nanocore

General

Target
52df5827294dde17fc7e54062cb396191ce5477e045e665abed65183ba56bfc0
Size 677KB
Sample221108-q12efsaeb3
SHA256 52df5827294dde17fc7e54062cb396191ce5477e045e665abed65183ba56bfc0
MD5 034e2d140fef7f5ce0ed2c1f348913f0
SHA1 e5802e55988f158aaeb487b33af170e4c46d2587
SHA512 6725d8656c64ee1801e53f3dba5321fbf408f9922156be8704618c89ad82230005e4088b4245eed7252af80c0ebeaf4c6ab31a8e8279e0c37e94261cf4229a06
SSDEEP 12288:Jat0EAH49n8BesinhH7YD4nE1dAEHEsrjUp7TD7BSFyMzDT:4t24TsinFi0EvhkrvBWyMz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  52df5827294dde17fc7e54062cb396191ce5477e045e665abed65183ba56bfc0
- Size 677KB
- SHA256 52df5827294dde17fc7e54062cb396191ce5477e045e665abed65183ba56bfc0
- MD5 034e2d140fef7f5ce0ed2c1f348913f0
- SHA1 e5802e55988f158aaeb487b33af170e4c46d2587
- SHA512 6725d8656c64ee1801e53f3dba5321fbf408f9922156be8704618c89ad82230005e4088b4245eed7252af80c0ebeaf4c6ab31a8e8279e0c37e94261cf4229a06
- SSDEEP 12288:Jat0EAH49n8BesinhH7YD4nE1dAEHEsrjUp7TD7BSFyMzDT:4t24TsinFi0EvhkrvBWyMz
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore keylogger persistence spyware stealer trojan microsoft phishing
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

AutoIT Executable

Detected potential entity reuse from brand microsoft.

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2