nanocore | 4c6762d75166eeec117650f3168738b1a5bfcf96f5f22225828bede16269d965

Analysis

max time kernel
28s
max time network
38s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.exe
Size

203KB
MD5

5e57576033800e9cb23629afead165db
SHA1

cbbf0cb6cf95d73d3f1a204fca8e292c8322a995
SHA256

4c6762d75166eeec117650f3168738b1a5bfcf96f5f22225828bede16269d965
SHA512

681730335d3c3de0fda2d41e63bb5c6127a4a1710fb3363d50a809f170a5fe5c3d6f28543a63afe672c78243e0f952457185e35c9619ff500d9757eae499459a
SSDEEP

6144:MLV6Bta6dtJmakIM58rnJk4wyKmtkn3Y2AT:MLV6BtpmkRd2etYIv

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

client.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe" client.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

client.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA client.exe
Drops file in Program Files directory 2 IoCs

Processes:

client.exe

description ioc process

File created C:\Program Files (x86)\DDP Service\ddpsv.exe client.exe
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe client.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2908 schtasks.exe
2712 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

client.exe

pid process

3020 client.exe
3020 client.exe
3020 client.exe
3020 client.exe
3020 client.exe
3020 client.exe
3020 client.exe
3020 client.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

client.exe

pid process

3020 client.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

client.exe

description pid process

Token: SeDebugPrivilege 3020 client.exe
Token: SeDebugPrivilege 3020 client.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe"	client.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	client.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Service\ddpsv.exe	client.exe
File opened for modification	C:\Program Files (x86)\DDP Service\ddpsv.exe	client.exe

pid	process
2908	schtasks.exe
2712	schtasks.exe

pid	process
3020	client.exe
3020	client.exe
3020	client.exe
3020	client.exe
3020	client.exe
3020	client.exe
3020	client.exe
3020	client.exe

pid	process
3020	client.exe

description	pid	process
Token: SeDebugPrivilege	3020	client.exe
Token: SeDebugPrivilege	3020	client.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

client.exe

description	pid	process	target process
PID 3020 wrote to memory of 2908	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2908	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2908	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2908	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2712	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2712	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2712	3020	client.exe	schtasks.exe
PID 3020 wrote to memory of 2712	3020	client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7A8D.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7D5B.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2712

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7A8D.tmp
Filesize
1KB

MD5
4b25c43c4a8a3c8ce6ed59dd27a6d5da

SHA1
39a1059ae8a14458672fa20053b9214fb0faeba7

SHA256
5b4d4a864d877a082656f01ff8fa16ad6305e63d3c0e9df37035a13ffa07d285

SHA512
50ebc2b42c5d87b6be155f7c8e950e2826db5cab4b3c895c82c1b0964774c5708a14c33b36e6292e941b2f46092fac3f3adcf4c10f9ff54308b0f6d255331dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7D5B.tmp
Filesize
1KB

MD5
93d357e6194c8eb8d0616a9f592cc4bf

SHA1
5cc3a3d95d82cb88f65cb6dc6c188595fa272808

SHA256
a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713

SHA512
4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

Download Submit
memory/3020-0-0x0000000074861000-0x0000000074862000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download
memory/3020-2-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download
memory/3020-10-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download
memory/3020-11-0x0000000074860000-0x0000000074E0B000-memory.dmp

Filesize
5.7MB

Download