nanocore | 29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

Analysis

max time kernel
151s
max time network
125s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
Size

367KB
MD5

2c81e39a809c95e0ff82059bb62a2fc7
SHA1

2d35b7c5bfc6411f5fe874e355eed465310b0ff3
SHA256

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b
SHA512

067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b
SSDEEP

6144:DM1ET2vTWN6sW5vGT3Dwm9m58PSMmympPLifCkpH6GRDsIbYTMvulTn1LPJ2tPHs:DMe2DsW1Up9TqpkCMHjRDsIbYTPTFBwk

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.0.0

tolaresfgc.ddns.net:6400

Mutex

e3ce3bd9-a714-42c3-b555-60de7e4e2e48

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
buffer_size
65535
build_time
2014-08-02T00:23:07.409088836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6400
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
e3ce3bd9-a714-42c3-b555-60de7e4e2e48
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
tolaresfgc.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.0.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 8 IoCs

Processes:

IpOverUsbSvrc.exeatiesrx.exeatiesrx.exeIpOverUsbSvrc.exeatiesrx.exeIpOverUsbSvrc.exeatiesrx.exeatiesrx.exe

pid process

276 IpOverUsbSvrc.exe
1848 atiesrx.exe
1604 atiesrx.exe
1568 IpOverUsbSvrc.exe
1264 atiesrx.exe
1656 IpOverUsbSvrc.exe
1768 atiesrx.exe
832 atiesrx.exe
Loads dropped DLL 3 IoCs

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeIpOverUsbSvrc.exeatiesrx.exe

pid process

956 29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276 IpOverUsbSvrc.exe
1848 atiesrx.exe

pid	process
276	IpOverUsbSvrc.exe
1848	atiesrx.exe
1604	atiesrx.exe
1568	IpOverUsbSvrc.exe
1264	atiesrx.exe
1656	IpOverUsbSvrc.exe
1768	atiesrx.exe
832	atiesrx.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IpOverUsbSvrc.exeIpOverUsbSvrc.exeIpOverUsbSvrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeatiesrx.exe29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeatiesrx.exe

description	pid	process	target process
PID 956 set thread context of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 1848 set thread context of 1604	1848	atiesrx.exe	atiesrx.exe
PID 268 set thread context of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 1604 set thread context of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 set thread context of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 set thread context of 832	1604	atiesrx.exe	atiesrx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeIpOverUsbSvrc.exeatiesrx.exeIpOverUsbSvrc.exe29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe

pid	process
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276	IpOverUsbSvrc.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276	IpOverUsbSvrc.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276	IpOverUsbSvrc.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276	IpOverUsbSvrc.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276	IpOverUsbSvrc.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
276	IpOverUsbSvrc.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
1848	atiesrx.exe
1848	atiesrx.exe
1568	IpOverUsbSvrc.exe
1848	atiesrx.exe
1848	atiesrx.exe
1568	IpOverUsbSvrc.exe
1848	atiesrx.exe
1848	atiesrx.exe
1568	IpOverUsbSvrc.exe
1848	atiesrx.exe
1848	atiesrx.exe
1848	atiesrx.exe
1568	IpOverUsbSvrc.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
1848	atiesrx.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
1848	atiesrx.exe
1568	IpOverUsbSvrc.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
1848	atiesrx.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
1848	atiesrx.exe
268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
1568	IpOverUsbSvrc.exe
1848	atiesrx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe

pid process

1932 29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe

pid	process
1932	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeIpOverUsbSvrc.exeatiesrx.exe29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeIpOverUsbSvrc.exe29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeatiesrx.exeIpOverUsbSvrc.exe

description	pid	process
Token: SeDebugPrivilege	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
Token: SeDebugPrivilege	276	IpOverUsbSvrc.exe
Token: SeDebugPrivilege	1848	atiesrx.exe
Token: SeDebugPrivilege	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
Token: SeDebugPrivilege	1568	IpOverUsbSvrc.exe
Token: SeDebugPrivilege	1932	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
Token: SeDebugPrivilege	1604	atiesrx.exe
Token: SeDebugPrivilege	1656	IpOverUsbSvrc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeIpOverUsbSvrc.exeatiesrx.exe29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exeatiesrx.exe

