Analysis
-
max time kernel
121s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 15:54
General
-
Target
3ea7bd2fb52842ea458767db3b9a3189.exe
-
Size
202KB
-
MD5
3ea7bd2fb52842ea458767db3b9a3189
-
SHA1
a7e5bc074c3f2f318c5c38961d2d714b181f5aa6
-
SHA256
c8c69f36f89061f4ce86b108c0ff12ade49d665eace2d60ba179a2341bd54c40
-
SHA512
be61014439bc0556d8888429106f2ee4895f78a6a37c28d9226af22b9bdaf27e3d1b5a8a3f536f4f274ae1477a168128e5096ea327cc9fdb668d9c4e3cd3fcc1
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ea7bd2fb52842ea458767db3b9a3189.exe"C:\Users\Admin\AppData\Local\Temp\3ea7bd2fb52842ea458767db3b9a3189.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB