Overview

overview

10

Static

static

10

Production...t1.exe

windows7_x64

10

Production...t1.exe

windows10_x64

10

Analysis

  • max time kernel
    116s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 00:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Production order list1.exe

  • Size

    202KB

  • MD5

    bfbcba72ce61ead3bf4bc35002846856

  • SHA1

    8e99c47e0c5ea0a839ef63e19527dcb9f755d6a0

  • SHA256

    38f5c4a1a5be8e02b3898f125313cb34f8b686fd8c83f2192252f529c21cd47c

  • SHA512

    7151c60093019b9ca9cf0d034108027ed291ee44abe98787565ec74168b3dfaa6387614b4ac17671711a27a36c734ba4a428bc3d431692631a89da5dec53bedd

Score
10/10
nanocoreevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Production order list1.exe
    "C:\Users\Admin\AppData\Local\Temp\Production order list1.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:776
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:428
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2ec
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:656

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/428-4-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp
      Filesize

      8KB

      Download
    • memory/776-2-0x0000000076071000-0x0000000076073000-memory.dmp
      Filesize

      8KB

      Download
    • memory/776-3-0x0000000001E30000-0x0000000001E31000-memory.dmp
      Filesize

      4KB

      Download