Overview
overview
10Static
static
10NanoCore_1...22.rar
windows10-2004-x64
3NanoCore 1...in.xml
windows10-2004-x64
1NanoCore 1...sqlite
windows10-2004-x64
3NanoCore 1...sqlite
windows10-2004-x64
3NanoCore 1...sqlite
windows10-2004-x64
3NanoCore 1...IO.ncp
windows10-2004-x64
3NanoCore 1...in.ncp
windows10-2004-x64
3NanoCore 1...in.ncp
windows10-2004-x64
3NanoCore 1...ls.ncp
windows10-2004-x64
3NanoCore 1...ck.ncp
windows10-2004-x64
3NanoCore 1...ss.ncp
windows10-2004-x64
3NanoCore 1...in.ncp
windows10-2004-x64
3NanoCore 1...in.ncp
windows10-2004-x64
3NanoCore 1...in.ncp
windows10-2004-x64
3NanoCore 1...in.ncp
windows10-2004-x64
3NanoCore 1...ra.wav
windows10-2004-x64
6NanoCore 1...te.png
windows10-2004-x64
3NanoCore 1...in.png
windows10-2004-x64
3NanoCore 1...en.png
windows10-2004-x64
3NanoCore 1...om.png
windows10-2004-x64
3NanoCore 1...el.png
windows10-2004-x64
3NanoCore 1...og.png
windows10-2004-x64
3NanoCore 1...el.png
windows10-2004-x64
3NanoCore 1...ry.png
windows10-2004-x64
3NanoCore 1...te.dll
windows10-2004-x64
1NanoCore 1...er.log
windows10-2004-x64
1NanoCore 1...nt.exe
windows10-2004-x64
10NanoCore 1...ns.bin
windows10-2004-x64
3NanoCore 1...ic.bin
windows10-2004-x64
3NanoCore 1...gs.bin
windows10-2004-x64
3NanoCore 1...op.dll
windows10-2004-x64
1NanoCore 1...op.dll
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 22:40
Behavioral task
behavioral1
Sample
NanoCore_1.2.2.0_Cracked_By_Alcatraz3222.rar
Resource
win10v2004-20230221-en
Behavioral task
behavioral2
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/ClientPlugin.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Databases/core.sqlite
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Databases/geolocation.sqlite
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Databases/network.sqlite
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/AIO.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/CorePlugin.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/DucPlugin.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/MiscTools.ncp
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/NanoBlack.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/NanoCoreSwiss.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/NanoProtectPlugin.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/NetworkPlugin.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/SurveillanceExPlugin.ncp
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Plugins/ToolsPlugin.ncp
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/Audio/camera.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/application_delete.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/bin.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/book_open.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/broom.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/cancel.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/cog.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/control_panel.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/ContextIcons/ddr_memory.png
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/System.Data.SQLite.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/builder.log
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/client.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/plugins.bin
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/public.bin
Resource
win10v2004-20230221-en
Behavioral task
behavioral30
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/settings.bin
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/x64/SQLite.Interop.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
NanoCore 1.2.2.0_Cracked By Alcatraz3222/x86/SQLite.Interop.dll
Resource
win10v2004-20230221-en
General
-
Target
NanoCore 1.2.2.0_Cracked By Alcatraz3222/Resources/Audio/camera.wav
-
Size
45KB
-
MD5
4567dbe9cc7cfdfe3a13a609e20a205e
-
SHA1
2242b43e9e6f45545b479883d72070fbff998340
-
SHA256
f49ec225a0df03534f4b9b265aeda561fd0a6b11d53038abaa27b3858db41aa1
-
SHA512
99828e282d4fac836d9bf597ee67305f24e1bbcd273e8e4fb56a08e6a98b34b16e53d8bb0b01e3e496099ad656ac54c1bde5d4145670c2354a4bc313ae67a118
-
SSDEEP
768:Ff+LOBHmFWHpphqrDAf/ozD6oNCvpsavQRU+pFATYZeuFk/jO/bH:sLOMQHp3iE3yD06aoUEk+Fkbw
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 4580 unregmp2.exe Token: SeCreatePagefilePrivilege 4580 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 4296 wrote to memory of 1140 4296 wmplayer.exe setup_wm.exe PID 4296 wrote to memory of 1140 4296 wmplayer.exe setup_wm.exe PID 4296 wrote to memory of 1140 4296 wmplayer.exe setup_wm.exe PID 4296 wrote to memory of 1920 4296 wmplayer.exe unregmp2.exe PID 4296 wrote to memory of 1920 4296 wmplayer.exe unregmp2.exe PID 4296 wrote to memory of 1920 4296 wmplayer.exe unregmp2.exe PID 1920 wrote to memory of 4580 1920 unregmp2.exe unregmp2.exe PID 1920 wrote to memory of 4580 1920 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\Audio\camera.wav"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\Audio\camera.wav"2⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
64KB
MD5dbfc662304aa4236ac6c685fdd3ee597
SHA1bee96b9256c93a35398a8c6a341da9470c6101c2
SHA256dfd76fd8ae4d04c006729be160e7c23fe8e003e7094a54abf3a5aaee1a5c5590
SHA5126730c50e8217e93d819b24a76af50ed9afeb34c73f32bcf65cca1bac139219c4897f7a43faa7a88909b32777420f47beb2a1ab23fad5886ef4da35226305c42b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD54a9c526034eaa04c101f88791da2a8be
SHA1a02d9ecb24a0f28c93c57e31877267a73326ed90
SHA256df97457766cfb7ffcc814fea32151db431f461a853df35314bcafd9c1b15c6c3
SHA5125ea4b371797d76476391b650f4d4c2e16e669c2220d658ba37ac7a973f211942fed62a7ce5da8c3a66735d43ed6f6d4292fbfd4c111bb5bb694b57b9392ab224