nanocore

General

Target
1524892380fe641d3bce387e17892c0f.exe
Size 1012KB
Sample210406-khvhmh2gm2
SHA256 63df29d3fa84705de35251b66c3cf555ba225d9a2b064edbd566ccd1b3c59e07
MD5 1524892380fe641d3bce387e17892c0f
SHA1 2ec5449079f5f9899f7b3ee0cb26217ca01695a6
SHA512 bca18cbcf29af2e5c323bcf33e87e8df8e8033449f59c7fa0ef796911ac522a757c1344b7c0564c0648e26cc065d3dc6d7d6dbd01e13354c2d410028e0f33cda
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

cato.fingusti.club:6609

Targets

- Target
  1524892380fe641d3bce387e17892c0f.exe
- Size 1012KB
- SHA256 63df29d3fa84705de35251b66c3cf555ba225d9a2b064edbd566ccd1b3c59e07
- MD5 1524892380fe641d3bce387e17892c0f
- SHA1 2ec5449079f5f9899f7b3ee0cb26217ca01695a6
- SHA512 bca18cbcf29af2e5c323bcf33e87e8df8e8033449f59c7fa0ef796911ac522a757c1344b7c0564c0648e26cc065d3dc6d7d6dbd01e13354c2d410028e0f33cda
- MD5 SHA1 SHA512
Score

10^/10

nanocore remcos keylogger persistence rat spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Remcos

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2