nanocore | 7c1f3747508f5ec12c0f2979e1fa2e5fd62ca5c135a859947f43be74d09109bf

Analysis

max time kernel
159s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 11:30

Target

e18f19570a01a97b669b8d24c7e310ff.exe
Size

6.3MB
MD5

e18f19570a01a97b669b8d24c7e310ff
SHA1

e7c8fbee74f9f94d9710b3350c2cf933aedfb96c
SHA256

7c1f3747508f5ec12c0f2979e1fa2e5fd62ca5c135a859947f43be74d09109bf
SHA512

43a886573e86f4631b5190532229d5e9867b547cd99892f43cac160d2c7455e33c8d5c5f83ffd050fa2dc3923dfd3d6769d2c806f4e6e046c431044fe746d6dc
SSDEEP

196608:ebz2DI5YvQnW9mybL/vjZq8xMTe0lNCoyFY3EwgdeqQDXGv2Mv/uum+hgdpLkSZo:85YLmmDBYm63sSbWJuPIe/Z

Score

10^/10

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

e18f19570a01a97b669b8d24c7e310ff.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e18f19570a01a97b669b8d24c7e310ff.exe

C:\Users\Admin\AppData\Local\Temp\e18f19570a01a97b669b8d24c7e310ff.exe
"C:\Users\Admin\AppData\Local\Temp\e18f19570a01a97b669b8d24c7e310ff.exe"
1⤵
- Checks whether UAC is enabled
PID:1180

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/1180-0-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/1180-1-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/1180-2-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/1180-4-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/1180-5-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/1180-6-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/1180-7-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download