nanocore | f3a93748905cad69e0bd87fa9eb50aa8a03a4eaf2c8441fd872107ca0d948ee1

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-en-20211014
submitted
25-10-2021 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

manager.exe
Size

202KB
MD5

1479371ef0752f027661fc1b7748b318
SHA1

3bf6809d0987cd82ec328b7bbdbcc5618743cf38
SHA256

183923330057af95cedb73d0aa2e7f844dba89df8866995f483be4c5780298b3
SHA512

cb10d09a5fc39acf2b799534900d0af2196df00123c6bbc485646960da69a0012d9423c60ae2d04687351fee52fc132c48bc62cc109f88588f766f9d977ce6f2

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

manager.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA manager.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

manager.exe

pid process

752 manager.exe
752 manager.exe
752 manager.exe
752 manager.exe
752 manager.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

manager.exe

pid process

752 manager.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

manager.exe

description pid process

Token: SeDebugPrivilege 752 manager.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	manager.exe

pid	process
752	manager.exe
752	manager.exe
752	manager.exe
752	manager.exe
752	manager.exe

pid	process
752	manager.exe

description	pid	process
Token: SeDebugPrivilege	752	manager.exe

C:\Users\Admin\AppData\Local\Temp\manager.exe
"C:\Users\Admin\AppData\Local\Temp\manager.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/752-56-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads