nanocore | 593ca3c64c7bb92f0636ed1b69cd9223a0fdd4ef348035862b0abeb4c2364a26

General

Target

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
Size

452KB
MD5

2d5b4052ba6e888d0a2e8b044bc04651
SHA1

7c23a7ea336ceb57d3c9d43b38b5d7e6b2265443
SHA256

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17
SHA512

2fa5f0a2dd0d0f13a258aa97a96195b4f63441a79a3d60edf96684ee3c09525e783ea4c28629982420121a6d23099099c76075559fb3d0a86f8e2aa8d91ab5ed
SSDEEP

12288:8LV6BtpmkAuJO+CCSswmAf9CoPhxLz5zACZZ0d:OApfA7+XVwDY0hxLz5sCn0d

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Monitor = "C:\\Program Files (x86)\\DSL Monitor\\dslmon.exe"	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 36 IoCs

Web Service

T1102

Processes:

flow	ioc
47	6.tcp.eu.ngrok.io
75	6.tcp.eu.ngrok.io
100	6.tcp.eu.ngrok.io
102	6.tcp.eu.ngrok.io
53	6.tcp.eu.ngrok.io
57	6.tcp.eu.ngrok.io
92	6.tcp.eu.ngrok.io
107	6.tcp.eu.ngrok.io
109	6.tcp.eu.ngrok.io
4	6.tcp.eu.ngrok.io
32	6.tcp.eu.ngrok.io
69	6.tcp.eu.ngrok.io
96	6.tcp.eu.ngrok.io
84	6.tcp.eu.ngrok.io
98	6.tcp.eu.ngrok.io
104	6.tcp.eu.ngrok.io
90	6.tcp.eu.ngrok.io
19	6.tcp.eu.ngrok.io
27	6.tcp.eu.ngrok.io
55	6.tcp.eu.ngrok.io
81	6.tcp.eu.ngrok.io
71	6.tcp.eu.ngrok.io
88	6.tcp.eu.ngrok.io
94	6.tcp.eu.ngrok.io
65	6.tcp.eu.ngrok.io
67	6.tcp.eu.ngrok.io
86	6.tcp.eu.ngrok.io
17	6.tcp.eu.ngrok.io
25	6.tcp.eu.ngrok.io
50	6.tcp.eu.ngrok.io
59	6.tcp.eu.ngrok.io
73	6.tcp.eu.ngrok.io
21	6.tcp.eu.ngrok.io
23	6.tcp.eu.ngrok.io
44	6.tcp.eu.ngrok.io
63	6.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	ioc	process
File created	C:\Program Files (x86)\DSL Monitor\dslmon.exe	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
File opened for modification	C:\Program Files (x86)\DSL Monitor\dslmon.exe	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exeschtasks.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3392 schtasks.exe
1708 schtasks.exe

pid	process
3392	schtasks.exe
1708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

pid	process
3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

pid process

3592 c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	pid	process
Token: SeDebugPrivilege	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
Token: SeDebugPrivilege	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe

description	pid	process	target process
PID 3592 wrote to memory of 3392	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 3592 wrote to memory of 3392	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 3592 wrote to memory of 3392	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 3592 wrote to memory of 1708	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 3592 wrote to memory of 1708	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe
PID 3592 wrote to memory of 1708	3592	c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe
"C:\Users\Admin\AppData\Local\Temp\c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp72A0.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DSL Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp730E.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp72A0.tmp
Filesize
1KB

MD5
14608f606fdbc8c928fc56a257d4c283

SHA1
cc88cc40f7b676fc03f413877066dd2dc51569d7

SHA256
c4de491d38884874a17664a071aa3cfb39c2d7de9e24b684813a52577c47615f

SHA512
4b3b1496a8f800a4a609d24a7a91589e0377c217b76647f6e38a2367bc51e12106471ae0e06fe09ca00c5c3bb09a5bf42dd370445dd01c17664223f513d395b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp730E.tmp
Filesize
1KB

MD5
eeeec12536233e9353f6f2aa14eaa5d8

SHA1
61fefdc5646ed69df8d1cc2e24f8d5409ae90da9

SHA256
922551f7dcda34b377e984ccdcc0f97bc4524599caf715a2ace06db37923b5f3

SHA512
944143921d0fd1a6c1a0fda8163d4b311ba38e7ed2726a605f147c08d40578c47e5ec147a17458823c7a61b820950a906e31a383f87aeae67d603260914fe392

Download Submit
memory/3592-0-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Filesize
4KB

Download
memory/3592-1-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3592-2-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3592-10-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3592-11-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Filesize
4KB

Download
memory/3592-12-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3592-13-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads