nanocore | 607b0ff863381ee25ef50bafe0d1903da3bd546860e62cebd7458e2daf8e1c65

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81be55c863016924a3134289fae40970_NeikiAnalytics.exe
Size

3.6MB
MD5

81be55c863016924a3134289fae40970
SHA1

980ff520a5dd3cee97c63544a9d8fa9fe327f101
SHA256

607b0ff863381ee25ef50bafe0d1903da3bd546860e62cebd7458e2daf8e1c65
SHA512

93fbc49ff1cfcd6dac58cbd60f225b292259ef70773351f2f447a7a39d3d672a569279125825f0eb83905ab7751b54df2d3e918e6bb35d1639e7ae9059eb4250
SSDEEP

49152:DtOcE5/k017aNCFTTIP5uqz2lSNd6ZoR9ttqQ/3FPnh:Dcj/kFs5IAqzSP85/3FPh

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

81be55c863016924a3134289fae40970_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	81be55c863016924a3134289fae40970_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

81be55c863016924a3134289fae40970_NeikiAnalytics.exe

pid	process
848	81be55c863016924a3134289fae40970_NeikiAnalytics.exe
848	81be55c863016924a3134289fae40970_NeikiAnalytics.exe
848	81be55c863016924a3134289fae40970_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

81be55c863016924a3134289fae40970_NeikiAnalytics.exe

pid process

848 81be55c863016924a3134289fae40970_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81be55c863016924a3134289fae40970_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 848 81be55c863016924a3134289fae40970_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	848	81be55c863016924a3134289fae40970_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\81be55c863016924a3134289fae40970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\81be55c863016924a3134289fae40970_NeikiAnalytics.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-0-0x0000000074972000-0x0000000074973000-memory.dmp

Filesize
4KB

Download
memory/848-1-0x0000000074970000-0x0000000074F21000-memory.dmp

Filesize
5.7MB

Download
memory/848-2-0x0000000074970000-0x0000000074F21000-memory.dmp

Filesize
5.7MB

Download
memory/848-4-0x0000000074970000-0x0000000074F21000-memory.dmp

Filesize
5.7MB

Download
memory/848-5-0x0000000074972000-0x0000000074973000-memory.dmp

Filesize
4KB

Download
memory/848-6-0x0000000074970000-0x0000000074F21000-memory.dmp

Filesize
5.7MB

Download
memory/848-7-0x0000000074970000-0x0000000074F21000-memory.dmp

Filesize
5.7MB

Download