nanocore | c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f

General

Target

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
Size

239KB
MD5

6e33fdd3d5343b3cb9095dfb03a003f0
SHA1

a01a2e8d6dd2b3c69066a7e55c8f3374933eec4f
SHA256

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f
SHA512

42efe24a7a22434c9717ee2d6e103e856c64399f58a66eae8dee0b264942ff2d737582319c614a7c7ef78add1e4b385d5cf590b290188b1c1b7279deb157fb24
SSDEEP

3072:HnFKUZojE4O+1XX/3wVwTfjgfaZozrVP4I+n6ItAw94H5oJSg1QoMn3:Qg4jx4aZ+JwOdwagPMn

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
buffer_size
0
build_time
0001-01-01T00:00:00Z
bypass_user_account_control
false
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
0
connection_port
0
default_group
enable_debug_mode
false
gc_threshold
0
keep_alive_timeout
0
keyboard_logging
false
lan_timeout
0
max_packet_size
0
mutex
mutex_timeout
0
prevent_system_sleep
false
primary_connection_host
primary_dns_server
request_elevation
false
restart_delay
0
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
0
use_custom_dns_server
false
version
wan_timeout
0

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	pid	process	target process
PID 576 set thread context of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery
T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid process

1672 ping.exe
956 ping.exe
960 ping.exe
1068 ping.exe
948 ping.exe
1784 ping.exe
1108 ping.exe
1980 ping.exe
1756 ping.exe
1940 ping.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

pid process

576 c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description pid process

Token: SeDebugPrivilege 576 c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

pid	process
1672	ping.exe
956	ping.exe
960	ping.exe
1068	ping.exe
948	ping.exe
1784	ping.exe
1108	ping.exe
1980	ping.exe
1756	ping.exe
1940	ping.exe

pid	process
576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	pid	process
Token: SeDebugPrivilege	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	pid	process	target process
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 2036	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 576 wrote to memory of 948	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 948	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 948	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 948	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1756	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1756	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1756	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1756	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1784	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1784	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1784	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1784	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1672	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1672	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1672	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1672	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 956	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 956	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 956	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 956	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1940	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1940	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1940	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1940	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 960	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 960	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 960	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 960	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1108	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1108	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1108	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1108	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1980	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1980	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1980	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1980	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1068	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1068	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1068	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 576 wrote to memory of 1068	576	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe

C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
"C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
"C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe"
2⤵
- Checks whether UAC is enabled
PID:2036

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:948

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1756

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1784

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1672

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:956

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1940

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:960

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1108

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1980

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-55-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/576-81-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/576-72-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/948-68-0x0000000000000000-mapping.dmp

Download
memory/956-75-0x0000000000000000-mapping.dmp

Download
memory/960-77-0x0000000000000000-mapping.dmp

Download
memory/1068-80-0x0000000000000000-mapping.dmp

Download
memory/1108-78-0x0000000000000000-mapping.dmp

Download
memory/1672-73-0x0000000000000000-mapping.dmp

Download
memory/1756-70-0x0000000000000000-mapping.dmp

Download
memory/1784-71-0x0000000000000000-mapping.dmp

Download
memory/1940-76-0x0000000000000000-mapping.dmp

Download
memory/1980-79-0x0000000000000000-mapping.dmp

Download
memory/2036-69-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-66-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2036-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2036-74-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2036-62-0x000000000041E73A-mapping.dmp

Download
memory/2036-60-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2036-59-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2036-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2036-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads