Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-02-2025 03:35
General
-
Target
NanoCore 1.2.2.0/server.exe
-
Size
202KB
-
MD5
b82a881ebc11b0c1100ee726c0b6b6f2
-
SHA1
3daab5cae14c0dfb5a84e42a83c9c1073fb19871
-
SHA256
50dadf81bd1df69948628db113c62c4f08e8c12df21ec59b02aa65a4d593c906
-
SHA512
8ed210a8fd9d1a609830da007ed2e5a63ad5e48393b1859257257273f1ae9703f349d2d81fef075fe1529de2b3acbbd919ca4885bf017f2a058eabbce699f872
-
SSDEEP
3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HICAzhzRWEV9UWlv38SAF:wLV6Bta6dtJmakIM5oFAyUWlv3PAF
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0\server.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0\server.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB