nanocore | 7c1f3747508f5ec12c0f2979e1fa2e5fd62ca5c135a859947f43be74d09109bf

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 11:30

Target

e18f19570a01a97b669b8d24c7e310ff.exe
Size

6.3MB
MD5

e18f19570a01a97b669b8d24c7e310ff
SHA1

e7c8fbee74f9f94d9710b3350c2cf933aedfb96c
SHA256

7c1f3747508f5ec12c0f2979e1fa2e5fd62ca5c135a859947f43be74d09109bf
SHA512

43a886573e86f4631b5190532229d5e9867b547cd99892f43cac160d2c7455e33c8d5c5f83ffd050fa2dc3923dfd3d6769d2c806f4e6e046c431044fe746d6dc
SSDEEP

196608:ebz2DI5YvQnW9mybL/vjZq8xMTe0lNCoyFY3EwgdeqQDXGv2Mv/uum+hgdpLkSZo:85YLmmDBYm63sSbWJuPIe/Z

Score

10^/10

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

e18f19570a01a97b669b8d24c7e310ff.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e18f19570a01a97b669b8d24c7e310ff.exe

C:\Users\Admin\AppData\Local\Temp\e18f19570a01a97b669b8d24c7e310ff.exe
"C:\Users\Admin\AppData\Local\Temp\e18f19570a01a97b669b8d24c7e310ff.exe"
1⤵
- Checks whether UAC is enabled
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1676

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/5060-0-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/5060-1-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/5060-2-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/5060-3-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/5060-5-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/5060-6-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/5060-7-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download