Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29-08-2022 14:35
General
-
Target
0x000a0000000139f2-58.exe
-
Size
202KB
-
MD5
e132a3665bf8187deead9364cbdc5017
-
SHA1
ca29f9fc578210fa07fd2acc87774f17a9564eab
-
SHA256
2b65cf2fcbab35105403c2bff2a50ae05599e687d4d8ca0919a41980a3d60ab8
-
SHA512
d27cbf55583638dbbf5bc82b1bd399f0ec6a3f4e09ec6e4894292188364bc57bca3b10fda832aeecea42bceb07af4058e6d0be43401fd1327a2643da4d4b69e4
-
SSDEEP
6144:QLV6Bta6dtJmakIM5Cr8cCqESuheKLJcyfFo3Z:QLV6BtpmkscbgvfyZ
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000a0000000139f2-58.exe"C:\Users\Admin\AppData\Local\Temp\0x000a0000000139f2-58.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB