nanocore | c8a496dcf94d5d246dec0747f139957709b63412f48d9a1591ca5e771a988636

Analysis

max time kernel
294s
max time network
302s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Verified by Visa.exe
Size

203KB
MD5

317acdfc40a1101e24581e36cbedf08b
SHA1

18a4e6f44f5e40602e9a667ee0563ee344858c16
SHA256

05e59171a19c97bf2fa9dead4de20645fc41cf9fcbd59fc014cdc7a571c185d3
SHA512

5edaa32431dee3dc02c1d3b559ecc6984258876e9307bbaf367c9b1fb80fefee2ba11d46f6f1bedc9aee2481a0d8b904b6e66f909d759b50b94d3a8d05cf4c52
SSDEEP

6144:ULV6Bta6dtJmakIM5+72k3q7jrVGxP23GqRNL:ULV6BtpmkPq7jRKP23XL

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe"	Verified by Visa.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Verified by Visa.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ARP Host\arphost.exe	Verified by Visa.exe
File opened for modification	C:\Program Files (x86)\ARP Host\arphost.exe	Verified by Visa.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2656	schtasks.exe
2176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1824	Verified by Visa.exe
1824	Verified by Visa.exe
1824	Verified by Visa.exe
1824	Verified by Visa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1824	Verified by Visa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	Verified by Visa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2176	1824	Verified by Visa.exe	28
PID 1824 wrote to memory of 2176	1824	Verified by Visa.exe	28
PID 1824 wrote to memory of 2176	1824	Verified by Visa.exe	28
PID 1824 wrote to memory of 2176	1824	Verified by Visa.exe	28
PID 1824 wrote to memory of 2656	1824	Verified by Visa.exe	30
PID 1824 wrote to memory of 2656	1824	Verified by Visa.exe	30
PID 1824 wrote to memory of 2656	1824	Verified by Visa.exe	30
PID 1824 wrote to memory of 2656	1824	Verified by Visa.exe	30

C:\Users\Admin\AppData\Local\Temp\Verified by Visa.exe
"C:\Users\Admin\AppData\Local\Temp\Verified by Visa.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp33AE.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2176
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3479.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp33AE.tmp

Filesize
1KB

MD5
5a64bf7a3b7c0522f2cffdecb6a5bd3a

SHA1
51047690aec1d83371a537f2db77060128109724

SHA256
809a9dadbd18413c89bce18aa3bffc955462a9aa32e930f570b14ae0e0f92847

SHA512
9f57cfcbc3a898dffc7715f2dd7e216ae4a6e2ddeb1952fb3bd1af8cef9fbcc718cdd41694dfad0ee8cb3781c00d8c7212646c3e7fdf2b07767ee2647e5b5955

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3479.tmp

Filesize
1KB

MD5
447ab194ab36cb1d20078d80e502b1b2

SHA1
a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0

SHA256
8d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5

SHA512
49ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327

Download Submit
memory/1824-0-0x0000000074A11000-0x0000000074A12000-memory.dmp

Filesize
4KB

Download
memory/1824-1-0x0000000074A10000-0x0000000074FBB000-memory.dmp

Filesize
5.7MB

Download
memory/1824-2-0x0000000074A10000-0x0000000074FBB000-memory.dmp

Filesize
5.7MB

Download
memory/1824-10-0x0000000074A10000-0x0000000074FBB000-memory.dmp

Filesize
5.7MB

Download