Overview
overview
10Static
static
10NanoCore-m...in.dll
windows7-x64
1NanoCore-m...in.dll
windows10-2004-x64
1NanoCore-m...ib.dll
windows7-x64
1NanoCore-m...ib.dll
windows10-2004-x64
1NanoCore-m...er.exe
windows7-x64
1NanoCore-m...er.exe
windows10-2004-x64
1NanoCore-m...re.exe
windows7-x64
10NanoCore-m...re.exe
windows10-2004-x64
10NanoCore-m...in.dll
windows7-x64
1NanoCore-m...in.dll
windows10-2004-x64
1NanoCore-m...te.dll
windows7-x64
1NanoCore-m...te.dll
windows10-2004-x64
1NanoCore-m...nt.exe
windows7-x64
3NanoCore-m...nt.exe
windows10-2004-x64
7NanoCore-m...op.dll
windows7-x64
1NanoCore-m...op.dll
windows10-2004-x64
1NanoCore-m...op.dll
windows7-x64
3NanoCore-m...op.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 08:06
Behavioral task
behavioral1
Sample
NanoCore-master/sample/ClientPlugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NanoCore-master/sample/ClientPlugin.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
NanoCore-master/sample/Interop.NATUPNPLib.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
NanoCore-master/sample/Interop.NATUPNPLib.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
NanoCore-master/sample/NanoCore Plugin Compiler.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
NanoCore-master/sample/NanoCore Plugin Compiler.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
NanoCore-master/sample/NanoCore.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
NanoCore-master/sample/NanoCore.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
NanoCore-master/sample/ServerPlugin.dll
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
NanoCore-master/sample/ServerPlugin.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
NanoCore-master/sample/System.Data.SQLite.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NanoCore-master/sample/System.Data.SQLite.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
NanoCore-master/sample/client.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
NanoCore-master/sample/client.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
NanoCore-master/sample/x64/SQLite.Interop.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
NanoCore-master/sample/x64/SQLite.Interop.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
NanoCore-master/sample/x86/SQLite.Interop.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
NanoCore-master/sample/x86/SQLite.Interop.dll
Resource
win10v2004-20250129-en
General
-
Target
NanoCore-master/sample/client.exe
-
Size
87KB
-
MD5
e7dde6ff81df20066d7c57bb32d45193
-
SHA1
f4494f962a6241715f1d313fee37203b6607e42b
-
SHA256
f63d7fecabfd501643a12ff3988f2809a1573009a452510e286a91554d49599d
-
SHA512
da3ec487122b70a062dd7ffc792fc4d7cb223775a7e09ca9664bc259097d53ad93678cfeec32d554783f37f9d23a299a0e75ee7e9951abf9d4da8d55e58eb527
-
SSDEEP
1536:EtPtlChZHNnK1MJTmvuzazpZl4hTPnmOIP+LNPSP2avOauA:Edtl8NnwMJTm/9kTPnmOg+LNQ2aJuA
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2384 client.exe Token: SeDebugPrivilege 1652 client.exe Token: SeDebugPrivilege 1296 client.exe Token: SeDebugPrivilege 2792 client.exe Token: SeDebugPrivilege 2704 client.exe Token: SeDebugPrivilege 2868 client.exe Token: SeDebugPrivilege 1200 client.exe Token: SeDebugPrivilege 2584 client.exe Token: SeDebugPrivilege 2144 client.exe Token: SeDebugPrivilege 1436 client.exe Token: SeDebugPrivilege 1460 client.exe Token: SeDebugPrivilege 1600 client.exe Token: SeDebugPrivilege 1644 client.exe Token: SeDebugPrivilege 472 client.exe Token: SeDebugPrivilege 1876 client.exe Token: SeDebugPrivilege 2764 client.exe Token: SeDebugPrivilege 2232 client.exe Token: SeDebugPrivilege 2436 client.exe Token: SeDebugPrivilege 780 client.exe Token: SeDebugPrivilege 1524 client.exe Token: SeDebugPrivilege 1844 client.exe Token: SeDebugPrivilege 324 client.exe Token: SeDebugPrivilege 1244 client.exe Token: SeDebugPrivilege 636 client.exe Token: SeDebugPrivilege 568 client.exe Token: SeDebugPrivilege 1940 client.exe Token: SeDebugPrivilege 1780 client.exe Token: SeDebugPrivilege 2260 client.exe Token: SeDebugPrivilege 2348 client.exe Token: SeDebugPrivilege 2384 client.exe Token: SeDebugPrivilege 2428 client.exe Token: SeDebugPrivilege 1652 client.exe Token: SeDebugPrivilege 2452 client.exe Token: SeDebugPrivilege 2616 client.exe Token: SeDebugPrivilege 2604 client.exe Token: SeDebugPrivilege 2308 client.exe Token: SeDebugPrivilege 376 client.exe Token: SeDebugPrivilege 2148 client.exe Token: SeDebugPrivilege 2880 client.exe Token: SeDebugPrivilege 1472 client.exe Token: SeDebugPrivilege 2928 client.exe Token: SeDebugPrivilege 336 client.exe Token: SeDebugPrivilege 1440 client.exe Token: SeDebugPrivilege 2916 client.exe Token: SeDebugPrivilege 2272 client.exe Token: SeDebugPrivilege 112 client.exe Token: SeDebugPrivilege 1968 client.exe Token: SeDebugPrivilege 1996 client.exe Token: SeDebugPrivilege 1840 client.exe Token: SeDebugPrivilege 980 client.exe Token: SeDebugPrivilege 3024 client.exe Token: SeDebugPrivilege 1468 client.exe Token: SeDebugPrivilege 800 client.exe Token: SeDebugPrivilege 2324 client.exe Token: SeDebugPrivilege 1952 client.exe Token: SeDebugPrivilege 1660 client.exe Token: SeDebugPrivilege 1516 client.exe Token: SeDebugPrivilege 2392 client.exe Token: SeDebugPrivilege 2000 client.exe Token: SeDebugPrivilege 2024 client.exe Token: SeDebugPrivilege 3016 client.exe Token: SeDebugPrivilege 2808 client.exe Token: SeDebugPrivilege 2608 client.exe Token: SeDebugPrivilege 2628 client.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1652 2384 client.exe 61 PID 2384 wrote to memory of 1652 2384 client.exe 61 PID 2384 wrote to memory of 1652 2384 client.exe 61 PID 1652 wrote to memory of 1296 1652 client.exe 32 PID 1652 wrote to memory of 1296 1652 client.exe 32 PID 1652 wrote to memory of 1296 1652 client.exe 32 PID 1296 wrote to memory of 2792 1296 client.exe 33 PID 1296 wrote to memory of 2792 1296 client.exe 33 PID 1296 wrote to memory of 2792 1296 client.exe 33 PID 2792 wrote to memory of 2704 2792 client.exe 34 PID 2792 wrote to memory of 2704 2792 client.exe 34 PID 2792 wrote to memory of 2704 2792 client.exe 34 PID 2704 wrote to memory of 2868 2704 client.exe 35 PID 2704 wrote to memory of 2868 2704 client.exe 35 PID 2704 wrote to memory of 2868 2704 client.exe 35 PID 2868 wrote to memory of 1200 2868 client.exe 36 PID 2868 wrote to memory of 1200 2868 client.exe 36 PID 2868 wrote to memory of 1200 2868 client.exe 36 PID 1200 wrote to memory of 2584 1200 client.exe 37 PID 1200 wrote to memory of 2584 1200 client.exe 37 PID 1200 wrote to memory of 2584 1200 client.exe 37 PID 2584 wrote to memory of 2144 2584 client.exe 38 PID 2584 wrote to memory of 2144 2584 client.exe 38 PID 2584 wrote to memory of 2144 2584 client.exe 38 PID 2144 wrote to memory of 1436 2144 client.exe 39 PID 2144 wrote to memory of 1436 2144 client.exe 39 PID 2144 wrote to memory of 1436 2144 client.exe 39 PID 1436 wrote to memory of 1460 1436 client.exe 40 PID 1436 wrote to memory of 1460 1436 client.exe 40 PID 1436 wrote to memory of 1460 1436 client.exe 40 PID 1460 wrote to memory of 1600 1460 client.exe 41 PID 1460 wrote to memory of 1600 1460 client.exe 41 PID 1460 wrote to memory of 1600 1460 client.exe 41 PID 1600 wrote to memory of 1644 1600 client.exe 42 PID 1600 wrote to memory of 1644 1600 client.exe 42 PID 1600 wrote to memory of 1644 1600 client.exe 42 PID 1644 wrote to memory of 472 1644 client.exe 43 PID 1644 wrote to memory of 472 1644 client.exe 43 PID 1644 wrote to memory of 472 1644 client.exe 43 PID 472 wrote to memory of 1876 472 client.exe 44 PID 472 wrote to memory of 1876 472 client.exe 44 PID 472 wrote to memory of 1876 472 client.exe 44 PID 1876 wrote to memory of 2764 1876 client.exe 45 PID 1876 wrote to memory of 2764 1876 client.exe 45 PID 1876 wrote to memory of 2764 1876 client.exe 45 PID 2764 wrote to memory of 2232 2764 client.exe 46 PID 2764 wrote to memory of 2232 2764 client.exe 46 PID 2764 wrote to memory of 2232 2764 client.exe 46 PID 2232 wrote to memory of 2436 2232 client.exe 47 PID 2232 wrote to memory of 2436 2232 client.exe 47 PID 2232 wrote to memory of 2436 2232 client.exe 47 PID 2436 wrote to memory of 780 2436 client.exe 48 PID 2436 wrote to memory of 780 2436 client.exe 48 PID 2436 wrote to memory of 780 2436 client.exe 48 PID 780 wrote to memory of 1524 780 client.exe 49 PID 780 wrote to memory of 1524 780 client.exe 49 PID 780 wrote to memory of 1524 780 client.exe 49 PID 1524 wrote to memory of 1844 1524 client.exe 50 PID 1524 wrote to memory of 1844 1524 client.exe 50 PID 1524 wrote to memory of 1844 1524 client.exe 50 PID 1844 wrote to memory of 324 1844 client.exe 51 PID 1844 wrote to memory of 324 1844 client.exe 51 PID 1844 wrote to memory of 324 1844 client.exe 51 PID 324 wrote to memory of 1244 324 client.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
PID:636 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:376 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:336 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:112 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:980 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:800 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"65⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"66⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"67⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"68⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"69⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"70⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"71⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"72⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"73⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"74⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"75⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"76⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"77⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"78⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"79⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"80⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"81⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"82⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"83⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"84⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"85⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"86⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"87⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"88⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"89⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"90⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"91⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"92⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"93⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"94⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"95⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"96⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"97⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"98⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"99⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"101⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"102⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"103⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"104⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"105⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"106⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"107⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"108⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"109⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"110⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"111⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"112⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"113⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"114⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"115⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"116⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"117⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"118⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"119⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"120⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"121⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-