nanocore | c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f

General

Target

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
Size

239KB
MD5

6e33fdd3d5343b3cb9095dfb03a003f0
SHA1

a01a2e8d6dd2b3c69066a7e55c8f3374933eec4f
SHA256

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f
SHA512

42efe24a7a22434c9717ee2d6e103e856c64399f58a66eae8dee0b264942ff2d737582319c614a7c7ef78add1e4b385d5cf590b290188b1c1b7279deb157fb24
SSDEEP

3072:HnFKUZojE4O+1XX/3wVwTfjgfaZozrVP4I+n6ItAw94H5oJSg1QoMn3:Qg4jx4aZ+JwOdwagPMn

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
buffer_size
0
build_time
0001-01-01T00:00:00Z
bypass_user_account_control
false
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
0
connection_port
0
default_group
enable_debug_mode
false
gc_threshold
0
keep_alive_timeout
0
keyboard_logging
false
lan_timeout
0
max_packet_size
0
mutex
mutex_timeout
0
prevent_system_sleep
false
primary_connection_host
primary_dns_server
request_elevation
false
restart_delay
0
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
0
use_custom_dns_server
false
version
wan_timeout
0

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	pid	process	target process
PID 3036 set thread context of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery
T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid process

2228 ping.exe
1944 ping.exe
240 ping.exe
312 ping.exe
3564 ping.exe
396 ping.exe
1008 ping.exe
4084 ping.exe
4488 ping.exe
4812 ping.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

pid process

3036 c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description pid process

Token: SeDebugPrivilege 3036 c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

pid	process
2228	ping.exe
1944	ping.exe
240	ping.exe
312	ping.exe
3564	ping.exe
396	ping.exe
1008	ping.exe
4084	ping.exe
4488	ping.exe
4812	ping.exe

pid	process
3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	pid	process
Token: SeDebugPrivilege	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe

description	pid	process	target process
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 3796	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
PID 3036 wrote to memory of 1008	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 1008	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 1008	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4084	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4084	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4084	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 1944	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 1944	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 1944	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 240	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 240	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 240	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4488	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4488	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4488	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 312	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 312	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 312	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 3564	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 3564	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 3564	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4812	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4812	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 4812	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 396	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 396	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 396	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 2228	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 2228	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe
PID 3036 wrote to memory of 2228	3036	c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe	ping.exe

C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
"C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe
"C:\Users\Admin\AppData\Local\Temp\c4302b6122f11439c0ba321e80d67e5fa04d940f84bd738644203bd4a299f42f.exe"
2⤵
- Checks whether UAC is enabled
PID:3796

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1008

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:4084

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:1944

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:240

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:4488

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:312

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:3564

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:4812

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:396

C:\Windows\SysWOW64\ping.exe
ping google.com
2⤵
- Runs ping.exe
PID:2228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-140-0x0000000000000000-mapping.dmp

Download
memory/312-143-0x0000000000000000-mapping.dmp

Download
memory/396-146-0x0000000000000000-mapping.dmp

Download
memory/1008-135-0x0000000000000000-mapping.dmp

Download
memory/1944-138-0x0000000000000000-mapping.dmp

Download
memory/2228-147-0x0000000000000000-mapping.dmp

Download
memory/3036-148-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3036-132-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3036-139-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3564-144-0x0000000000000000-mapping.dmp

Download
memory/3796-141-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3796-136-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/3796-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3796-133-0x0000000000000000-mapping.dmp

Download
memory/4084-137-0x0000000000000000-mapping.dmp

Download
memory/4488-142-0x0000000000000000-mapping.dmp

Download
memory/4812-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads