nanocore | ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268ad

General

Target

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
Size

210KB
MD5

55f18ff212586f3a44b9e43e17b01180
SHA1

13ff9ce74942f561ae08055236d1e184fb20dd49
SHA256

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268ad
SHA512

5dcbdc9d296d441614e18530b35b0cbd921eb155d2abee38ae67c6fbb0bc821cfe48f793ae9172e799d9f1382fd925b2ec5131799fda9d32608e7170c52f5ae7
SSDEEP

3072:yzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIkS2X6ecnziHRCWuzu/gBuFAU8:yLV6Bta6dtJmakIM5A2GnWaQgyhM3

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DNS Manager = "C:\\Program Files\\DNS Manager\\dnsmgr.exe"	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

Drops file in Program Files directory 2 IoCs

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

description	ioc	Process
File created	C:\Program Files\DNS Manager\dnsmgr.exe	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
File opened for modification	C:\Program Files\DNS Manager\dnsmgr.exe	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
4900	schtasks.exe
756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

pid	Process
4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

pid	Process
4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

description	pid	Process
Token: SeDebugPrivilege	4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
Token: SeDebugPrivilege	4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe

description	pid	Process	procid_target
PID 4772 wrote to memory of 4900	4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe	82
PID 4772 wrote to memory of 4900	4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe	82
PID 4772 wrote to memory of 756	4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe	84
PID 4772 wrote to memory of 756	4772	ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
"C:\Users\Admin\AppData\Local\Temp\ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "DNS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBBED.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4900
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /tn "DNS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBC5C.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBBED.tmp

Filesize
1KB

MD5
1a1cbfe21aacb86f1d4976046c6640b6

SHA1
22e26ed1140a0d2a6118ad2fe635bfd04d6de57c

SHA256
41b4f5c561210f887a5d7d88093a988a7a5961e8619817845f23c80e37566827

SHA512
4a4fe0f16385758288f4b79947dafb3c50a1d05a68aaafc2d2bfbad9ba73ffa971debb34d0086598ce9d0a4bc93d2b0de9a38881b50fc1fe4da857b52f501297

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBC5C.tmp

Filesize
1KB

MD5
56d07635c600333fc94848e69c2ec211

SHA1
a39281c9da523dac5ce045d869aa93bcea2abd36

SHA256
f9b19b08098ab4ae2b55e32fcbb0b261a1a7ebc75df057c9d6442989b6d3d70f

SHA512
d3bf5e4ed8ee60d944930dcef08962ba03dc0c89c317d4afa2653eea0acbf1be0af307ffe9239be0e2ce77c93229d5baf1f5bb1ef56c76637f6600382bab731c

Download Submit
memory/4772-16-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-29-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-0-0x00007FFCD36B5000-0x00007FFCD36B6000-memory.dmp

Filesize
4KB

Download
memory/4772-5-0x000000001BD50000-0x000000001BD58000-memory.dmp

Filesize
32KB

Download
memory/4772-6-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-7-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-2-0x000000001C2C0000-0x000000001C78E000-memory.dmp

Filesize
4.8MB

Download
memory/4772-1-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-15-0x000000001D1C0000-0x000000001D1CA000-memory.dmp

Filesize
40KB

Download
memory/4772-19-0x000000001D3D0000-0x000000001D3DA000-memory.dmp

Filesize
40KB

Download
memory/4772-4-0x000000001C940000-0x000000001C9E6000-memory.dmp

Filesize
664KB

Download
memory/4772-3-0x000000001BC90000-0x000000001BD2C000-memory.dmp

Filesize
624KB

Download
memory/4772-17-0x000000001BDD0000-0x000000001BDDC000-memory.dmp

Filesize
48KB

Download
memory/4772-20-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-21-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-22-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-23-0x00007FFCD36B5000-0x00007FFCD36B6000-memory.dmp

Filesize
4KB

Download
memory/4772-24-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-25-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-26-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-27-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-28-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp

Filesize
9.6MB

Download
memory/4772-18-0x000000001D3F0000-0x000000001D40E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads