Overview

overview

10

Static

static

10

11-10-2020...HN.exe

windows7_x64

10

11-10-2020...HN.exe

windows10-2004_x64

10

11_07_2020...47.exe

windows7_x64

10

11_07_2020...47.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    168s
  • max time network
    197s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-05-2022 22:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    11-10-2020 NEW SPECIF #3309 MCHN.exe

  • Size

    203KB

  • MD5

    b0e73dcfba506ab521b23383e49e778c

  • SHA1

    640326b8b6fc9f0b5504e1e2e2ae961af819b9cc

  • SHA256

    a6477205ef1bd79cf5306cfa59940e34bf328ba2b447697d59d3936449f58ba5

  • SHA512

    322f638cfc24b2ac4d7efdc872dd7760f6143315f1f7509baf703f76007c7ca38afd6f416b74bd73113664cec7a1f53790a9561002ac7d573efe11316627ed83

Score
10/10
nanocoreevasionkeyloggerspywarestealertrojan

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11-10-2020 NEW SPECIF #3309 MCHN.exe
    "C:\Users\Admin\AppData\Local\Temp\11-10-2020 NEW SPECIF #3309 MCHN.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC505.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpC505.tmp
    Filesize

    1KB

    MD5

    73055fa6866d1d95c05d5878d1df7e00

    SHA1

    a6cd517073fac1c1a56660e9d5b843a11fad029b

    SHA256

    c9c9a74adf008d013f4583ee02c7e9b2a6265e25c0ed07628718e39a78ff059f

    SHA512

    73afba1cc00eba3c09053fc3ee17d01ab92e409f28796fa6d40bad6f4185e1910380cec3f19bde0fa151b17dbdee2b490e357ad6d5d07fca4e5dff8c305e416b

    Download Submit
  • memory/628-56-0x0000000000000000-mapping.dmp
    Download
  • memory/2040-54-0x0000000075841000-0x0000000075843000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2040-55-0x0000000074720000-0x0000000074CCB000-memory.dmp
    Filesize

    5.7MB

    Download