nanocore

General

Target

f7d9d4ca140f041c794869885b13e56e9cfbd1c9cacc3441540368324b7e4023
Size

844KB
Sample

221123-pv8e5sfd8z
MD5

65f3288c542e20460186435829d8f386
SHA1

468862a1748cba16e163ff88a477bae08dc920fe
SHA256

f7d9d4ca140f041c794869885b13e56e9cfbd1c9cacc3441540368324b7e4023
SHA512

cb8a28d8ccacf6573ef48668365ffd8e52eb8cd0c56a1bba880bfd46ac2764105119580c4fafe4f93d06ac792084d05ab3a4c8abbdf58ad773353350707f3918
SSDEEP

12288:nwotByF6npG8mwnV9qF/iLRlCO+YaYC+1JbfBjQd:wobBGNm7wqLGnH+5jQ

Score

10^/10

Malware Config

Targets

- Target
  
  f7d9d4ca140f041c794869885b13e56e9cfbd1c9cacc3441540368324b7e4023
- Size
  
  844KB
- MD5
  
  65f3288c542e20460186435829d8f386
- SHA1
  
  468862a1748cba16e163ff88a477bae08dc920fe
- SHA256
  
  f7d9d4ca140f041c794869885b13e56e9cfbd1c9cacc3441540368324b7e4023
- SHA512
  
  cb8a28d8ccacf6573ef48668365ffd8e52eb8cd0c56a1bba880bfd46ac2764105119580c4fafe4f93d06ac792084d05ab3a4c8abbdf58ad773353350707f3918
- SSDEEP
  
  12288:nwotByF6npG8mwnV9qF/iLRlCO+YaYC+1JbfBjQd:wobBGNm7wqLGnH+5jQ
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies WinLogon for persistence

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2