nanocore | 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0

General

Target

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
Size

203KB
MD5

07d9144c3b3cfe44c24f850a74faaacc
SHA1

1df82c6dbe192d9f78e137bb96c499fd5f0c93a5
SHA256

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0
SHA512

39120f944f46dfa34f0d4a2e59a9bdb74a76d9f69b55c054969a96666b0366651bcc2a0ab4a48f3243a2046e961f43fba5e13d5b04248eeae0f86b7428133584
SSDEEP

6144:sLV6Bta6dtJmakIM51O3JM1fMKQqa7FPp0k4v:sLV6BtpmkBGpC78v

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Host = "C:\\Program Files (x86)\\ISS Host\\isshost.exe"	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 28 IoCs

Web Service

T1102

Processes:

flow	ioc
36	0.tcp.eu.ngrok.io
48	0.tcp.eu.ngrok.io
12	0.tcp.eu.ngrok.io
20	0.tcp.eu.ngrok.io
26	0.tcp.eu.ngrok.io
44	0.tcp.eu.ngrok.io
2	0.tcp.eu.ngrok.io
54	0.tcp.eu.ngrok.io
38	0.tcp.eu.ngrok.io
22	0.tcp.eu.ngrok.io
30	0.tcp.eu.ngrok.io
32	0.tcp.eu.ngrok.io
34	0.tcp.eu.ngrok.io
46	0.tcp.eu.ngrok.io
52	0.tcp.eu.ngrok.io
16	0.tcp.eu.ngrok.io
24	0.tcp.eu.ngrok.io
28	0.tcp.eu.ngrok.io
10	0.tcp.eu.ngrok.io
14	0.tcp.eu.ngrok.io
40	0.tcp.eu.ngrok.io
18	0.tcp.eu.ngrok.io
50	0.tcp.eu.ngrok.io
56	0.tcp.eu.ngrok.io
4	0.tcp.eu.ngrok.io
6	0.tcp.eu.ngrok.io
8	0.tcp.eu.ngrok.io
42	0.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	ioc	process
File created	C:\Program Files (x86)\ISS Host\isshost.exe	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
File opened for modification	C:\Program Files (x86)\ISS Host\isshost.exe	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2496 schtasks.exe
2628 schtasks.exe

pid	process
2496	schtasks.exe
2628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

pid	process
2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

pid process

2208 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description pid process

Token: SeDebugPrivilege 2208 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	pid	process
Token: SeDebugPrivilege	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	pid	process	target process
PID 2208 wrote to memory of 2496	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2496	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2496	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2496	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2628	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2628	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2628	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2208 wrote to memory of 2628	2208	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
"C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ISS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA3E.tmp"
2⤵
- Creates scheduled task(s)
PID:2496

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ISS Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAFA.tmp"
2⤵
- Creates scheduled task(s)
PID:2628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA3E.tmp
Filesize
1KB

MD5
9913e267519b245bd05576cd155e618b

SHA1
f9988cc21222e156d8df51cc1c67ff394e0baa9a

SHA256
db8d12fa91ed89d361af77401bd08785c5b7d538627fe2591c69ad675daee81d

SHA512
fec48c5fec8a03bc55ff319580a512fcbe476d309cfb4dc8563f3cf5266a68418b8a200a2e6f0fb1131c936f6a9d79cdb0ba72e6f225c36921c6188021acd882

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAFA.tmp
Filesize
1KB

MD5
3d1580c0395f6de62659467f5b7f1acf

SHA1
8e73a3885896cecca7ff799a272fc9ddfe06ea96

SHA256
6f40196c42a171f24a3e16edeca664cdc5a2f7c150d468255b0e14ab10a2b714

SHA512
7637c0d9b03227dffcb00a68d97ddce60bfc40ca0f8a7a4bbd700ea56be6d570908511dea5cab9f609a7da2e558e5298c482fd1e330af085f9c52867d5a847ea

Download Submit
memory/2208-0-0x0000000074A40000-0x0000000074FEB000-memory.dmp

Filesize
5.7MB

Download
memory/2208-1-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download
memory/2208-2-0x0000000074A40000-0x0000000074FEB000-memory.dmp

Filesize
5.7MB

Download
memory/2208-10-0x0000000074A40000-0x0000000074FEB000-memory.dmp

Filesize
5.7MB

Download
memory/2208-11-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads