nanocore | 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0

General

Target
07D9144C3B3CFE44C24F850A74FAAACC.exe
Size 203KB
Sample240420-snfnbsbd28
SHA256 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0
MD5 07d9144c3b3cfe44c24f850a74faaacc
SHA1 1df82c6dbe192d9f78e137bb96c499fd5f0c93a5
SHA512 39120f944f46dfa34f0d4a2e59a9bdb74a76d9f69b55c054969a96666b0366651bcc2a0ab4a48f3243a2046e961f43fba5e13d5b04248eeae0f86b7428133584
SSDEEP 6144:sLV6Bta6dtJmakIM51O3JM1fMKQqa7FPp0k4v:sLV6BtpmkBGpC78v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe"	07D9144C3B3CFE44C24F850A74FAAACC.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	07D9144C3B3CFE44C24F850A74FAAACC.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
131	0.tcp.eu.ngrok.io
135	0.tcp.eu.ngrok.io
9	0.tcp.eu.ngrok.io
64	0.tcp.eu.ngrok.io
69	0.tcp.eu.ngrok.io
96	0.tcp.eu.ngrok.io
120	0.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UDP Subsystem\udpss.exe	07D9144C3B3CFE44C24F850A74FAAACC.exe
File opened for modification	C:\Program Files (x86)\UDP Subsystem\udpss.exe	07D9144C3B3CFE44C24F850A74FAAACC.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1640	schtasks.exe
3672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4716	07D9144C3B3CFE44C24F850A74FAAACC.exe
4716	07D9144C3B3CFE44C24F850A74FAAACC.exe
4716	07D9144C3B3CFE44C24F850A74FAAACC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4716	07D9144C3B3CFE44C24F850A74FAAACC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1640	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe	88
PID 4716 wrote to memory of 1640	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe	88
PID 4716 wrote to memory of 1640	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe	88
PID 4716 wrote to memory of 3672	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe	90
PID 4716 wrote to memory of 3672	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe	90
PID 4716 wrote to memory of 3672	4716	07D9144C3B3CFE44C24F850A74FAAACC.exe	90

C:\Users\Admin\AppData\Local\Temp\07D9144C3B3CFE44C24F850A74FAAACC.exe
"C:\Users\Admin\AppData\Local\Temp\07D9144C3B3CFE44C24F850A74FAAACC.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "UDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3F1C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1640
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "UDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3F8A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3F1C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3F1C.tmp
Size 1KB
SHA256 83c08b8306a8f76e1a1baad4521084d7864e19016b7d7b87d71af7a2a4a9374d
MD5 15dd66b2d12b458f33e1e7633661d0ff
SHA1 cfd2f24ebd67174196ce15689641686df637f570
SHA512 a7d2b1bd089b3c064ff2bc1275b49dd022ddbfb101aa8f5aa19b84e1502b4081c5a79508b10b35ac3b0de4d1ed38195b4683be4948a621880a0cea4f47024baf
MD5 SHA1 SHA512

Submit Download

tmp3F8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3F8A.tmp
Size 1KB
SHA256 24fd0d87bea36a024449a95f808aaa174e4ed9003cb8a427b67c02411b8a2e0b
MD5 c4aecdef99eba873119e79616df3f4b0
SHA1 b1b3af52655fb633eed909dfed05b64fbbfac37c
SHA512 e3f44b07267fccf4f5abd4efe80f2b037ddadc4cb898bdfca9d21ac5d79fcac828950065c2060d3ce125ee971fc3096183afee5287ba9951fbbda7257d8ed8d4
MD5 SHA1 SHA512

Submit Download

memory/4716-0-0x0000000074C00000-0x00000000751B1000-memory.dmp

Download

memory/4716-1-0x0000000074C00000-0x00000000751B1000-memory.dmp

Download

memory/4716-2-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Download

memory/4716-10-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Download

memory/4716-11-0x0000000074C00000-0x00000000751B1000-memory.dmp

Download

memory/4716-12-0x0000000074C00000-0x00000000751B1000-memory.dmp

Download

memory/4716-13-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads