nanocore | fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802

General

Target

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
Size

1.3MB
MD5

f41ac3c9d7cac6153c6687fe0b160dc9
SHA1

c7368bb2435f0dca25a39fe11ca1df1be9dbef6c
SHA256

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802
SHA512

40d7605ec4244a702893ed926b5e4eeef41052fa06ffd5c753bf06b03c171dcd6929a58d2336f47ac4b5def49221c811748f8b9962896ed900141ddda595bc8d

Score

10^/10

nanocore evasion keylogger persistence spyware stealer suricata trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Monitor = "C:\\Program Files (x86)\\IMAP Monitor\\imapmon.exe"	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exefb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

pid	process
2284	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description	pid	process	target process
PID 2284 set thread context of 3192	2284	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Drops file in Program Files directory 2 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description	ioc	process
File created	C:\Program Files (x86)\IMAP Monitor\imapmon.exe	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
File opened for modification	C:\Program Files (x86)\IMAP Monitor\imapmon.exe	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4080 schtasks.exe
4088 schtasks.exe

pid	process
4080	schtasks.exe
4088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

pid	process
3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

pid process

3192 fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description pid process

Token: SeDebugPrivilege 3192 fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

pid process

2284 fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description	pid	process
Token: SeDebugPrivilege	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exefb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe

description	pid	process	target process
PID 2284 wrote to memory of 3192	2284	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
PID 2284 wrote to memory of 3192	2284	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
PID 2284 wrote to memory of 3192	2284	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
PID 3192 wrote to memory of 4080	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	schtasks.exe
PID 3192 wrote to memory of 4080	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	schtasks.exe
PID 3192 wrote to memory of 4080	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	schtasks.exe
PID 3192 wrote to memory of 4088	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	schtasks.exe
PID 3192 wrote to memory of 4088	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	schtasks.exe
PID 3192 wrote to memory of 4088	3192	fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
"C:\Users\Admin\AppData\Local\Temp\fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe
"C:\Users\Admin\AppData\Local\Temp\fb54fb0923bdd2eab423511171594f00e111895a2569ff98079e264ba8ef5802.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "IMAP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp129.tmp"
3⤵
- Creates scheduled task(s)
PID:4080

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "IMAP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1F5.tmp"
3⤵
- Creates scheduled task(s)
PID:4088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp129.tmp
Filesize
1KB

MD5
77ae39d74633ba1cd28d5af6dfc9ae48

SHA1
a07a06e314d8da1e79389c8040b72eac1de1a147

SHA256
3a91e8698b1f3f1a58948608e660a9febe3533f9573d097a952386f7f87f95e1

SHA512
4d1d8a1bc29d78f98b419490bcc8d175fe6afd22f8c2d7573748b60e4926d36979d89171acb54bdbe7fb1e21c6b4dc6491c468bff32dcf662ee56894e98f3240

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F5.tmp
Filesize
1KB

MD5
d2d6911d94b06e405e7687a2437eafec

SHA1
9f28f9e7d8d5179d44ddaa6ca266984ed7521dea

SHA256
2dc87169ad53fbdd7abb08f49777cb8fb05adbff4e6f6616b4c89942af8cad0f

SHA512
b5983de701ff98e944283a25f1770c1e792d52148dc1671f1d19203f8b9d10b056abcf79a17ca536a5f88ccf52f6445d8f3e75fce628666640ad8bad697dcfd1

Download Submit
memory/2284-136-0x00000000022E0000-0x00000000022EE000-memory.dmp

Filesize
56KB

Download
memory/2284-133-0x00007FFEA5590000-0x00007FFEA5785000-memory.dmp

Filesize
2.0MB

Download
memory/2284-132-0x00000000022E0000-0x00000000022EE000-memory.dmp

Filesize
56KB

Download
memory/2284-137-0x0000000077E10000-0x0000000077FB3000-memory.dmp

Filesize
1.6MB

Download
memory/2284-135-0x0000000077E10000-0x0000000077FB3000-memory.dmp

Filesize
1.6MB

Download
memory/3192-147-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/3192-140-0x00007FFEA5590000-0x00007FFEA5785000-memory.dmp

Filesize
2.0MB

Download
memory/3192-141-0x0000000077E10000-0x0000000077FB3000-memory.dmp

Filesize
1.6MB

Download
memory/3192-142-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/3192-134-0x0000000000000000-mapping.dmp

Download
memory/3192-139-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/3192-138-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3192-148-0x00007FFEA5590000-0x00007FFEA5785000-memory.dmp

Filesize
2.0MB

Download
memory/3192-149-0x0000000077E10000-0x0000000077FB3000-memory.dmp

Filesize
1.6MB

Download
memory/3192-150-0x0000000075480000-0x0000000075A31000-memory.dmp

Filesize
5.7MB

Download
memory/4080-143-0x0000000000000000-mapping.dmp

Download
memory/4088-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads