nanocore | 6421b8dd3f429921cd2cd3b9d6809f8a860d2f6acb58be9387ff14541dc07878

General

Target

download.exe
Size

4.0MB
MD5

5577c8755bee3b80e17e42e80eadde86
SHA1

79ebbc3f9d175669ee090f53b93a925b42281b73
SHA256

85ba99319f22cde0abd25e839a7a230a730f1d52e546754873e479be88e65da1
SHA512

2d88bc7339c5629e21c00dbf63152a3389110752be0610d8744ce5f89037701e51f40a102730f9e843555749e69607c3b8896b5fbcab76662ab3a3640e45053d
SSDEEP

98304:oPk7tEUpppPxYyTUsAoQ9/hZjipqYW+YHeFJeAuw8agFo2Gm:GdUfAaBE+OzYIo

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsSecurity\\b3QyldHDQc0c.exe\",explorer.exe"	download.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	xkcOzcREPWn6UUdi.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xkcOzcREPWn6UUdi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xkcOzcREPWn6UUdi.exe

Executes dropped EXE 1 IoCs

pid	Process
3124	xkcOzcREPWn6UUdi.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	download.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	xkcOzcREPWn6UUdi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	xkcOzcREPWn6UUdi.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	xkcOzcREPWn6UUdi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	download.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3124	xkcOzcREPWn6UUdi.exe
3124	xkcOzcREPWn6UUdi.exe
3124	xkcOzcREPWn6UUdi.exe
3124	xkcOzcREPWn6UUdi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	download.exe
Token: SeDebugPrivilege	3124	xkcOzcREPWn6UUdi.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3124	2532	download.exe	81
PID 2532 wrote to memory of 3124	2532	download.exe	81
PID 3124 wrote to memory of 4908	3124	xkcOzcREPWn6UUdi.exe	83
PID 3124 wrote to memory of 4908	3124	xkcOzcREPWn6UUdi.exe	83

C:\Users\Admin\AppData\Local\Temp\download.exe
"C:\Users\Admin\AppData\Local\Temp\download.exe"
1⤵
- Modifies WinLogon for persistence
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\xkcOzcREPWn6UUdi.exe
  "C:\Users\Admin\AppData\Local\Temp\xkcOzcREPWn6UUdi.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

5

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xkcOzcREPWn6UUdi.exe

Filesize
3.6MB

MD5
94484d4b22abf59a05b0dc6542030b91

SHA1
6c6b68fc70bf4a4ff018f6f6f8b832484b205345

SHA256
bcd5e6863d5af75d3c04140e4192709ec1c63162c8447e3484dc72fd75158838

SHA512
0029c54a3c8dd65e1b5c7a0470afced12ae602376cce30b9662465c63cf7427fb9dead317c11ee040e969582a9e69e03be33b4d6bce8f3b7cb42a70ac3473bfc

Download Submit
memory/2532-0-0x0000000075261000-0x0000000075262000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/2532-2-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/2532-16-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/2532-18-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/2532-19-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/2532-21-0x0000000075260000-0x0000000075811000-memory.dmp

Filesize
5.7MB

Download
memory/3124-14-0x00007FF776260000-0x00007FF776B97000-memory.dmp

Filesize
9.2MB

Download
memory/3124-17-0x00007FF9F9F87000-0x00007FF9F9F89000-memory.dmp

Filesize
8KB

Download
memory/3124-20-0x00007FF776260000-0x00007FF776B97000-memory.dmp

Filesize
9.2MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads