nanocore | cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f

General

Target

cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
Size

1.7MB
MD5

ef6156d8b26762f63901d5fa97e65017
SHA1

c0e28b7062b68b1863812d7f278a19a95a5c8489
SHA256

cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f
SHA512

ea68d6947fef69c582d26347dc81596b1ee0b368465c6451ef5a0c425481f97d71ce0fd282216ef904b206b0ba7fd680a94ca720ae4826b47f274452feaf97cb
SSDEEP

24576:tEJt6KQ0CbX/AE3cG1cIp96W9nQ2sv88bCpQrhSVJCLjdhTtwlnxdI3F5YaVFqow:ot6KuvT371PPHIv88JrZvHRVqotWD

Score

10^/10

nanocore defense_evasion discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Executes dropped EXE 2 IoCs

pid	Process
2804	lit0.exe
2772	lit0.exe

Loads dropped DLL 3 IoCs

pid	Process
2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
2804	lit0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe"	lit0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\put0 = "wscript \"C:\\Users\\Admin\\sep0\\lit0.vbs\""	lit0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lit0.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 2664	2768	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	30
PID 2804 set thread context of 2772	2804	lit0.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UDP Service\udpsv.exe	lit0.exe
File opened for modification	C:\Program Files (x86)\UDP Service\udpsv.exe	lit0.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
File opened for modification	C:\Windows\win.ini	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
File opened for modification	C:\Windows\win.ini	lit0.exe
File opened for modification	C:\Windows\win.ini	lit0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lit0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lit0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3064	schtasks.exe
332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2772	lit0.exe
2772	lit0.exe
2772	lit0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	lit0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	lit0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2768	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
2804	lit0.exe
2772	lit0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2772	lit0.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2664	2768	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	30
PID 2768 wrote to memory of 2664	2768	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	30
PID 2768 wrote to memory of 2664	2768	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	30
PID 2768 wrote to memory of 2664	2768	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	30
PID 2664 wrote to memory of 2804	2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	31
PID 2664 wrote to memory of 2804	2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	31
PID 2664 wrote to memory of 2804	2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	31
PID 2664 wrote to memory of 2804	2664	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	31
PID 2804 wrote to memory of 2772	2804	lit0.exe	32
PID 2804 wrote to memory of 2772	2804	lit0.exe	32
PID 2804 wrote to memory of 2772	2804	lit0.exe	32
PID 2804 wrote to memory of 2772	2804	lit0.exe	32
PID 2772 wrote to memory of 3064	2772	lit0.exe	33
PID 2772 wrote to memory of 3064	2772	lit0.exe	33
PID 2772 wrote to memory of 3064	2772	lit0.exe	33
PID 2772 wrote to memory of 3064	2772	lit0.exe	33
PID 2772 wrote to memory of 332	2772	lit0.exe	35
PID 2772 wrote to memory of 332	2772	lit0.exe	35
PID 2772 wrote to memory of 332	2772	lit0.exe	35
PID 2772 wrote to memory of 332	2772	lit0.exe	35

C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
"C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
  "C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\sep0\lit0.exe
    "C:\Users\Admin\sep0\lit0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\sep0\lit0.exe
      "C:\Users\Admin\sep0\lit0.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3064
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp65F5.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp

Filesize
1KB

MD5
f8e7886767f6c4a13132e6217fabcccf

SHA1
ea37a2e6a142636a80adc3fccaf88d25018f4eae

SHA256
eee0fe11322fe1277d7ac67cee59934b24d0e1b30de973e88e82d94a9aa38664

SHA512
9de77cdae4dfd87ac2380bfcbb947e14ec218e7d44f96b952ab1596cc0b08ec52257db762c6658fef5874817ebea3e90c0ea691ab57a24f506b51288264332fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp65F5.tmp

Filesize
1KB

MD5
0a24db62cb5b84309c4803346caaa25d

SHA1
67660778f61bb44168c33ed3fe56ed86cf9583e8

SHA256
38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df

SHA512
d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
\Users\Admin\sep0\lit0.exe

Filesize
1.7MB

MD5
ef6156d8b26762f63901d5fa97e65017

SHA1
c0e28b7062b68b1863812d7f278a19a95a5c8489

SHA256
cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f

SHA512
ea68d6947fef69c582d26347dc81596b1ee0b368465c6451ef5a0c425481f97d71ce0fd282216ef904b206b0ba7fd680a94ca720ae4826b47f274452feaf97cb

Download Submit
memory/2664-14-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/2768-3-0x0000000000330000-0x0000000000346000-memory.dmp

Filesize
88KB

Download
memory/2768-4-0x00000000778E1000-0x00000000779E2000-memory.dmp

Filesize
1.0MB

Download
memory/2768-5-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/2768-11-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

Filesize
856KB

Download
memory/2768-10-0x0000000000330000-0x0000000000346000-memory.dmp

Filesize
88KB

Download
memory/2772-35-0x00000000002C0000-0x00000000002D6000-memory.dmp

Filesize
88KB

Download
memory/2772-34-0x0000000000400000-0x00000000005B7000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads