Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
01-08-2020 13:46
General
-
Target
Chqe3zQa.exe
-
Size
209KB
-
MD5
1624aa120c92768bf01124abe519761a
-
SHA1
7ba8814442b40d0da01d7308117d4b9e481e7d3b
-
SHA256
7824efe18fb422bf6ddc22ced42e3d095e04a0fff127a835104b9f2f8c49ac10
-
SHA512
75077bec520ad5c417e5e0025de912939232f8f371a4e9a0cedd93a36e0a773eb51322d4f271bc622fc0182ed2fa2eefb83a4b020e48c9240acc8a4b34ab8033
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chqe3zQa.exe"C:\Users\Admin\AppData\Local\Temp\Chqe3zQa.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken