nanocore | 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0

General

Target

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
Size

203KB
MD5

07d9144c3b3cfe44c24f850a74faaacc
SHA1

1df82c6dbe192d9f78e137bb96c499fd5f0c93a5
SHA256

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0
SHA512

39120f944f46dfa34f0d4a2e59a9bdb74a76d9f69b55c054969a96666b0366651bcc2a0ab4a48f3243a2046e961f43fba5e13d5b04248eeae0f86b7428133584
SSDEEP

6144:sLV6Bta6dtJmakIM51O3JM1fMKQqa7FPp0k4v:sLV6BtpmkBGpC78v

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 27 IoCs

Web Service

T1102

Processes:

flow	ioc
2	0.tcp.eu.ngrok.io
14	0.tcp.eu.ngrok.io
24	0.tcp.eu.ngrok.io
44	0.tcp.eu.ngrok.io
26	0.tcp.eu.ngrok.io
40	0.tcp.eu.ngrok.io
46	0.tcp.eu.ngrok.io
48	0.tcp.eu.ngrok.io
4	0.tcp.eu.ngrok.io
8	0.tcp.eu.ngrok.io
12	0.tcp.eu.ngrok.io
18	0.tcp.eu.ngrok.io
52	0.tcp.eu.ngrok.io
10	0.tcp.eu.ngrok.io
16	0.tcp.eu.ngrok.io
34	0.tcp.eu.ngrok.io
42	0.tcp.eu.ngrok.io
22	0.tcp.eu.ngrok.io
38	0.tcp.eu.ngrok.io
50	0.tcp.eu.ngrok.io
54	0.tcp.eu.ngrok.io
20	0.tcp.eu.ngrok.io
28	0.tcp.eu.ngrok.io
36	0.tcp.eu.ngrok.io
6	0.tcp.eu.ngrok.io
30	0.tcp.eu.ngrok.io
32	0.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2240 schtasks.exe
544 schtasks.exe

pid	process
2240	schtasks.exe
544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

pid	process
2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

pid process

2892 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description pid process

Token: SeDebugPrivilege 2892 4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	pid	process
Token: SeDebugPrivilege	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe

description	pid	process	target process
PID 2892 wrote to memory of 2240	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 2240	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 2240	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 2240	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 544	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 544	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 544	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe
PID 2892 wrote to memory of 544	2892	4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe
"C:\Users\Admin\AppData\Local\Temp\4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1796.tmp"
2⤵
- Creates scheduled task(s)
PID:2240

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1833.tmp"
2⤵
- Creates scheduled task(s)
PID:544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1796.tmp
Filesize
1KB

MD5
9913e267519b245bd05576cd155e618b

SHA1
f9988cc21222e156d8df51cc1c67ff394e0baa9a

SHA256
db8d12fa91ed89d361af77401bd08785c5b7d538627fe2591c69ad675daee81d

SHA512
fec48c5fec8a03bc55ff319580a512fcbe476d309cfb4dc8563f3cf5266a68418b8a200a2e6f0fb1131c936f6a9d79cdb0ba72e6f225c36921c6188021acd882

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1833.tmp
Filesize
1KB

MD5
93fc3117767507c9889abd12dc667d22

SHA1
1096e4cfa0c35756e3c3fb866c1e4c1e59115df9

SHA256
684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a

SHA512
e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

Download Submit
memory/2892-0-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-1-0x0000000001D90000-0x0000000001DD0000-memory.dmp

Filesize
256KB

Download
memory/2892-2-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-10-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-11-0x0000000001D90000-0x0000000001DD0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads