Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2022 08:58

General

  • Target

    2a5ee1016fdda8e2908036b87cfedce6.exe

  • Size

    475KB

  • MD5

    2a5ee1016fdda8e2908036b87cfedce6

  • SHA1

    e3dc47e26c46884ec73c07f164f8745c8034d5a4

  • SHA256

    df8152cb2a6ab0584320be340fa260a8e56cc122ca1a8b0787c00aa08dd1ad30

  • SHA512

    3f6e27a959a47cbdaae0b41add3884dfadee435f54916cee3e54f083c11a92735d253c4af54915122c7f64186fc1cfc293c81bd42dd5baa22204aaac47a00319

  • SSDEEP

    12288:MLV6BtpmkCtLzAa6gszrjxQd3qjcdEJl5oQFQe+B:+ApfMY1Qd31EJroLe+B

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a5ee1016fdda8e2908036b87cfedce6.exe
    "C:\Users\Admin\AppData\Local\Temp\2a5ee1016fdda8e2908036b87cfedce6.exe"
    Adds Run key to start application
    Checks whether UAC is enabled
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    PID:960

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp
                    • memory/960-55-0x00000000749D0000-0x0000000074F7B000-memory.dmp
                    • memory/960-56-0x00000000749D0000-0x0000000074F7B000-memory.dmp