5809a1e4b5ac6b59aea48113f1f921e9bf81476a335f244442d5ea85632d3ff4

Analysis

max time kernel
60s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nanacore/NanoCore.exe
Size

1.4MB
MD5

1728acc244115cbafd3b810277d2e321
SHA1

be64732f46c8a26a5bbf9d7f69c7f031b2c5180b
SHA256

ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b
SHA512

8c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034
SSDEEP

24576:d7dOT1b7eAJzjSTUd+21nm3kEvpqZ0vSxmfexX6shz07DTl/uz:d7dqVw2+2KkS4PmGX6og7

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NanoCore.exe

description pid process

Token: SeDebugPrivilege 1176 NanoCore.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

NanoCore.exe

pid process

1176 NanoCore.exe
1176 NanoCore.exe

description	pid	process
Token: SeDebugPrivilege	1176	NanoCore.exe

pid	process
1176	NanoCore.exe
1176	NanoCore.exe

C:\Users\Admin\AppData\Local\Temp\nanacore\NanoCore.exe
"C:\Users\Admin\AppData\Local\Temp\nanacore\NanoCore.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-133-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-134-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/1176-135-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-136-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-137-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-138-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-140-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-146-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-147-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-149-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-150-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-151-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-152-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-153-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-154-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-155-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download
memory/1176-156-0x00000000010D0000-0x00000000010E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads