nanocore | b1ed9465a4e8baab1490a5e1351db0282b8fb0ea67db0abdc47ee006414b480b

General

Target

uwu.exe
Size

203KB
MD5

5bb8a2313701dc641a35b99e559be51f
SHA1

b63370b47c89973ccef0edfe912ab800d0f3779f
SHA256

b1ed9465a4e8baab1490a5e1351db0282b8fb0ea67db0abdc47ee006414b480b
SHA512

9dce02249363779b245f20965fa74be5ec09b2094d0bb4d96986a0a97e386bc0887d9b1e6703f9e3b8ec89cb97e680a43f3bffc1921d81807bd93c6889e74cf2
SSDEEP

6144:MLV6Bta6dtJmakIM5S0cFHkf8wa3PNMGdP:MLV6BtpmkhrH3wKlMG9

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Service = "C:\\Program Files (x86)\\AGP Service\\agpsv.exe"	uwu.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uwu.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AGP Service\agpsv.exe	uwu.exe
File opened for modification	C:\Program Files (x86)\AGP Service\agpsv.exe	uwu.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2932	schtasks.exe
1052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4076	uwu.exe
4076	uwu.exe
4076	uwu.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4076	uwu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	uwu.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2932	4076	uwu.exe	84
PID 4076 wrote to memory of 2932	4076	uwu.exe	84
PID 4076 wrote to memory of 2932	4076	uwu.exe	84
PID 4076 wrote to memory of 1052	4076	uwu.exe	86
PID 4076 wrote to memory of 1052	4076	uwu.exe	86
PID 4076 wrote to memory of 1052	4076	uwu.exe	86

C:\Users\Admin\AppData\Local\Temp\uwu.exe
"C:\Users\Admin\AppData\Local\Temp\uwu.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB258.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2932
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB2C6.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB258.tmp

Filesize
1KB

MD5
f5147cc88383b20862b708b731e610f5

SHA1
25ea124e5e6e1ee8c41ad210057b22ae9ea2415f

SHA256
a515e77af6d7ac781eff610918d833851934fe36f3ed3cdd6ae28ec75351f707

SHA512
3ae41da2af9af42ae265fb976fa43513f5dcb4f9e791263561db1fd2aba5f9c900f175decb9998145f51dbf46dd245046cb075858c473b4808b87c700d06167b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB2C6.tmp

Filesize
1KB

MD5
7a81ae69c04c8d95261eb5f490b7f869

SHA1
9f4f484d306fea15b2e7f9f16db660833bb1f8ce

SHA256
ce3933e772f663a834335cc2071e5e7b2d49a065b51d84a259054b8ef663e785

SHA512
8260ab83106752a488e164bbed63ef334d34399bc9a5c09a0cfceba6aef48eafe5c64e4dfbd353ac3edfff2523b16c2b0287d34833a293c4436e068fae656de8

Download Submit
memory/4076-0-0x0000000075462000-0x0000000075463000-memory.dmp

Filesize
4KB

Download
memory/4076-1-0x0000000075460000-0x0000000075A11000-memory.dmp

Filesize
5.7MB

Download
memory/4076-2-0x0000000075460000-0x0000000075A11000-memory.dmp

Filesize
5.7MB

Download
memory/4076-10-0x0000000075460000-0x0000000075A11000-memory.dmp

Filesize
5.7MB

Download
memory/4076-11-0x0000000075462000-0x0000000075463000-memory.dmp

Filesize
4KB

Download
memory/4076-12-0x0000000075460000-0x0000000075A11000-memory.dmp

Filesize
5.7MB

Download
memory/4076-13-0x0000000075460000-0x0000000075A11000-memory.dmp

Filesize
5.7MB

Download
memory/4076-14-0x0000000075460000-0x0000000075A11000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads