Overview

overview

10

Static

static

88f9165538...ef.exe

windows7-x64

10

88f9165538...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88f91655388ba7e3f8c3ba4df516adecf49ed1462233ba84b4bf5a2361d784ef

  • Size

    372KB

  • Sample

    221123-q2bv7aad9z

  • MD5

    e0a53248959cc237d502045760eab3da

  • SHA1

    f2747b669016607a3b44bb15be395b4d06afca31

  • SHA256

    88f91655388ba7e3f8c3ba4df516adecf49ed1462233ba84b4bf5a2361d784ef

  • SHA512

    ccc48f7c9618939dbf176869bd73798e6ea967a7c12af6750d159dc89dca17714d48e59a0eb2b2bd412eea112f486acb66fea944f98c2fa87ebb9c341cd77a6c

  • SSDEEP

    6144:ciJB3eMyCkgJeNXXr5k5MhPHq+pzQAABAh6Sn0/8163IG3vnpvSd8tnmTx+:hnOMyCqXre5i6AA+c81X8U8tn

Score
10/10
nanocoreevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      88f91655388ba7e3f8c3ba4df516adecf49ed1462233ba84b4bf5a2361d784ef

    • Size

      372KB

    • MD5

      e0a53248959cc237d502045760eab3da

    • SHA1

      f2747b669016607a3b44bb15be395b4d06afca31

    • SHA256

      88f91655388ba7e3f8c3ba4df516adecf49ed1462233ba84b4bf5a2361d784ef

    • SHA512

      ccc48f7c9618939dbf176869bd73798e6ea967a7c12af6750d159dc89dca17714d48e59a0eb2b2bd412eea112f486acb66fea944f98c2fa87ebb9c341cd77a6c

    • SSDEEP

      6144:ciJB3eMyCkgJeNXXr5k5MhPHq+pzQAABAh6Sn0/8163IG3vnpvSd8tnmTx+:hnOMyCqXre5i6AA+c81X8U8tn

    Score
    10/10
    nanocoreevasionkeyloggerpersistencespywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks