Extracted

• • Target

    Launcher.exe

  • Size

    37.9MB

  • MD5

    2879823979f8b16f80483eb80f38dcaa

  • SHA1

    83846ac4df07519a2fab9952d43ee9be2fdb5794

  • SHA256

    15455df49778d6e1154d788f37171e2e73abc52db4c0b78cde050ad054a23bf7

  • SHA512

    3470ac73d739c805d52ed452bc463f92977d8b606fd4f83e0aab9546e01d55bac27e9faffb20d3f617b6f48476296588e354453d74a32459225c22d716a205b2

  • SSDEEP

    786432:YRrD3/04fhQJc9LUwSwLzL60o48fyEodlWPy1WGTO7icRS7:YRrT04yJzwR60v8fyEoqPyjt

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojanexecutionprivilege_escalation

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • UAC bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2