nanocore

General

Target
Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130 Second Party Ref128141001808.PDF.exe
Size 536KB
Sample221213-jftesagh7z
SHA256 d0fb8dde68fa31c19a906a06576f80ddab87d8247fcd6ba879840df4d517080f
MD5 dbebc41f3228af3c9fe2ef7972009fab
SHA1 4391ce30e0baa4538b04a93b6eaddfc11a52f2b2
SHA512 0dd74f87595efe14896d8a2045c0703650f9bf1fe046f35863e00f8d968eec79181bdcc9659574627d91aca6ee9bc6f6c882bfc203a016ca37fbb7c792d577d4
SSDEEP 12288:slzAKpjDhO0lZWG9EdtQBFYIBLmudbwUAzL:slDpPM0zWG9wtQnYI0Ac
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

svetanakravenova248.ddns.net:5634

Mutex

28aa6c07-7c21-4208-97f7-23c9618edcb1

Attributes

activate_away_mode
true
backup_connection_host
svetanakravenova248.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-09-13T17:11:19.119527236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5634
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
28aa6c07-7c21-4208-97f7-23c9618edcb1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
svetanakravenova248.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  Payment Advice - Advice Ref A1T4C80vSIxi ACH credits Customer Ref1093817130 Second Party Ref128141001808.PDF.exe
- Size 536KB
- SHA256 d0fb8dde68fa31c19a906a06576f80ddab87d8247fcd6ba879840df4d517080f
- MD5 dbebc41f3228af3c9fe2ef7972009fab
- SHA1 4391ce30e0baa4538b04a93b6eaddfc11a52f2b2
- SHA512 0dd74f87595efe14896d8a2045c0703650f9bf1fe046f35863e00f8d968eec79181bdcc9659574627d91aca6ee9bc6f6c882bfc203a016ca37fbb7c792d577d4
- SSDEEP 12288:slzAKpjDhO0lZWG9EdtQBFYIBLmudbwUAzL:slDpPM0zWG9wtQnYI0Ac
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2