Overview
overview
10Static
static
10NanoCore-m...in.dll
windows7-x64
1NanoCore-m...in.dll
windows10-2004-x64
1NanoCore-m...ib.dll
windows7-x64
1NanoCore-m...ib.dll
windows10-2004-x64
1NanoCore-m...er.exe
windows7-x64
1NanoCore-m...er.exe
windows10-2004-x64
1NanoCore-m...re.exe
windows7-x64
10NanoCore-m...re.exe
windows10-2004-x64
10NanoCore-m...in.dll
windows7-x64
1NanoCore-m...in.dll
windows10-2004-x64
1NanoCore-m...te.dll
windows7-x64
1NanoCore-m...te.dll
windows10-2004-x64
1NanoCore-m...nt.exe
windows7-x64
3NanoCore-m...nt.exe
windows10-2004-x64
7NanoCore-m...op.dll
windows7-x64
1NanoCore-m...op.dll
windows10-2004-x64
1NanoCore-m...op.dll
windows7-x64
3NanoCore-m...op.dll
windows10-2004-x64
3Analysis
-
max time kernel
115s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-08-2024 02:33
Behavioral task
behavioral1
Sample
NanoCore-master/sample/ClientPlugin.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
NanoCore-master/sample/ClientPlugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
NanoCore-master/sample/Interop.NATUPNPLib.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
NanoCore-master/sample/Interop.NATUPNPLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
NanoCore-master/sample/NanoCore Plugin Compiler.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
NanoCore-master/sample/NanoCore Plugin Compiler.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
NanoCore-master/sample/NanoCore.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
NanoCore-master/sample/NanoCore.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
NanoCore-master/sample/ServerPlugin.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
NanoCore-master/sample/ServerPlugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
NanoCore-master/sample/System.Data.SQLite.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
NanoCore-master/sample/System.Data.SQLite.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
NanoCore-master/sample/client.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
NanoCore-master/sample/client.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
NanoCore-master/sample/x64/SQLite.Interop.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
NanoCore-master/sample/x64/SQLite.Interop.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
NanoCore-master/sample/x86/SQLite.Interop.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
NanoCore-master/sample/x86/SQLite.Interop.dll
Resource
win10v2004-20240802-en
General
-
Target
NanoCore-master/sample/client.exe
-
Size
87KB
-
MD5
e7dde6ff81df20066d7c57bb32d45193
-
SHA1
f4494f962a6241715f1d313fee37203b6607e42b
-
SHA256
f63d7fecabfd501643a12ff3988f2809a1573009a452510e286a91554d49599d
-
SHA512
da3ec487122b70a062dd7ffc792fc4d7cb223775a7e09ca9664bc259097d53ad93678cfeec32d554783f37f9d23a299a0e75ee7e9951abf9d4da8d55e58eb527
-
SSDEEP
1536:EtPtlChZHNnK1MJTmvuzazpZl4hTPnmOIP+LNPSP2avOauA:Edtl8NnwMJTm/9kTPnmOg+LNQ2aJuA
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2280 client.exe Token: SeDebugPrivilege 1892 client.exe Token: SeDebugPrivilege 2472 client.exe Token: SeDebugPrivilege 2900 client.exe Token: SeDebugPrivilege 748 client.exe Token: SeDebugPrivilege 2804 client.exe Token: SeDebugPrivilege 2664 client.exe Token: SeDebugPrivilege 2680 client.exe Token: SeDebugPrivilege 2184 client.exe Token: SeDebugPrivilege 1900 client.exe Token: SeDebugPrivilege 2020 client.exe Token: SeDebugPrivilege 1752 client.exe Token: SeDebugPrivilege 1136 client.exe Token: SeDebugPrivilege 1132 client.exe Token: SeDebugPrivilege 2956 client.exe Token: SeDebugPrivilege 2980 client.exe Token: SeDebugPrivilege 2516 client.exe Token: SeDebugPrivilege 2588 client.exe Token: SeDebugPrivilege 2676 client.exe Token: SeDebugPrivilege 1912 client.exe Token: SeDebugPrivilege 1968 client.exe Token: SeDebugPrivilege 1140 client.exe Token: SeDebugPrivilege 2456 client.exe Token: SeDebugPrivilege 980 client.exe Token: SeDebugPrivilege 528 client.exe Token: SeDebugPrivilege 2580 client.exe Token: SeDebugPrivilege 868 client.exe Token: SeDebugPrivilege 2524 client.exe Token: SeDebugPrivilege 2496 client.exe Token: SeDebugPrivilege 2992 client.exe Token: SeDebugPrivilege 2264 client.exe Token: SeDebugPrivilege 2872 client.exe Token: SeDebugPrivilege 2732 client.exe Token: SeDebugPrivilege 3000 client.exe Token: SeDebugPrivilege 284 client.exe Token: SeDebugPrivilege 2604 client.exe Token: SeDebugPrivilege 1212 client.exe Token: SeDebugPrivilege 852 client.exe Token: SeDebugPrivilege 2328 client.exe Token: SeDebugPrivilege 2276 client.exe Token: SeDebugPrivilege 1996 client.exe Token: SeDebugPrivilege 1720 client.exe Token: SeDebugPrivilege 1564 client.exe Token: SeDebugPrivilege 2968 client.exe Token: SeDebugPrivilege 2228 client.exe Token: SeDebugPrivilege 2648 client.exe Token: SeDebugPrivilege 2560 client.exe Token: SeDebugPrivilege 304 client.exe Token: SeDebugPrivilege 1784 client.exe Token: SeDebugPrivilege 1000 client.exe Token: SeDebugPrivilege 2056 client.exe Token: SeDebugPrivilege 2792 client.exe Token: SeDebugPrivilege 1680 client.exe Token: SeDebugPrivilege 2484 client.exe Token: SeDebugPrivilege 2188 client.exe Token: SeDebugPrivilege 1088 client.exe Token: SeDebugPrivilege 1596 client.exe Token: SeDebugPrivilege 2492 client.exe Token: SeDebugPrivilege 2548 client.exe Token: SeDebugPrivilege 1400 client.exe Token: SeDebugPrivilege 2912 client.exe Token: SeDebugPrivilege 2616 client.exe Token: SeDebugPrivilege 2768 client.exe Token: SeDebugPrivilege 2836 client.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1892 2280 client.exe 31 PID 2280 wrote to memory of 1892 2280 client.exe 31 PID 2280 wrote to memory of 1892 2280 client.exe 31 PID 1892 wrote to memory of 2472 1892 client.exe 32 PID 1892 wrote to memory of 2472 1892 client.exe 32 PID 1892 wrote to memory of 2472 1892 client.exe 32 PID 2472 wrote to memory of 2900 2472 client.exe 33 PID 2472 wrote to memory of 2900 2472 client.exe 33 PID 2472 wrote to memory of 2900 2472 client.exe 33 PID 2900 wrote to memory of 748 2900 client.exe 34 PID 2900 wrote to memory of 748 2900 client.exe 34 PID 2900 wrote to memory of 748 2900 client.exe 34 PID 748 wrote to memory of 2804 748 client.exe 35 PID 748 wrote to memory of 2804 748 client.exe 35 PID 748 wrote to memory of 2804 748 client.exe 35 PID 2804 wrote to memory of 2664 2804 client.exe 36 PID 2804 wrote to memory of 2664 2804 client.exe 36 PID 2804 wrote to memory of 2664 2804 client.exe 36 PID 2664 wrote to memory of 2680 2664 client.exe 37 PID 2664 wrote to memory of 2680 2664 client.exe 37 PID 2664 wrote to memory of 2680 2664 client.exe 37 PID 2680 wrote to memory of 2184 2680 client.exe 96 PID 2680 wrote to memory of 2184 2680 client.exe 96 PID 2680 wrote to memory of 2184 2680 client.exe 96 PID 2184 wrote to memory of 1900 2184 client.exe 39 PID 2184 wrote to memory of 1900 2184 client.exe 39 PID 2184 wrote to memory of 1900 2184 client.exe 39 PID 1900 wrote to memory of 2020 1900 client.exe 155 PID 1900 wrote to memory of 2020 1900 client.exe 155 PID 1900 wrote to memory of 2020 1900 client.exe 155 PID 2020 wrote to memory of 1752 2020 client.exe 156 PID 2020 wrote to memory of 1752 2020 client.exe 156 PID 2020 wrote to memory of 1752 2020 client.exe 156 PID 1752 wrote to memory of 1136 1752 client.exe 42 PID 1752 wrote to memory of 1136 1752 client.exe 42 PID 1752 wrote to memory of 1136 1752 client.exe 42 PID 1136 wrote to memory of 1132 1136 client.exe 43 PID 1136 wrote to memory of 1132 1136 client.exe 43 PID 1136 wrote to memory of 1132 1136 client.exe 43 PID 1132 wrote to memory of 2956 1132 client.exe 44 PID 1132 wrote to memory of 2956 1132 client.exe 44 PID 1132 wrote to memory of 2956 1132 client.exe 44 PID 2956 wrote to memory of 2980 2956 client.exe 45 PID 2956 wrote to memory of 2980 2956 client.exe 45 PID 2956 wrote to memory of 2980 2956 client.exe 45 PID 2980 wrote to memory of 2516 2980 client.exe 46 PID 2980 wrote to memory of 2516 2980 client.exe 46 PID 2980 wrote to memory of 2516 2980 client.exe 46 PID 2516 wrote to memory of 2588 2516 client.exe 47 PID 2516 wrote to memory of 2588 2516 client.exe 47 PID 2516 wrote to memory of 2588 2516 client.exe 47 PID 2588 wrote to memory of 2676 2588 client.exe 134 PID 2588 wrote to memory of 2676 2588 client.exe 134 PID 2588 wrote to memory of 2676 2588 client.exe 134 PID 2676 wrote to memory of 1912 2676 client.exe 135 PID 2676 wrote to memory of 1912 2676 client.exe 135 PID 2676 wrote to memory of 1912 2676 client.exe 135 PID 1912 wrote to memory of 1968 1912 client.exe 50 PID 1912 wrote to memory of 1968 1912 client.exe 50 PID 1912 wrote to memory of 1968 1912 client.exe 50 PID 1968 wrote to memory of 1140 1968 client.exe 51 PID 1968 wrote to memory of 1140 1968 client.exe 51 PID 1968 wrote to memory of 1140 1968 client.exe 51 PID 1140 wrote to memory of 2456 1140 client.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
PID:980 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
PID:528 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
PID:868 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:284 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:852 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:304 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"65⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"66⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"67⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"68⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"69⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"70⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"71⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"72⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"73⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"75⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"76⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"77⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"78⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"79⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"80⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"81⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"82⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"83⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"84⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"85⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"86⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"87⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"88⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"89⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"90⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"91⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"92⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"93⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"94⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"95⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"96⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"97⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"98⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"99⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"100⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"101⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"102⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"103⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"104⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"105⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"106⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"107⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"108⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"109⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"110⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"111⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"112⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"113⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"114⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"115⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"116⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"117⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"118⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"119⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"120⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"121⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"122⤵PID:1816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-