nanocore | 47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355

General

Target

47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe
Size

544KB
MD5

05fd0b57f4e2433c6ec515b40a0a9ebe
SHA1

f18e540f9b20349bd431d78533e5ac8a40ae3ea2
SHA256

47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355
SHA512

4bc0a0c9fa06dda684621e670cb5f18c055187d3b535fec7955bb571ab7db151c0c60557814a96871eae42b687f3875efd926666edb7876a292bb7096f5687e5
SSDEEP

3072:hqIQi2PAheBsUKTpoUHf0MeaiuVXk6QP9GzeQlufXATUDXxK6JK8v/AkwbiCD/Y9:voAh3TplHfMaBi9GzhurxLNm9K

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\run = "C:\\Users\\Admin\\AppData\\Roaming\\msconfg\\cmd.exe"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe

description	pid	process	target process
PID 1488 set thread context of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB89B6C1-6B4C-11ED-9551-6E705F4A26E5} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001571c318cdc3bc4ea5cc826778ef271300000000020000000000106600000001000020000000c6ebd33f1d533c9a93b08d66a27c5193358955ab431660f1a551279f505896dd000000000e80000000020000200000009a9fdedc0c4dedfdbf920f6c1e4fc1a07a71fba32ffba54aca896251810194212000000085976f706da78256ffb640cac2cf23df63fdfbed36a65a36219fea1e9b7290d8400000005e8adb1a046975502e8febe5000fa860f5adaf7a6595d3d0b87cd37709efcbedf447a5cf3dd3f38d5d185d796bc62748078f42f97a8dc71df21288fd3c2efe14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3031c5b959ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375986288"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001571c318cdc3bc4ea5cc826778ef2713000000000200000000001066000000010000200000001e68db3bad186f536973c1693b3135aed9a2fc33d40173ffee217c7b675c6566000000000e80000000020000200000004462047b309b13dbf09ee1e6d202de9bbb021613a46ffa4e4ff17d5f70fda59f9000000075915313a0d857393278222a471d5c599646041af2a52d40cedbb2477d56c188dc97b9808c5c585c60e2045c0b4512aa8c1158327c0d2a747b400414ef2169c88f36f4ab5d59221608f572262823ab3e8e890e14c4c26d8df4f39d33076a5e3ceaa9da8372373c0c1aa457e89d5eb18f430ba35a13b19753a7841a0387d315a94a84558ac00d49e1ef76aefd22577f0e40000000ea5391181e3e52ee27e8ceffae657b43822f05c4dd5b7a369f0e6a663e87fb0986b9b336cb1079bde0f4a05a45d99985631d6ecaa01a205b6409401a53376222	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe

description pid process

Token: SeDebugPrivilege 1488 47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1256 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1256 iexplore.exe
1256 iexplore.exe
1504 IEXPLORE.EXE
1504 IEXPLORE.EXE
1504 IEXPLORE.EXE
1504 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe

pid	process
1256	iexplore.exe

pid	process
1256	iexplore.exe
1256	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.execvtres.exeiexplore.exe

description	pid	process	target process
PID 1488 wrote to memory of 1732	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	REG.exe
PID 1488 wrote to memory of 1732	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	REG.exe
PID 1488 wrote to memory of 1732	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	REG.exe
PID 1488 wrote to memory of 1732	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	REG.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 1488 wrote to memory of 936	1488	47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe	cvtres.exe
PID 936 wrote to memory of 1256	936	cvtres.exe	iexplore.exe
PID 936 wrote to memory of 1256	936	cvtres.exe	iexplore.exe
PID 936 wrote to memory of 1256	936	cvtres.exe	iexplore.exe
PID 936 wrote to memory of 1256	936	cvtres.exe	iexplore.exe
PID 1256 wrote to memory of 1504	1256	iexplore.exe	IEXPLORE.EXE
PID 1256 wrote to memory of 1504	1256	iexplore.exe	IEXPLORE.EXE
PID 1256 wrote to memory of 1504	1256	iexplore.exe	IEXPLORE.EXE
PID 1256 wrote to memory of 1504	1256	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe
"C:\Users\Admin\AppData\Local\Temp\47534a4dd4deb5efd05fa32f8cc49b911832a735f0c1500e5d8de2700690f355.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "run" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\msconfg\cmd.exe"
2⤵
- Adds Run key to start application
PID:1732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\cvtres.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cvtres.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1256 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9PI4CI6A.txt

Filesize
608B

MD5
31961d2397ec9103e8aa002041416d63

SHA1
df8a0777e496acb4d7748222290693472ad1b170

SHA256
e419932fd243139f4c0c5e3f28c871842d029f0784b730e775c8d8c98616dd8a

SHA512
9c414275db14f67ad2aa5389733be0df1d812fa1e049aacee6c448fdf7fb415ce11d1214dc44863a6028abdca2ace1e4ce2f32b81701f054abd6b5f77e1f6255

Download Submit
memory/936-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/936-57-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/936-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/936-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/936-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/936-64-0x000000000041C01E-mapping.dmp

Download
memory/936-67-0x0000000000402000-0x000000000041C200-memory.dmp

Filesize
104KB

Download
memory/936-66-0x0000000000402000-0x000000000041C200-memory.dmp

Filesize
104KB

Download
memory/1488-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1488-68-0x0000000073E20000-0x00000000743CB000-memory.dmp

Filesize
5.7MB

Download
memory/1488-55-0x0000000073E20000-0x00000000743CB000-memory.dmp

Filesize
5.7MB

Download
memory/1732-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads