Overview
overview
10Static
static
10nanacore/1.exe
windows10-2004-x64
10nanacore/C...in.dll
windows10-2004-x64
1nanacore/NanoCore.exe
windows10-2004-x64
1nanacore/P...er.exe
windows10-2004-x64
1nanacore/S...in.dll
windows10-2004-x64
1nanacore/S...te.dll
windows10-2004-x64
1nanacore/client.exe
windows10-2004-x64
10nanacore/x...op.dll
windows10-2004-x64
1nanacore/x...op.dll
windows10-2004-x64
1Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 22:03
Behavioral task
behavioral1
Sample
nanacore/1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
nanacore/ClientPlugin.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
nanacore/NanoCore.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
nanacore/PluginCompiler.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
nanacore/ServerPlugin.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
nanacore/System.Data.SQLite.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
nanacore/client.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
nanacore/x64/SQLite.Interop.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
nanacore/x86/SQLite.Interop.dll
Resource
win10v2004-20230220-en
General
-
Target
nanacore/x86/SQLite.Interop.dll
-
Size
792KB
-
MD5
9b19dcee960dc215e64b1d82348707a9
-
SHA1
9c1e0f76673eb385787120e17404df179316ca2b
-
SHA256
3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38
-
SHA512
cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d
-
SSDEEP
12288:iIF0SBEkDG7/jznRefvOIVcn4PW5d6PrVJNcdwLzs9w:iIYkDG7rznRenOIVc4PW76TbK
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 684 wrote to memory of 628 684 rundll32.exe rundll32.exe PID 684 wrote to memory of 628 684 rundll32.exe rundll32.exe PID 684 wrote to memory of 628 684 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nanacore\x86\SQLite.Interop.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nanacore\x86\SQLite.Interop.dll,#12⤵