nanocore | 2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d

General

Target

2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
Size

159KB
MD5

7c5285cf6b2cdbc1c6ac66236b1f0180
SHA1

bbee19df0ea9ef80fec4f85f6b8c50904f7c7d5f
SHA256

2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d
SHA512

e330c4fc030229e3dea7a6f9fe031da1ed86aa483edba28b7c75179e993c377bd89b9b2b79ecf59166a16292f19c521dece19817cf24f5d6d247df3cb7eff5ad
SSDEEP

3072:nZO06GYDQu9j/J4Oy1emLjNI3n3xZJyDSjQ0C7TOacVxNqnDonU:ZOIYDQsj/2Oy1xLjN+3/VQ0UWqnDon

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
buffer_size
0
build_time
0001-01-01T00:00:00Z
bypass_user_account_control
false
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
0
connection_port
0
default_group
enable_debug_mode
false
gc_threshold
0
keep_alive_timeout
0
keyboard_logging
false
lan_timeout
0
max_packet_size
0
mutex
mutex_timeout
0
prevent_system_sleep
false
primary_connection_host
primary_dns_server
request_elevation
false
restart_delay
0
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
0
use_custom_dns_server
false
version
wan_timeout
0

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

description	pid	process	target process
PID 3004 set thread context of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

description pid process

Token: SeDebugPrivilege 3004 2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

description	pid	process
Token: SeDebugPrivilege	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

description	pid	process	target process
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
PID 3004 wrote to memory of 408	3004	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe	2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe

C:\Users\Admin\AppData\Local\Temp\2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
"C:\Users\Admin\AppData\Local\Temp\2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004

C:\Users\Admin\AppData\Local\Temp\2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
C:\Users\Admin\AppData\Local\Temp\2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe
2⤵
- Checks whether UAC is enabled
PID:408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\2dc2465316e6a56ec64c1195dba1eec9de1b5c7795d77f14b849cec7c91a7c1d.exe.log
Filesize
224B

MD5
c19eb8c8e7a40e6b987f9d2ee952996e

SHA1
6fc3049855bc9100643e162511673c6df0f28bfb

SHA256
677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

SHA512
860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

Download Submit
memory/408-134-0x0000000000000000-mapping.dmp

Download
memory/408-135-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/408-138-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/408-139-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3004-132-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3004-133-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3004-137-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads