0000000075510000-0x0000000075AC1000-memory.dmp

Download

memory/3816-9-0x0000000075510000-0x0000000075AC1000-memory.dmp

Download

memory/3816-10-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Download