nanocore | c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17

General

Target

2D5B4052BA6E888D0A2E8B044BC04651.exe
Size

452KB
MD5

2d5b4052ba6e888d0a2e8b044bc04651
SHA1

7c23a7ea336ceb57d3c9d43b38b5d7e6b2265443
SHA256

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17
SHA512

2fa5f0a2dd0d0f13a258aa97a96195b4f63441a79a3d60edf96684ee3c09525e783ea4c28629982420121a6d23099099c76075559fb3d0a86f8e2aa8d91ab5ed
SSDEEP

12288:8LV6BtpmkAuJO+CCSswmAf9CoPhxLz5zACZZ0d:OApfA7+XVwDY0hxLz5sCn0d

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IMAP Monitor = "C:\\Program Files (x86)\\IMAP Monitor\\imapmon.exe"	2D5B4052BA6E888D0A2E8B044BC04651.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2D5B4052BA6E888D0A2E8B044BC04651.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

2 6.tcp.eu.ngrok.io
33 6.tcp.eu.ngrok.io
41 6.tcp.eu.ngrok.io

flow	ioc
2	6.tcp.eu.ngrok.io
33	6.tcp.eu.ngrok.io
41	6.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

description	ioc	process
File created	C:\Program Files (x86)\IMAP Monitor\imapmon.exe	2D5B4052BA6E888D0A2E8B044BC04651.exe
File opened for modification	C:\Program Files (x86)\IMAP Monitor\imapmon.exe	2D5B4052BA6E888D0A2E8B044BC04651.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exeschtasks.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D5B4052BA6E888D0A2E8B044BC04651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3180 schtasks.exe
5004 schtasks.exe

pid	process
3180	schtasks.exe
5004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

pid	process
1440	2D5B4052BA6E888D0A2E8B044BC04651.exe
1440	2D5B4052BA6E888D0A2E8B044BC04651.exe
1440	2D5B4052BA6E888D0A2E8B044BC04651.exe
1440	2D5B4052BA6E888D0A2E8B044BC04651.exe
1440	2D5B4052BA6E888D0A2E8B044BC04651.exe
1440	2D5B4052BA6E888D0A2E8B044BC04651.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

pid process

1440 2D5B4052BA6E888D0A2E8B044BC04651.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

description pid process

Token: SeDebugPrivilege 1440 2D5B4052BA6E888D0A2E8B044BC04651.exe
Token: SeDebugPrivilege 1440 2D5B4052BA6E888D0A2E8B044BC04651.exe

description	pid	process
Token: SeDebugPrivilege	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe
Token: SeDebugPrivilege	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2D5B4052BA6E888D0A2E8B044BC04651.exe

description	pid	process	target process
PID 1440 wrote to memory of 3180	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe	schtasks.exe
PID 1440 wrote to memory of 3180	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe	schtasks.exe
PID 1440 wrote to memory of 3180	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe	schtasks.exe
PID 1440 wrote to memory of 5004	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe	schtasks.exe
PID 1440 wrote to memory of 5004	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe	schtasks.exe
PID 1440 wrote to memory of 5004	1440	2D5B4052BA6E888D0A2E8B044BC04651.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2D5B4052BA6E888D0A2E8B044BC04651.exe
"C:\Users\Admin\AppData\Local\Temp\2D5B4052BA6E888D0A2E8B044BC04651.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "IMAP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAFB8.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3180

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "IMAP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB017.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAFB8.tmp

Filesize
1KB

MD5
1cc1e86dcd6727b8a3c2cbbbd34bd872

SHA1
7cb7ee2ec407983deaa5e0bb980cd7a029b2daec

SHA256
01c879bb1d182930cccbd93eaaf3c67e7d96cac11c877533bf7b86d6eea7225c

SHA512
a6fef86a1e3854dc796ec4ccd4b3b30b7e29bf2f7b054280492db564f262c999f25e604ec9b102228c4b3696f482f1c7dddf34a81413d67f5f7b8bfbb834a767

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB017.tmp

Filesize
1KB

MD5
d2d6911d94b06e405e7687a2437eafec

SHA1
9f28f9e7d8d5179d44ddaa6ca266984ed7521dea

SHA256
2dc87169ad53fbdd7abb08f49777cb8fb05adbff4e6f6616b4c89942af8cad0f

SHA512
b5983de701ff98e944283a25f1770c1e792d52148dc1671f1d19203f8b9d10b056abcf79a17ca536a5f88ccf52f6445d8f3e75fce628666640ad8bad697dcfd1

Download Submit
memory/1440-0-0x0000000075222000-0x0000000075223000-memory.dmp

Filesize
4KB

Download
memory/1440-1-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/1440-2-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/1440-10-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/1440-11-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/1440-12-0x0000000075222000-0x0000000075223000-memory.dmp

Filesize
4KB

Download
memory/1440-13-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download
memory/1440-14-0x0000000075220000-0x00000000757D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads