nanocore | 5b68e9707ce610dc2f8684699473b677b7d9ee8893d8030716cc091fa8763b04

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cracksetup.exe
Size

180KB
MD5

73b4985055e9ef42df1d630218d484c0
SHA1

e444a3e9f2a2e86afed479d01ad217ecaf17c625
SHA256

5b68e9707ce610dc2f8684699473b677b7d9ee8893d8030716cc091fa8763b04
SHA512

31fc0ab3a53b46f7c12472afe643726bd52f1dcd7b03328ad03f80245ac2ae3e3d1ca968b85ef6ca4ab36a01c1145420bef59b989549870ff70b98997c1e13cf
SSDEEP

3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HILUgSHQkID1wP1e/0:MLV6Bta6dtJmakIM5PwjS17

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

cracksetup.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cracksetup.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cracksetup.exe

pid process

1308 cracksetup.exe
1308 cracksetup.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cracksetup.exe

pid process

1308 cracksetup.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cracksetup.exe

description pid process

Token: SeDebugPrivilege 1308 cracksetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cracksetup.exe

pid	process
1308	cracksetup.exe
1308	cracksetup.exe

pid	process
1308	cracksetup.exe

description	pid	process
Token: SeDebugPrivilege	1308	cracksetup.exe

C:\Users\Admin\AppData\Local\Temp\cracksetup.exe
"C:\Users\Admin\AppData\Local\Temp\cracksetup.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-55-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

Filesize
256KB

Download
memory/1308-56-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

Filesize
256KB

Download