Attempts to execute on secondary objectives such as sensitive data exfiltration, monitoring and surveillance, deploying ransomware, and further network enumeration and lateral movement.

Establishes communication with a command and control (C2) server to receive relay environment and system architecture.

Adds itself to the Windows Registry Run keys to maintain persistence even after a reboot.

exe) files in the victim’s home directory

Injects itself into RegAsm.exe using a technique known as process hollowing to execute its primary payload with a high privilege level.

These initial access attacks predominantly use social engineering tactics such as email phishing to bait a victim. Unfortunately, the imprisonment of Nanocore’s leader did not stop the malware’s continued development and propagation in 2021, Nanocore was rated as a top malware strain by CISA and is considered high-risk.Īs a second-stage exploit kit, Nanocore is introduced to a victim’s system by first-stage downloader malware as part of the initial exploit. In 2017 the FBI tracked down and arrested Nanocore’s leading developer, who was sentenced to 33 months in prison for violating the Computer Fraud and Abuse Act.

Credentials stolen by Nanocore are typically used to compromise local network or cloud-service accounts further or are sold on the Dark Web.įirst observed in 2013, Nanocore has seen several version updates since its inception and continues to be maintained by a community of developers.

But the malware’s modular, plugin-based architecture allows even novice threat actors to quickly configure automated exploits, including file exfiltration, keystroke logging, screenshot exfiltration, and other hardware exploitation capabilities like webcam and microphone surveillance. Nanocore gives an attacker direct access to the compromised system to execute objectives manually. iso disk image files, and binary image files, to evade endpoint security products. Nanocore is usually delivered via infected Microsoft Office documents but has been observed to be delivered with more sophisticated methods, such as in encrypted. Nanocore is sophisticated second-stage malware classified as a Remote Access Trojan (RAT) that provides attackers with Remote Code Execution (RCE) on a victim’s system.

Crypter that works with nanocore