Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
09/05/2024, 01:33
General
- Target client.exe
- Size 130KB
- Sample240509-by1mtadf43
- SHA256 9d3ea5af7dc261bf93c76f55d702a315aa22fb241e4207dc86cd834c262245c8
Malware Config
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1540-0-0x00007FFEDADF5000-0x00007FFEDADF6000-memory.dmp
memory/1540-1-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-2-0x000000001C260000-0x000000001C72E000-memory.dmp
memory/1540-3-0x000000001BB90000-0x000000001BC2C000-memory.dmp
memory/1540-4-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-5-0x000000001C7E0000-0x000000001C886000-memory.dmp
memory/1540-6-0x0000000001680000-0x0000000001688000-memory.dmp
memory/1540-7-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-9-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-10-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-11-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-12-0x000000001CDC0000-0x000000001CDCA000-memory.dmp
memory/1540-13-0x00007FFEDADF5000-0x00007FFEDADF6000-memory.dmp
memory/1540-14-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-15-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-16-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-17-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-18-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp
memory/1540-19-0x00007FFEDAB40000-0x00007FFEDB4E1000-memory.dmp