description	pid	process	target process
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 268	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 956 wrote to memory of 276	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	IpOverUsbSvrc.exe
PID 956 wrote to memory of 276	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	IpOverUsbSvrc.exe
PID 956 wrote to memory of 276	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	IpOverUsbSvrc.exe
PID 956 wrote to memory of 276	956	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	IpOverUsbSvrc.exe
PID 276 wrote to memory of 1848	276	IpOverUsbSvrc.exe	atiesrx.exe
PID 276 wrote to memory of 1848	276	IpOverUsbSvrc.exe	atiesrx.exe
PID 276 wrote to memory of 1848	276	IpOverUsbSvrc.exe	atiesrx.exe
PID 276 wrote to memory of 1848	276	IpOverUsbSvrc.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1604	1848	atiesrx.exe	atiesrx.exe
PID 1848 wrote to memory of 1568	1848	atiesrx.exe	IpOverUsbSvrc.exe
PID 1848 wrote to memory of 1568	1848	atiesrx.exe	IpOverUsbSvrc.exe
PID 1848 wrote to memory of 1568	1848	atiesrx.exe	IpOverUsbSvrc.exe
PID 1848 wrote to memory of 1568	1848	atiesrx.exe	IpOverUsbSvrc.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 268 wrote to memory of 1932	268	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe	29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1264	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1656	1604	atiesrx.exe	IpOverUsbSvrc.exe
PID 1604 wrote to memory of 1656	1604	atiesrx.exe	IpOverUsbSvrc.exe
PID 1604 wrote to memory of 1656	1604	atiesrx.exe	IpOverUsbSvrc.exe
PID 1604 wrote to memory of 1656	1604	atiesrx.exe	IpOverUsbSvrc.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 1768	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 832	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 832	1604	atiesrx.exe	atiesrx.exe
PID 1604 wrote to memory of 832	1604	atiesrx.exe	atiesrx.exe

C:\Users\Admin\AppData\Local\Temp\29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
"C:\Users\Admin\AppData\Local\Temp\29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
"C:\Users\Admin\AppData\Local\Temp\29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Local\Temp\29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe
"C:\Users\Admin\AppData\Local\Temp\29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b.exe"
3⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
5⤵
- Executes dropped EXE
PID:1264

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
5⤵
- Executes dropped EXE
PID:1768

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
5⤵
- Executes dropped EXE
PID:832

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
367KB

MD5
2c81e39a809c95e0ff82059bb62a2fc7

SHA1
2d35b7c5bfc6411f5fe874e355eed465310b0ff3

SHA256
29616bbc4c2a724d987b3e9cca09104d689c000fbb039a1a02f4d1935cf29c8b

SHA512
067067595b99cf1810f6135fe22115fd8699c2c34e25c1a88d21224b87fa3058570002c3b7b4f851863853881cf983082bd91cfa216b98f485953f786967259b

Download Submit
memory/268-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-57-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-79-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/268-67-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/268-82-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/268-63-0x0000000000447F7E-mapping.dmp

Download
memory/276-80-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/276-83-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/276-85-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/276-70-0x0000000000000000-mapping.dmp

Download
memory/832-190-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/832-182-0x000000000041D8D6-mapping.dmp

Download
memory/832-189-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/956-86-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/956-56-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/956-55-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/956-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1264-140-0x0000000000080000-0x00000000000B6000-memory.dmp

Filesize
216KB

Download
memory/1264-132-0x000000000041D8D6-mapping.dmp

Download
memory/1264-152-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1264-151-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1264-149-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1264-144-0x0000000000080000-0x00000000000B6000-memory.dmp

Filesize
216KB

Download
memory/1264-135-0x0000000000080000-0x00000000000B6000-memory.dmp

Filesize
216KB

Download
memory/1568-106-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1568-122-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1568-136-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1568-102-0x0000000000000000-mapping.dmp

Download
memory/1604-121-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1604-93-0x0000000000447F7E-mapping.dmp

Download
memory/1604-100-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1656-143-0x0000000000000000-mapping.dmp

Download
memory/1656-150-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1656-148-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1768-160-0x000000000041D8D6-mapping.dmp

Download
memory/1768-172-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1768-174-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1768-173-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-76-0x0000000000000000-mapping.dmp

Download
memory/1848-81-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-84-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1848-123-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1932-113-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-120-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1932-124-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/1932-110-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-111-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-118-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-108-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-107-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-116-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-114-0x000000000041D8D6-mapping.dmp

Download