nanocore | 4c6762d75166eeec117650f3168738b1a5bfcf96f5f22225828bede16269d965

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.exe
Size

203KB
MD5

5e57576033800e9cb23629afead165db
SHA1

cbbf0cb6cf95d73d3f1a204fca8e292c8322a995
SHA256

4c6762d75166eeec117650f3168738b1a5bfcf96f5f22225828bede16269d965
SHA512

681730335d3c3de0fda2d41e63bb5c6127a4a1710fb3363d50a809f170a5fe5c3d6f28543a63afe672c78243e0f952457185e35c9619ff500d9757eae499459a
SSDEEP

6144:MLV6Bta6dtJmakIM58rnJk4wyKmtkn3Y2AT:MLV6BtpmkRd2etYIv

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

client.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAAS Manager = "C:\\Program Files (x86)\\SAAS Manager\\saasmgr.exe" client.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

client.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA client.exe
Drops file in Program Files directory 2 IoCs

Processes:

client.exe

description ioc process

File created C:\Program Files (x86)\SAAS Manager\saasmgr.exe client.exe
File opened for modification C:\Program Files (x86)\SAAS Manager\saasmgr.exe client.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

332 schtasks.exe
2944 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

client.exe

pid process

5036 client.exe
5036 client.exe
5036 client.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

client.exe

pid process

5036 client.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

client.exe

description pid process

Token: SeDebugPrivilege 5036 client.exe
Token: SeDebugPrivilege 5036 client.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAAS Manager = "C:\\Program Files (x86)\\SAAS Manager\\saasmgr.exe"	client.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	client.exe

description	ioc	process
File created	C:\Program Files (x86)\SAAS Manager\saasmgr.exe	client.exe
File opened for modification	C:\Program Files (x86)\SAAS Manager\saasmgr.exe	client.exe

pid	process
332	schtasks.exe
2944	schtasks.exe

pid	process
5036	client.exe
5036	client.exe
5036	client.exe

pid	process
5036	client.exe

description	pid	process
Token: SeDebugPrivilege	5036	client.exe
Token: SeDebugPrivilege	5036	client.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

client.exe

description	pid	process	target process
PID 5036 wrote to memory of 332	5036	client.exe	schtasks.exe
PID 5036 wrote to memory of 332	5036	client.exe	schtasks.exe
PID 5036 wrote to memory of 332	5036	client.exe	schtasks.exe
PID 5036 wrote to memory of 2944	5036	client.exe	schtasks.exe
PID 5036 wrote to memory of 2944	5036	client.exe	schtasks.exe
PID 5036 wrote to memory of 2944	5036	client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SAAS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5CE5.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "SAAS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5D53.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2944

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5CE5.tmp
Filesize
1KB

MD5
4b25c43c4a8a3c8ce6ed59dd27a6d5da

SHA1
39a1059ae8a14458672fa20053b9214fb0faeba7

SHA256
5b4d4a864d877a082656f01ff8fa16ad6305e63d3c0e9df37035a13ffa07d285

SHA512
50ebc2b42c5d87b6be155f7c8e950e2826db5cab4b3c895c82c1b0964774c5708a14c33b36e6292e941b2f46092fac3f3adcf4c10f9ff54308b0f6d255331dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5D53.tmp
Filesize
1KB

MD5
b5ee6d4d0a6aab49e12d44d82afc5157

SHA1
9fbe67452ca81b59802441955020086c3d163b2c

SHA256
f769b73883f96cefd35c438e8bdbe12c10a87ce11e09e4084474a85f6e4f8a10

SHA512
c4071b68c40aedd04b48bcbf4c4256e8b746474c6d4cfe680a4c0bcd61c9c4daa45d5d1e2fc8df655feba77de485258d06a81ac1a9144ed37ab9c80fbce09754

Download Submit
memory/5036-0-0x0000000075482000-0x0000000075483000-memory.dmp

Filesize
4KB

Download
memory/5036-1-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/5036-2-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/5036-10-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/5036-11-0x0000000075482000-0x0000000075483000-memory.dmp

Filesize
4KB

Download
memory/5036-12-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/5036-13-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/5036-14-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download