nanocore | cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f

General

Target

cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
Size

1.7MB
MD5

ef6156d8b26762f63901d5fa97e65017
SHA1

c0e28b7062b68b1863812d7f278a19a95a5c8489
SHA256

cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f
SHA512

ea68d6947fef69c582d26347dc81596b1ee0b368465c6451ef5a0c425481f97d71ce0fd282216ef904b206b0ba7fd680a94ca720ae4826b47f274452feaf97cb
SSDEEP

24576:tEJt6KQ0CbX/AE3cG1cIp96W9nQ2sv88bCpQrhSVJCLjdhTtwlnxdI3F5YaVFqow:ot6KuvT371PPHIv88JrZvHRVqotWD

Score

10^/10

nanocore defense_evasion discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe

Executes dropped EXE 2 IoCs

pid	Process
2964	lit0.exe
1372	lit0.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsvc.exe"	lit0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\put0 = "wscript \"C:\\Users\\Admin\\sep0\\lit0.vbs\""	lit0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lit0.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DHCP Service\dhcpsvc.exe	lit0.exe
File opened for modification	C:\Program Files (x86)\DHCP Service\dhcpsvc.exe	lit0.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	lit0.exe
File opened for modification	C:\Windows\win.ini	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
File opened for modification	C:\Windows\win.ini	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
File opened for modification	C:\Windows\win.ini	lit0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lit0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lit0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1488	schtasks.exe
1968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1372	lit0.exe
1372	lit0.exe
1372	lit0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1372	lit0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	lit0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2208	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
4468	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
2964	lit0.exe
1372	lit0.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4468	2208	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	84
PID 2208 wrote to memory of 4468	2208	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	84
PID 2208 wrote to memory of 4468	2208	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	84
PID 4468 wrote to memory of 2964	4468	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	87
PID 4468 wrote to memory of 2964	4468	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	87
PID 4468 wrote to memory of 2964	4468	cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe	87
PID 2964 wrote to memory of 1372	2964	lit0.exe	88
PID 2964 wrote to memory of 1372	2964	lit0.exe	88
PID 2964 wrote to memory of 1372	2964	lit0.exe	88
PID 1372 wrote to memory of 1488	1372	lit0.exe	90
PID 1372 wrote to memory of 1488	1372	lit0.exe	90
PID 1372 wrote to memory of 1488	1372	lit0.exe	90
PID 1372 wrote to memory of 1968	1372	lit0.exe	92
PID 1372 wrote to memory of 1968	1372	lit0.exe	92
PID 1372 wrote to memory of 1968	1372	lit0.exe	92

C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
"C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe
  "C:\Users\Admin\AppData\Local\Temp\cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Users\Admin\sep0\lit0.exe
    "C:\Users\Admin\sep0\lit0.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Users\Admin\sep0\lit0.exe
      "C:\Users\Admin\sep0\lit0.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7CA2.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1488
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7CE2.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7CA2.tmp

Filesize
1KB

MD5
f8e7886767f6c4a13132e6217fabcccf

SHA1
ea37a2e6a142636a80adc3fccaf88d25018f4eae

SHA256
eee0fe11322fe1277d7ac67cee59934b24d0e1b30de973e88e82d94a9aa38664

SHA512
9de77cdae4dfd87ac2380bfcbb947e14ec218e7d44f96b952ab1596cc0b08ec52257db762c6658fef5874817ebea3e90c0ea691ab57a24f506b51288264332fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7CE2.tmp

Filesize
1KB

MD5
7f4b37265a0a4b0fea67999d11d911e8

SHA1
1b8e13e6a27c3768c30cf713b79eaa8a757e1349

SHA256
39b16b3a00b6b43c6820357127228c0768a577153014ce7b0ea3c585244dc08b

SHA512
ef97ccfb663555aedc7fdc4b3ac4cd6536c80a778b4ec3bc6124a09544733988de1dac1e6a3714b0d6e8713e3523e0732d5dfcf674f2c5e1f3eadacb0c8e5e03

Download Submit
C:\Users\Admin\sep0\lit0.exe

Filesize
1.7MB

MD5
ef6156d8b26762f63901d5fa97e65017

SHA1
c0e28b7062b68b1863812d7f278a19a95a5c8489

SHA256
cba86b70969975790694a1913cd12089df0770a8a2c68938948718657f26c12f

SHA512
ea68d6947fef69c582d26347dc81596b1ee0b368465c6451ef5a0c425481f97d71ce0fd282216ef904b206b0ba7fd680a94ca720ae4826b47f274452feaf97cb

Download Submit
C:\Windows\win.ini

Filesize
123B

MD5
6bf517432f65eb7f0d18d574bf14124c

SHA1
5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

SHA256
6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

SHA512
7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

Download Submit
memory/1372-33-0x00000000022B0000-0x00000000022C6000-memory.dmp

Filesize
88KB

Download
memory/1372-32-0x0000000000400000-0x00000000005B7000-memory.dmp

Filesize
1.7MB

Download
memory/2208-3-0x00000000023C0000-0x00000000023D6000-memory.dmp

Filesize
88KB

Download
memory/2208-4-0x0000000076FE1000-0x0000000077101000-memory.dmp

Filesize
1.1MB

Download
memory/2208-9-0x00000000023C0000-0x00000000023D6000-memory.dmp

Filesize
88KB

Download
memory/4468-12-0x0000000005060000-0x0000000005076000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads