Analysis

  • max time kernel
    149s
  • max time network
    163s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-09-2022 05:45

General

  • Target

    a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe

  • Size

    202KB

  • MD5

    20cd6c97f053cb9771cb76f3a9993968

  • SHA1

    031974f83613dfb9d9ca52d5c912d1f3f0b00c82

  • SHA256

    a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04

  • SHA512

    5ee2937df3422180f82b074087935e39933ddfb31f576d86207eeaec734759bc98aaf7047acf34acb31988d9249ca26b38db497a42b7c6817ba43f41b3023a1d

  • SSDEEP

    3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIXmT9cx77B7aqetQ0XdeMBma1d:gLV6Bta6dtJmakIM5Kx79PEQ8QVP4

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe
    "C:\Users\Admin\AppData\Local\Temp\a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe"
    Adds Run key to start application
    Checks whether UAC is enabled
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    PID:3876

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • memory/3876-116-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-117-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-118-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-119-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-120-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-121-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-122-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-123-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-124-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-125-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-126-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-128-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-127-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-129-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-130-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-131-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-132-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-133-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-134-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-135-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-136-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-137-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-138-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-139-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-140-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-141-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-142-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-143-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-144-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-145-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-146-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-147-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-148-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-149-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-150-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-151-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-152-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-153-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-154-0x0000000073150000-0x0000000073700000-memory.dmp
                    • memory/3876-155-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-156-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-157-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-158-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-159-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-160-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-161-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-162-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-163-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-164-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-165-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-166-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-167-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-168-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-169-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-170-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-171-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-172-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-173-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-174-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-175-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-176-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-177-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-178-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-179-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-180-0x0000000076EC0000-0x000000007704E000-memory.dmp
                    • memory/3876-193-0x0000000073150000-0x0000000073700000-memory.dmp