nanocore | 3ed9206fc74a86f26e4edafa7f1637688184228fa75b3003a52b23d1fcca3aa7

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
filme2017.exe
Size 203KB
Sample240916-wvftfssdjh
SHA256 3ed9206fc74a86f26e4edafa7f1637688184228fa75b3003a52b23d1fcca3aa7
MD5 663e8c824c5d331843c9c56b1a8eda4c
SHA1 d9d70b04d4ba5f1647c6e33e878f5fab2ec99687
SHA512 98c4a97205ed1d5afeb0b6afecf9bc1ac396885b5d1727f4207dce12b5ff29abfcc5af372b5eef1f75bf5428be4afffc5f0b839aefe06bc96176493e2946e1cb
SSDEEP 3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIT5P+1Nda82N+xdkv9iRLGeQLT:MLV6Bta6dtJmakIM54kAgNpa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Monitor = "C:\\Program Files (x86)\\NAS Monitor\\nasmon.exe"	filme2017.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	filme2017.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NAS Monitor\nasmon.exe	filme2017.exe
File opened for modification	C:\Program Files (x86)\NAS Monitor\nasmon.exe	filme2017.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	filme2017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3868	schtasks.exe
516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3492	filme2017.exe
3492	filme2017.exe
3492	filme2017.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3492	filme2017.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	filme2017.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 3868	3492	filme2017.exe	81
PID 3492 wrote to memory of 3868	3492	filme2017.exe	81
PID 3492 wrote to memory of 3868	3492	filme2017.exe	81
PID 3492 wrote to memory of 516	3492	filme2017.exe	83
PID 3492 wrote to memory of 516	3492	filme2017.exe	83
PID 3492 wrote to memory of 516	3492	filme2017.exe	83

C:\Users\Admin\AppData\Local\Temp\filme2017.exe
"C:\Users\Admin\AppData\Local\Temp\filme2017.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "NAS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5204.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3868
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "NAS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5254.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5204.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5204.tmp
Size 1KB
SHA256 e2d77c16d3e7e63d16dd45a2fc8a6e0fbda94a50133720dba2066a6e72ce8e81
MD5 8ae062b9d2fa673a10985dca5da6b8fb
SHA1 d27050929217bce815464900078ee2d68a553b6f
SHA512 278083c9a51ca6d6f4910fb43da1a2d0fb047741eef611e1883f5044a524e545c8b39327efde0ce75457213122cfa3e1e40039268f6ad0eca9560fb000bb44b2
MD5 SHA1 SHA512

Submit Download

tmp5254.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5254.tmp
Size 1KB
SHA256 d20aeda9cadd332268afc89cbee76f297b00f061bf69a2f558a8d7657e4c41d7
MD5 3144131f2fe1c35ad2aafff167a26f59
SHA1 959879de38aed11bc08b7725500d2c8c953e80bf
SHA512 27a07c8f953cc4fde9ec348d3f5c4621ab56ff281b778bc7ac95dd808d5f0eea6969c5e4662efc00a6416c8bcf4d8e3892be5c99e603e36f8aa49d2a957206fb
MD5 SHA1 SHA512

Submit Download

memory/3492-0-0x0000000075412000-0x0000000075413000-memory.dmp

Download

memory/3492-1-0x0000000075410000-0x00000000759C1000-memory.dmp

Download

memory/3492-2-0x0000000075410000-0x00000000759C1000-memory.dmp

Download

memory/3492-10-0x0000000075410000-0x00000000759C1000-memory.dmp

Download

memory/3492-11-0x0000000075412000-0x0000000075413000-memory.dmp

Download

memory/3492-12-0x0000000075410000-0x00000000759C1000-memory.dmp

Download

memory/3492-13-0x0000000075410000-0x00000000759C1000-memory.dmp

Download

memory/3492-14-0x0000000075410000-0x00000000759C1000-memory.dmp

Download