nanocore | 593ca3c64c7bb92f0636ed1b69cd9223a0fdd4ef348035862b0abeb4c2364a26

General

Target

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
Size

452KB
MD5

2d5b4052ba6e888d0a2e8b044bc04651
SHA1

7c23a7ea336ceb57d3c9d43b38b5d7e6b2265443
SHA256

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17
SHA512

2fa5f0a2dd0d0f13a258aa97a96195b4f63441a79a3d60edf96684ee3c09525e783ea4c28629982420121a6d23099099c76075559fb3d0a86f8e2aa8d91ab5ed
SSDEEP

12288:8LV6BtpmkAuJO+CCSswmAf9CoPhxLz5zACZZ0d:OApfA7+XVwDY0hxLz5sCn0d

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Monitor = "C:\\Program Files (x86)\\UDP Monitor\\udpmon.exe"	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 36 IoCs

Web Service

T1102

Processes:

flow	ioc
14	6.tcp.eu.ngrok.io
30	6.tcp.eu.ngrok.io
38	6.tcp.eu.ngrok.io
42	6.tcp.eu.ngrok.io
10	6.tcp.eu.ngrok.io
24	6.tcp.eu.ngrok.io
62	6.tcp.eu.ngrok.io
68	6.tcp.eu.ngrok.io
8	6.tcp.eu.ngrok.io
20	6.tcp.eu.ngrok.io
28	6.tcp.eu.ngrok.io
46	6.tcp.eu.ngrok.io
54	6.tcp.eu.ngrok.io
16	6.tcp.eu.ngrok.io
22	6.tcp.eu.ngrok.io
56	6.tcp.eu.ngrok.io
12	6.tcp.eu.ngrok.io
26	6.tcp.eu.ngrok.io
36	6.tcp.eu.ngrok.io
70	6.tcp.eu.ngrok.io
72	6.tcp.eu.ngrok.io
6	6.tcp.eu.ngrok.io
18	6.tcp.eu.ngrok.io
34	6.tcp.eu.ngrok.io
40	6.tcp.eu.ngrok.io
50	6.tcp.eu.ngrok.io
58	6.tcp.eu.ngrok.io
64	6.tcp.eu.ngrok.io
2	6.tcp.eu.ngrok.io
4	6.tcp.eu.ngrok.io
32	6.tcp.eu.ngrok.io
48	6.tcp.eu.ngrok.io
52	6.tcp.eu.ngrok.io
44	6.tcp.eu.ngrok.io
60	6.tcp.eu.ngrok.io
66	6.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
File created	C:\Program Files (x86)\UDP Monitor\udpmon.exe	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
File opened for modification	C:\Program Files (x86)\UDP Monitor\udpmon.exe	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeschtasks.exec00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2592 schtasks.exe
2460 schtasks.exe

pid	process
2592	schtasks.exe
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

pid	process
948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

pid process

948 c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	pid	process
Token: SeDebugPrivilege	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
Token: SeDebugPrivilege	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	pid	process	target process
PID 948 wrote to memory of 2592	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2592	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2592	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2592	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2460	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2460	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2460	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 948 wrote to memory of 2460	948	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
"C:\Users\Admin\AppData\Local\Temp\c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UDP Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1555.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UDP Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp15F2.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1555.tmp

Filesize
1KB

MD5
14608f606fdbc8c928fc56a257d4c283

SHA1
cc88cc40f7b676fc03f413877066dd2dc51569d7

SHA256
c4de491d38884874a17664a071aa3cfb39c2d7de9e24b684813a52577c47615f

SHA512
4b3b1496a8f800a4a609d24a7a91589e0377c217b76647f6e38a2367bc51e12106471ae0e06fe09ca00c5c3bb09a5bf42dd370445dd01c17664223f513d395b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15F2.tmp

Filesize
1KB

MD5
179f6a368194b3d8490223f22126274b

SHA1
cc2997c7fde3cfe0dcf267bf3b6338a7e2ecf2d0

SHA256
cdfb59fb9dabcedf57f84d9b3ea596f6ce26f8c559b503b6980a42738cf2f4d8

SHA512
8b1c1b2a8db227db2e741171c29e4bfcaad2919665cde77eb5b4058b45fe7c78b46e2ef1bc5b896aa0e172219c4a43b647d68b62db39c8f51ac0ed159e4f042b

Download Submit
memory/948-0-0x00000000746D1000-0x00000000746D2000-memory.dmp

Filesize
4KB

Download
memory/948-1-0x00000000746D0000-0x0000000074C7B000-memory.dmp

Filesize
5.7MB

Download
memory/948-2-0x00000000746D0000-0x0000000074C7B000-memory.dmp

Filesize
5.7MB

Download
memory/948-10-0x00000000746D0000-0x0000000074C7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads