nanocore | dba9651aebb772e7c4d82b68f7e5763ffa9d4b460a99fe6e1fd72c6411612815

General

Target

EMAIL ACCESS BY WORTYLESS/EMAIL ACCESS BY WORTYLESS.exe
Size

203KB
MD5

bba733ae6622aab730f4833f85f2b7df
SHA1

136ba13c922525e139b79ce1397eacd5bff1101c
SHA256

2e935cf07542a29f48be90925fc43b77da788b17b15e3917b90183a59cd2576d
SHA512

6ed95ccf4eadd32a3d88941b77d3835894ca0a4b46b76e363be5f80cef1f0456f10c31bdd62b38aaef1a1b55eb96127da77e29aee9bbb0bb42e02125c153affc
SSDEEP

3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI3aQYusdrK6ymbcYmRriGNny:sLV6Bta6dtJmakIM5tax0cYgrimy

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

EMAIL ACCESS BY WORTYLESS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Subsystem = "C:\\Program Files (x86)\\DPI Subsystem\\dpiss.exe"	EMAIL ACCESS BY WORTYLESS.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

EMAIL ACCESS BY WORTYLESS.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EMAIL ACCESS BY WORTYLESS.exe

Drops file in Program Files directory 2 IoCs

Processes:

EMAIL ACCESS BY WORTYLESS.exe

description	ioc	process
File created	C:\Program Files (x86)\DPI Subsystem\dpiss.exe	EMAIL ACCESS BY WORTYLESS.exe
File opened for modification	C:\Program Files (x86)\DPI Subsystem\dpiss.exe	EMAIL ACCESS BY WORTYLESS.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3436 schtasks.exe
2088 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

EMAIL ACCESS BY WORTYLESS.exe

pid process

4804 EMAIL ACCESS BY WORTYLESS.exe
4804 EMAIL ACCESS BY WORTYLESS.exe
4804 EMAIL ACCESS BY WORTYLESS.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

EMAIL ACCESS BY WORTYLESS.exe

pid process

4804 EMAIL ACCESS BY WORTYLESS.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

EMAIL ACCESS BY WORTYLESS.exe

description pid process

Token: SeDebugPrivilege 4804 EMAIL ACCESS BY WORTYLESS.exe

pid	process
3436	schtasks.exe
2088	schtasks.exe

pid	process
4804	EMAIL ACCESS BY WORTYLESS.exe
4804	EMAIL ACCESS BY WORTYLESS.exe
4804	EMAIL ACCESS BY WORTYLESS.exe

pid	process
4804	EMAIL ACCESS BY WORTYLESS.exe

description	pid	process
Token: SeDebugPrivilege	4804	EMAIL ACCESS BY WORTYLESS.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EMAIL ACCESS BY WORTYLESS.exe

description	pid	process	target process
PID 4804 wrote to memory of 3436	4804	EMAIL ACCESS BY WORTYLESS.exe	schtasks.exe
PID 4804 wrote to memory of 3436	4804	EMAIL ACCESS BY WORTYLESS.exe	schtasks.exe
PID 4804 wrote to memory of 3436	4804	EMAIL ACCESS BY WORTYLESS.exe	schtasks.exe
PID 4804 wrote to memory of 2088	4804	EMAIL ACCESS BY WORTYLESS.exe	schtasks.exe
PID 4804 wrote to memory of 2088	4804	EMAIL ACCESS BY WORTYLESS.exe	schtasks.exe
PID 4804 wrote to memory of 2088	4804	EMAIL ACCESS BY WORTYLESS.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\EMAIL ACCESS BY WORTYLESS\EMAIL ACCESS BY WORTYLESS.exe
"C:\Users\Admin\AppData\Local\Temp\EMAIL ACCESS BY WORTYLESS\EMAIL ACCESS BY WORTYLESS.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DPI Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4D26.tmp"
2⤵
- Creates scheduled task(s)
PID:3436

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DPI Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4E02.tmp"
2⤵
- Creates scheduled task(s)
PID:2088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4D26.tmp
Filesize
1KB

MD5
896a323db8a4e1466dee95088bcad9e5

SHA1
ade5e880c93357e0ff664d74746cdf4ec93fdbba

SHA256
dd51236bd347d8c57ce5f5eb9e455607d627cf6a725b8a998bd6a236e7598d21

SHA512
c9b45b31c1f054cb9cfd442402b455b97c50177ca37e2f6f01d77ff6a16e61c319157c8a42cd6b8c74b188e6b295fce19d228b1775e8349f33b0ac42a6047096

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4E02.tmp
Filesize
1KB

MD5
5fea24e883e06e4df6d240dc72abf2c5

SHA1
d778bf0f436141e02df4b421e8188abdcc9a84a4

SHA256
e858982f4ab3c74f7a8903eea18c0f73501a77273ae38b54d5c9dec997e79a66

SHA512
15afc2ffbbee14d28a5ff8dc8285d01c942147aada36fb33e31045a4e998769b51738bebe199bcad3462f918b535845a893aa2f80c84b9c795cd1fee4a327924

Download Submit
memory/4804-0-0x00000000755A2000-0x00000000755A3000-memory.dmp

Filesize
4KB

Download
memory/4804-1-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download
memory/4804-2-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download
memory/4804-5-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download
memory/4804-11-0x00000000755A2000-0x00000000755A3000-memory.dmp

Filesize
4KB

Download
memory/4804-12-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download
memory/4804-13-0x00000000755A0000-0x0000000075B51000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads