nanocore

General

Target

d68c1898ceffa72ba1ac579c83cc494c.exe
Size

180KB
Sample

220921-gx614afea7
MD5

d68c1898ceffa72ba1ac579c83cc494c
SHA1

0cbea644e19ae6d3b934a648b5bd1a9558c64e96
SHA256

3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc
SHA512

35b09232dd1abb7d23910e64d09e6bebd43bc2469c6e4d44a2a4ed8fd88051ec0d08206a8fce25f1efb5aa85cefb9a8d87ddf9adb026029894c5481a19bb1b43
SSDEEP

1536:0GBVDgKMoum8X/ScqsClbZ5hapDbEJ0XIPnG+aaMrIl0PegZoZZZZZZZZZZZZZgJ:0muRjClb81C5adRQQelxyAx9fCTt

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

95.70.139.81:54984

Mutex

2afd92d3-82ee-48f4-9de3-98029fbb1ca4

Attributes

activate_away_mode
false
backup_connection_host
95.70.139.81
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-01T08:20:47.457547136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2afd92d3-82ee-48f4-9de3-98029fbb1ca4
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
95.70.139.81
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  d68c1898ceffa72ba1ac579c83cc494c.exe
- Size
  
  180KB
- MD5
  
  d68c1898ceffa72ba1ac579c83cc494c
- SHA1
  
  0cbea644e19ae6d3b934a648b5bd1a9558c64e96
- SHA256
  
  3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc
- SHA512
  
  35b09232dd1abb7d23910e64d09e6bebd43bc2469c6e4d44a2a4ed8fd88051ec0d08206a8fce25f1efb5aa85cefb9a8d87ddf9adb026029894c5481a19bb1b43
- SSDEEP
  
  1536:0GBVDgKMoum8X/ScqsClbZ5hapDbEJ0XIPnG+aaMrIl0PegZoZZZZZZZZZZZZZgJ:0muRjClb81C5adRQQelxyAx9fCTt
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2