nanocore | 1ba37151c9d3467ae73fda2bf4190b7d28c4102fa7b0a3aa7084135f23902933

Resubmissions

16-04-2024 19:21

240416-x2z2caad32 10

16-04-2024 19:15

240416-xydnyaac27 10

Analysis

max time kernel
105s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nananana.exe
Size

203KB
MD5

c6442af4b19ea669d08542dfdf9957f2
SHA1

f8567006a47d0ead38d2ecb0e33ea6968ebafc89
SHA256

1ba37151c9d3467ae73fda2bf4190b7d28c4102fa7b0a3aa7084135f23902933
SHA512

3bb116bd3610f98d3d3a693d5609ffc08fad6ca090c1d003671f6b4375cd7cb170e166612dffc19e9f8834c20077ab423dd03cf4c05075ae6de66ee14c868d4d
SSDEEP

6144:MLV6Bta6dtJmakIM50MBrwBJnaMC8xFev7y4QT1te:MLV6BtpmkxMFIPHPe2Dte

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

nananana.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nananana.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

10 0.tcp.in.ngrok.io
39 0.tcp.in.ngrok.io
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

nananana.exe

pid process

948 nananana.exe
948 nananana.exe
948 nananana.exe
948 nananana.exe
948 nananana.exe
948 nananana.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

nananana.exe

pid process

948 nananana.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nananana.exe

description pid process

Token: SeDebugPrivilege 948 nananana.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nananana.exe

flow	ioc
10	0.tcp.in.ngrok.io
39	0.tcp.in.ngrok.io

pid	process
948	nananana.exe
948	nananana.exe
948	nananana.exe
948	nananana.exe
948	nananana.exe
948	nananana.exe

pid	process
948	nananana.exe

description	pid	process
Token: SeDebugPrivilege	948	nananana.exe

C:\Users\Admin\AppData\Local\Temp\nananana.exe
"C:\Users\Admin\AppData\Local\Temp\nananana.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-0-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/948-2-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/948-1-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/948-7-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/948-8-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/948-9-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/948-10-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/948-11-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download
memory/948-12-0x0000000001870000-0x0000000001880000-memory.dmp

Filesize
64KB

Download