Overview

overview

10

Static

static

PO 047428.xlsx

windows7_x64

10

PO 047428.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 047428.xlsx

  • Size

    1.8MB

  • Sample

    210118-sgwfc6p7sx

  • MD5

    9c9f5772262a507296c5a3a718ab77e1

  • SHA1

    08477969175e1feb27a09258ad42e3c409816324

  • SHA256

    08c6f3c35f89f3ddd37764ab2bf87c4b10d20b8314e8c77dc07de286a0e5d560

  • SHA512

    f21350a02ea34a58e31529b91f1794946367d54fdbeda8351362be3bd869820eb896bbeab606363d8b3339d81b87b661b94506c25c004dd35f6bb3f085db9eb5

Score
10/10
nanocorekeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      PO 047428.xlsx

    • Size

      1.8MB

    • MD5

      9c9f5772262a507296c5a3a718ab77e1

    • SHA1

      08477969175e1feb27a09258ad42e3c409816324

    • SHA256

      08c6f3c35f89f3ddd37764ab2bf87c4b10d20b8314e8c77dc07de286a0e5d560

    • SHA512

      f21350a02ea34a58e31529b91f1794946367d54fdbeda8351362be3bd869820eb896bbeab606363d8b3339d81b87b661b94506c25c004dd35f6bb3f085db9eb5

    Score
    10/10
    nanocorekeyloggerspywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks