nanocore | 8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520

General

Target

0fd258899fb1afe14d8bd10503263901.exe
Size

2.0MB
MD5

0fd258899fb1afe14d8bd10503263901
SHA1

a74e78231d749099ed97a3990fa956b8ccbcbcfd
SHA256

8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520
SHA512

0d263abf7a29554b570633f17b7172531e343448c2b5969a00d81b04fd758250ba9398427c59d6e2270db6c19563e4eb6e648f946e6eb131ea43b6fb89349916
SSDEEP

49152:epQUjibrS75idST2/sBqEHw9lwsbpt23LObtPg4AZY0j5s5mZTiC+xccccccEww3:Dc3wrNIRZKccccccEwwww

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

Processes:

inulintentersbournssteepnesses.cominulintentersbournssteepnesses.com

pid	Process
2748	inulintentersbournssteepnesses.com
2796	inulintentersbournssteepnesses.com

Loads dropped DLL 2 IoCs

Processes:

0fd258899fb1afe14d8bd10503263901.exe

pid	Process
2128	0fd258899fb1afe14d8bd10503263901.exe
2128	0fd258899fb1afe14d8bd10503263901.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

inulintentersbournssteepnesses.cominulintentersbournssteepnesses.com

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\INTELLIGENSERELEVATORVOGNSAST = "wscript \"C:\\Users\\Admin\\banbatrawlingsundersgelsesa\\inulintentersbournssteepnesses.vbs\""	inulintentersbournssteepnesses.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DOS Manager = "C:\\Program Files (x86)\\DOS Manager\\dosmgr.exe"	inulintentersbournssteepnesses.com

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

inulintentersbournssteepnesses.com

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	inulintentersbournssteepnesses.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

0fd258899fb1afe14d8bd10503263901.exeinulintentersbournssteepnesses.com

description	pid	Process	procid_target
PID 2280 set thread context of 2128	2280	0fd258899fb1afe14d8bd10503263901.exe	30
PID 2748 set thread context of 2796	2748	inulintentersbournssteepnesses.com	32

Drops file in Program Files directory 2 IoCs

Processes:

inulintentersbournssteepnesses.com

description	ioc	Process
File opened for modification	C:\Program Files (x86)\DOS Manager\dosmgr.exe	inulintentersbournssteepnesses.com
File created	C:\Program Files (x86)\DOS Manager\dosmgr.exe	inulintentersbournssteepnesses.com

Drops file in Windows directory 4 IoCs

Processes:

inulintentersbournssteepnesses.com0fd258899fb1afe14d8bd10503263901.exe0fd258899fb1afe14d8bd10503263901.exeinulintentersbournssteepnesses.com

description	ioc	Process
File opened for modification	C:\Windows\win.ini	inulintentersbournssteepnesses.com
File opened for modification	C:\Windows\win.ini	0fd258899fb1afe14d8bd10503263901.exe
File opened for modification	C:\Windows\win.ini	0fd258899fb1afe14d8bd10503263901.exe
File opened for modification	C:\Windows\win.ini	inulintentersbournssteepnesses.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

inulintentersbournssteepnesses.comschtasks.exeschtasks.exe0fd258899fb1afe14d8bd10503263901.exe0fd258899fb1afe14d8bd10503263901.exeinulintentersbournssteepnesses.com

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inulintentersbournssteepnesses.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fd258899fb1afe14d8bd10503263901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fd258899fb1afe14d8bd10503263901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inulintentersbournssteepnesses.com

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
2464	schtasks.exe
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

inulintentersbournssteepnesses.com

pid	Process
2796	inulintentersbournssteepnesses.com
2796	inulintentersbournssteepnesses.com
2796	inulintentersbournssteepnesses.com

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

inulintentersbournssteepnesses.com

pid	Process
2796	inulintentersbournssteepnesses.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

inulintentersbournssteepnesses.com

description	pid	Process
Token: SeDebugPrivilege	2796	inulintentersbournssteepnesses.com

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

0fd258899fb1afe14d8bd10503263901.exe0fd258899fb1afe14d8bd10503263901.exeinulintentersbournssteepnesses.cominulintentersbournssteepnesses.com

pid	Process
2280	0fd258899fb1afe14d8bd10503263901.exe
2128	0fd258899fb1afe14d8bd10503263901.exe
2748	inulintentersbournssteepnesses.com
2796	inulintentersbournssteepnesses.com

Suspicious use of UnmapMainImage 1 IoCs

Processes:

inulintentersbournssteepnesses.com

pid	Process
2796	inulintentersbournssteepnesses.com

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

0fd258899fb1afe14d8bd10503263901.exe0fd258899fb1afe14d8bd10503263901.exeinulintentersbournssteepnesses.cominulintentersbournssteepnesses.com

description	pid	Process	procid_target
PID 2280 wrote to memory of 2128	2280	0fd258899fb1afe14d8bd10503263901.exe	30
PID 2280 wrote to memory of 2128	2280	0fd258899fb1afe14d8bd10503263901.exe	30
PID 2280 wrote to memory of 2128	2280	0fd258899fb1afe14d8bd10503263901.exe	30
PID 2280 wrote to memory of 2128	2280	0fd258899fb1afe14d8bd10503263901.exe	30
PID 2128 wrote to memory of 2748	2128	0fd258899fb1afe14d8bd10503263901.exe	31
PID 2128 wrote to memory of 2748	2128	0fd258899fb1afe14d8bd10503263901.exe	31
PID 2128 wrote to memory of 2748	2128	0fd258899fb1afe14d8bd10503263901.exe	31
PID 2128 wrote to memory of 2748	2128	0fd258899fb1afe14d8bd10503263901.exe	31
PID 2748 wrote to memory of 2796	2748	inulintentersbournssteepnesses.com	32
PID 2748 wrote to memory of 2796	2748	inulintentersbournssteepnesses.com	32
PID 2748 wrote to memory of 2796	2748	inulintentersbournssteepnesses.com	32
PID 2748 wrote to memory of 2796	2748	inulintentersbournssteepnesses.com	32
PID 2796 wrote to memory of 2464	2796	inulintentersbournssteepnesses.com	33
PID 2796 wrote to memory of 2464	2796	inulintentersbournssteepnesses.com	33
PID 2796 wrote to memory of 2464	2796	inulintentersbournssteepnesses.com	33
PID 2796 wrote to memory of 2464	2796	inulintentersbournssteepnesses.com	33
PID 2796 wrote to memory of 1980	2796	inulintentersbournssteepnesses.com	35
PID 2796 wrote to memory of 1980	2796	inulintentersbournssteepnesses.com	35
PID 2796 wrote to memory of 1980	2796	inulintentersbournssteepnesses.com	35
PID 2796 wrote to memory of 1980	2796	inulintentersbournssteepnesses.com	35

C:\Users\Admin\AppData\Local\Temp\0fd258899fb1afe14d8bd10503263901.exe
"C:\Users\Admin\AppData\Local\Temp\0fd258899fb1afe14d8bd10503263901.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\0fd258899fb1afe14d8bd10503263901.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd258899fb1afe14d8bd10503263901.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
    "C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
      "C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "DOS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7639.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2464
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "DOS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7782.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7639.tmp

Filesize
1KB

MD5
6673745d174e2b56990535bfe6e19329

SHA1
d6037df3923e9814843001feebde143e2a545588

SHA256
83b0432e6315318c1ee79845b037ee0c423d714f8df3efc44d82f8fcd1937c40

SHA512
e1b7c5163aa0c4bf14bfbe80f2957ba5cb1919590a4773098815c1051fb7d67455a8c46777ec90b9d7a4a8f9460580edbdb4b4c81118c9df98e5927beacb6edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7782.tmp

Filesize
1KB

MD5
8f5713b14cee3089852f6c8d2a7a7d57

SHA1
8bffbea05715c6434ad593cce8a2c737f80ff788

SHA256
ab3ce102242c3144f87bcbfe83984a478821cd09e62c0e5211b2ab37dde02d2c

SHA512
82bd2378c2d6bb34a1ad3f2d26bfea583fc8403691bed6668521ba3e8bc7bdbdf142f872ddbc8e5251550f47c9bbee4eb3d0d6096f80d85259082cf68a454c72

Download Submit
C:\Windows\win.ini

Filesize
900B

MD5
487dec5afe511f0efc16e6ec6b0b7f2b

SHA1
855c52edcd1166149e8fa146bb184e88a23feeee

SHA256
18009dddef6d177fc7bd9bbd51ec586cf6f50fa1538bf55d195824515a60cc6d

SHA512
caea952c4fffd9b12613cfd5145ef902fac88bda8805a9093f2e0f2de141b0875050377857f9a34d2595c83db9df8f99020e58dcc3b9db1999978c1845bfc32f

Download Submit
\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

Filesize
2.0MB

MD5
0fd258899fb1afe14d8bd10503263901

SHA1
a74e78231d749099ed97a3990fa956b8ccbcbcfd

SHA256
8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520

SHA512
0d263abf7a29554b570633f17b7172531e343448c2b5969a00d81b04fd758250ba9398427c59d6e2270db6c19563e4eb6e648f946e6eb131ea43b6fb89349916

Download Submit
memory/2128-11-0x0000000077C70000-0x0000000077E19000-memory.dmp

Filesize
1.7MB

Download
memory/2280-4-0x0000000077C71000-0x0000000077D72000-memory.dmp

Filesize
1.0MB

Download
memory/2280-5-0x0000000077C70000-0x0000000077E19000-memory.dmp

Filesize
1.7MB

Download
memory/2280-12-0x0000000077E60000-0x0000000077F36000-memory.dmp

Filesize
856KB

Download
memory/2796-35-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads