nanocore | a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931

General

Target

SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
Size

564KB
MD5

720d088da9cafaad486c347e0d09f696
SHA1

9b751c34f71bb40b050dab0592ff45be56a602ad
SHA256

a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931
SHA512

44addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30
SSDEEP

12288:48l02b1zzUFFiRU9WnSmzxwTqZfs+0K+:TlfzzUFAKASmyTqY

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 1 IoCs

Processes:

Bin.exe

pid process

2044 Bin.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

632 cmd.exe

pid	process
2044	Bin.exe

pid	process
632	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bin = "C:\\Users\\Admin\\AppData\\Local\\Bin.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

1816 PING.EXE
808 PING.EXE
1764 PING.EXE

pid	process
1816	PING.EXE
808	PING.EXE
1764	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.26720.exeBin.exe

pid	process
2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
2044	Bin.exe
2044	Bin.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.26720.exeBin.exe

description pid process

Token: SeDebugPrivilege 2020 SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
Token: SeDebugPrivilege 2044 Bin.exe

description	pid	process
Token: SeDebugPrivilege	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
Token: SeDebugPrivilege	2044	Bin.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

SecuriteInfo.com.Win32.CrypterX-gen.26720.execmd.execmd.exeBin.exe

description	pid	process	target process
PID 2020 wrote to memory of 1728	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 2020 wrote to memory of 1728	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 2020 wrote to memory of 1728	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 2020 wrote to memory of 1728	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 1728 wrote to memory of 1816	1728	cmd.exe	PING.EXE
PID 1728 wrote to memory of 1816	1728	cmd.exe	PING.EXE
PID 1728 wrote to memory of 1816	1728	cmd.exe	PING.EXE
PID 1728 wrote to memory of 1816	1728	cmd.exe	PING.EXE
PID 2020 wrote to memory of 632	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 2020 wrote to memory of 632	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 2020 wrote to memory of 632	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 2020 wrote to memory of 632	2020	SecuriteInfo.com.Win32.CrypterX-gen.26720.exe	cmd.exe
PID 632 wrote to memory of 808	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 808	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 808	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 808	632	cmd.exe	PING.EXE
PID 1728 wrote to memory of 1544	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1544	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1544	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1544	1728	cmd.exe	reg.exe
PID 632 wrote to memory of 1764	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 1764	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 1764	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 1764	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 2044	632	cmd.exe	Bin.exe
PID 632 wrote to memory of 2044	632	cmd.exe	Bin.exe
PID 632 wrote to memory of 2044	632	cmd.exe	Bin.exe
PID 632 wrote to memory of 2044	632	cmd.exe	Bin.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe
PID 2044 wrote to memory of 856	2044	Bin.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.26720.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.26720.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Bin.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 6
3⤵
- Runs ping.exe
PID:1816

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Bin" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Bin.exe"
3⤵
- Adds Run key to start application
PID:1544

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 15 > nul && copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.26720.exe" "C:\Users\Admin\AppData\Local\Bin.exe" && ping 127.0.0.1 -n 15 > nul && "C:\Users\Admin\AppData\Local\Bin.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 15
3⤵
- Runs ping.exe
PID:808

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 15
3⤵
- Runs ping.exe
PID:1764

C:\Users\Admin\AppData\Local\Bin.exe
"C:\Users\Admin\AppData\Local\Bin.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
4⤵
PID:856

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Bin.exe
Filesize
564KB

MD5
720d088da9cafaad486c347e0d09f696

SHA1
9b751c34f71bb40b050dab0592ff45be56a602ad

SHA256
a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931

SHA512
44addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30

Download Submit
C:\Users\Admin\AppData\Local\Bin.exe
Filesize
564KB

MD5
720d088da9cafaad486c347e0d09f696

SHA1
9b751c34f71bb40b050dab0592ff45be56a602ad

SHA256
a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931

SHA512
44addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30

Download Submit
\Users\Admin\AppData\Local\Bin.exe
Filesize
564KB

MD5
720d088da9cafaad486c347e0d09f696

SHA1
9b751c34f71bb40b050dab0592ff45be56a602ad

SHA256
a8eb775636faf8ab1f7083615f58d722b537467035be2f1e96360b3b700a1931

SHA512
44addb293e0f363244c0b1830e7d0047703aaa2dcd66e1ed2b005c8c25d87e7eee90781bc3838df37a94d5214a02f98976b1965a5b3c0664d7747252f6c8fd30

Download Submit
memory/632-60-0x0000000000000000-mapping.dmp

Download
memory/808-61-0x0000000000000000-mapping.dmp

Download
memory/856-77-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/856-76-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/856-74-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/856-73-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1544-62-0x0000000000000000-mapping.dmp

Download
memory/1728-58-0x0000000000000000-mapping.dmp

Download
memory/1764-63-0x0000000000000000-mapping.dmp

Download
memory/1816-59-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x0000000000D00000-0x0000000000D92000-memory.dmp

Filesize
584KB

Download
memory/2020-57-0x00000000006B0000-0x00000000006C8000-memory.dmp

Filesize
96KB

Download
memory/2020-56-0x0000000000BB0000-0x0000000000BE4000-memory.dmp

Filesize
208KB

Download
memory/2020-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/2044-65-0x0000000000000000-mapping.dmp

Download
memory/2044-68-0x0000000000B60000-0x0000000000BF2000-memory.dmp

Filesize
584KB

Download
memory/2044-70-0x0000000000B10000-0x0000000000B44000-memory.dmp

Filesize
208KB

Download
memory/2044-71-0x0000000004DE0000-0x0000000004DFA000-memory.dmp

Filesize
104KB

Download
memory/2044-72-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads