nanocore | 369d6c63e2db3360bdea83f3598171f0e5da1697b3c6811624b77e4127dfed76 | Triage

Submit
Reports

Overview

overview

Static

static

Quotation Order.exe

windows7_x64

Quotation Order.exe

windows10_x64

Sharing

General

Target

Quotation Order.exe
Size

216KB
Sample

210421-lyqspd7kqa
MD5

4485273f76f2a9bdbb1e077030ec861a
SHA1

a1cc14f83f2155946838afbbbdf3500789118385
SHA256

369d6c63e2db3360bdea83f3598171f0e5da1697b3c6811624b77e4127dfed76
SHA512

e450630fc34834463ce86926f1838cfb0a722d41f9a05d9be0f01cbcb852201c2bc2a704181a8c4fe109911aa5ebf9c0a4c33235d083bf09e55fa3d812fcf0d5

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

Quotation Order.exe

Resource

win7v20210410

nanocore evasion keylogger persistence spyware stealer trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

Quotation Order.exe

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  Quotation Order.exe
- Size
  
  216KB
- MD5
  
  4485273f76f2a9bdbb1e077030ec861a
- SHA1
  
  a1cc14f83f2155946838afbbbdf3500789118385
- SHA256
  
  369d6c63e2db3360bdea83f3598171f0e5da1697b3c6811624b77e4127dfed76
- SHA512
  
  e450630fc34834463ce86926f1838cfb0a722d41f9a05d9be0f01cbcb852201c2bc2a704181a8c4fe109911aa5ebf9c0a4c33235d083bf09e55fa3d812fcf0d5
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Turns off Windows Defender SpyNet reporting
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Nirsoft
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Bypass User Account Control

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

Bypass User Account Control

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy