MALICIOUS — nanocore.exe

MALICIOUS — nanocore.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the NanoCore family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 589e46d07f1239dd6b8b07a00d5739279648863d9cc78ced1a05fb034fc16122
SHA-1: ffa21433f4d9994417951617ce8b089fe632ecc5
MD5: da3635d346d58158cb0e09addd12f5b2
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:MLV6Bta6dtJmakIM55Yi2H5fni/MuQfKK:MLV6Btpmk+YHtniY1
TLSH: T11042D0CE04780DC5F477ED126ACEF5CFBCA08DEAD935AED90142D17619A4C27902B42A
Submitted as: nanocore.exe
File type: pe · Size: 207872 bytes
Verdict: malicious (100/100) · Family: NanoCore

Detections (6 of 56 engines)

ClamAV (daily): Win.Trojan.NanoCore-9852758-0
Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Backdoor:MSIL/Nanocore!atmn
Emsisoft (Emergency Kit): Trojan.NanoCore
Trellix Stinger (McAfee): Trojan-FICC!DA3635D346D5
Kaspersky (KVRT): Trojan.MSIL.Agent.fpar

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.NanoCore-9852758-0 (rule Win.Trojan.NanoCore-9852758-0) - engine signal, weight 0.90, confidence 0.95
Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Backdoor:MSIL/Nanocore!atmn (rule Backdoor:MSIL/Nanocore!atmn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.NanoCore (rule Trojan.NanoCore) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FICC!DA3635D346D5 (rule Trojan-FICC!DA3635D346D5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.MSIL.Agent.fpar (rule Trojan.MSIL.Agent.fpar) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted NanoCore config (0 C2) - engine signal, weight 0.45, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6075 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\EF33C369-7052-400C-B0E0-BDA7628BB461\run.dat - ea35a5c77672cdbb7328a309e1d012e34cfe2fbb4d687c582e1a8cd9214b59cf
C:\Users\analyst\AppData\Local\Temp\client.log - 4812a4079b82dfdfea6d9f7834b65a886a0dacb6f0aa8d1df6ac2234ff4ae20c
C:\Users\analyst\AppData\Roaming\EF33C369-7052-400C-B0E0-BDA7628BB461\task.dat - 1a560f7894dd35ca820c3b8f31fc5e9cd28e581eece4dd1c756fc92ea1533936
C:\Users\analyst\AppData\Local\Temp\tmp4B0F.tmp - 8de0bab59a9fe15f312e81a373382ed992ce5110deb3813f663b92cfc5eae0b6
C:\Users\analyst\AppData\Local\Temp\tmp30A0.tmp - 841154baee32a829b6045ad0bb9cc8de97744e05be4918b9ea56f4738a7a3b9f
fbbc35a8d32ad681c23573176477d864daeedc6cdce22fbf41ff25459ac6747e - fbbc35a8d32ad681c23573176477d864daeedc6cdce22fbf41ff25459ac6747e
53ca8265abb5ab1e4fbffd0c93ca2b3f57304861677b61f29d63c5c459c8d5f5 - 53ca8265abb5ab1e4fbffd0c93ca2b3f57304861677b61f29d63c5c459c8d5f5
2e1e128dc308a1cbde155d0c42172f25b6fad1bf1bd75743c4172e0739530d73 - 2e1e128dc308a1cbde155d0c42172f25b6fad1bf1bd75743c4172e0739530d73
5d0b09ddf7ade596e181959d546ffd666e836230e57adb24f074eba9cba1d70b - 5d0b09ddf7ade596e181959d546ffd666e836230e57adb24f074eba9cba1d70b
61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403 - 61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
2de079dcd0bd33416d8cb5208c7447dd70b03da534da4cd138789da2751c3282 - 2de079dcd0bd33416d8cb5208c7447dd70b03da534da4cd138789da2751c3282
ef6bb59ed6db177996a26fa28d0fda03078f6d170bf16e1cdf2b0e01325ebec0 - ef6bb59ed6db177996a26fa28d0fda03078f6d170bf16e1cdf2b0e01325ebec0
f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec - f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec
b31ad52c353d7429abd83eda4772fa20323aac97c421fecea168404baf92021a - b31ad52c353d7429abd83eda4772fa20323aac97c421fecea168404baf92021a
308025fc8987b532e7a0eb4bafb196fa0f94bc5c04d85bede964994dbf2f8f1d - 308025fc8987b532e7a0eb4bafb196fa0f94bc5c04d85bede964994dbf2f8f1d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

vamox.io
www.vamox.io
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.96
52.123.252.215
4.230.171.124
40.84.85.40
57.155.104.224
4.247.188.224
20.165.94.63
20.247.184.142
20.184.175.6
74.179.77.164
172.64.154.167
172.67.201.63
104.21.76.213
20.184.175.8
125.56.205.24
125.56.205.32
125.56.205.42
72.154.7.17
52.148.114.188
52.110.12.22
52.110.12.24

More NanoCore samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report