nanocore | 6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

Analysis

max time kernel
190s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
Size

306KB
MD5

96e1a7ce16e8c0883c092dc085ade0ee
SHA1

83a790b2a645deb4566901f57a98c465685e972d
SHA256

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0
SHA512

20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61
SSDEEP

6144:M3t3X7cmgQNegW+Hw8jGSA3FPFpX9eCSWAqXr2WQfXr61muU:sX7cmvWqsFDeCSWpB

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.1.1

103.25.58.220:72

Mutex

a12f511d-4b09-4b1c-bce0-1f3be91c147f

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
buffer_size
65535
build_time
2014-10-22T21:36:34.307109236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
72
default_group
Testers
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
a12f511d-4b09-4b1c-bce0-1f3be91c147f
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
103.25.58.220
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.1.1
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 11 IoCs

Processes:

LookupSvi.exesecdrv.exesecdrv.exeLookupSvi.exesecdrv.exesecdrv.exesecdrv.exesecdrv.exesecdrv.exesecdrv.exesecdrv.exe

pid	process
1516	LookupSvi.exe
60	secdrv.exe
3152	secdrv.exe
2000	LookupSvi.exe
5072	secdrv.exe
3280	secdrv.exe
3024	secdrv.exe
4760	secdrv.exe
4960	secdrv.exe
4656	secdrv.exe
3464	secdrv.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exeLookupSvi.exesecdrv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	LookupSvi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	secdrv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

LookupSvi.exeLookupSvi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Macrovision Security Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe"	LookupSvi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Macrovision Security Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe"	LookupSvi.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

Suspicious use of SetThreadContext 9 IoCs

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exesecdrv.exe

description	pid	process	target process
PID 1072 set thread context of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 60 set thread context of 3152	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 5072	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 3280	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 3024	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 4760	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 4960	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 4656	60	secdrv.exe	secdrv.exe
PID 60 set thread context of 3464	60	secdrv.exe	secdrv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

pid	process
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
5092	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
5092	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
5092	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

pid process

5092 6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

pid	process
5092	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exeLookupSvi.exesecdrv.exeLookupSvi.exe

description	pid	process
Token: SeDebugPrivilege	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
Token: SeDebugPrivilege	5092	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
Token: SeDebugPrivilege	1516	LookupSvi.exe
Token: SeDebugPrivilege	60	secdrv.exe
Token: SeDebugPrivilege	2000	LookupSvi.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exeLookupSvi.exesecdrv.exe

description	pid	process	target process
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 5092	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
PID 1072 wrote to memory of 1516	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	LookupSvi.exe
PID 1072 wrote to memory of 1516	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	LookupSvi.exe
PID 1072 wrote to memory of 1516	1072	6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe	LookupSvi.exe
PID 1516 wrote to memory of 60	1516	LookupSvi.exe	secdrv.exe
PID 1516 wrote to memory of 60	1516	LookupSvi.exe	secdrv.exe
PID 1516 wrote to memory of 60	1516	LookupSvi.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3152	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 2000	60	secdrv.exe	LookupSvi.exe
PID 60 wrote to memory of 2000	60	secdrv.exe	LookupSvi.exe
PID 60 wrote to memory of 2000	60	secdrv.exe	LookupSvi.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 5072	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3280	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 3024	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4760	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe
PID 60 wrote to memory of 4960	60	secdrv.exe	secdrv.exe

C:\Users\Admin\AppData\Local\Temp\6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
"C:\Users\Admin\AppData\Local\Temp\6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe
"C:\Users\Admin\AppData\Local\Temp\6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:3280

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:3024

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:4760

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:4960

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:4656

C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"
4⤵
- Executes dropped EXE
PID:3464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\LookupSvi.exe.log
Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\secdrv.exe.log
Filesize
496B

MD5
5b4789d01bb4d7483b71e1a35bce6a8b

SHA1
de083f2131c9a763c0d1810c97a38732146cffbf

SHA256
e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6

SHA512
357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
Filesize
13KB

MD5
cf7e259dd0225ae86a29f5952bcb5b4d

SHA1
4c6b2363a754bcaa07edeee5b4837b464cfb5d5c

SHA256
bcf654651c834ff5f885a6ab272d000aa48acea1ebe68ce146c68c863c4736a8

SHA512
91c469f7b4d3c95177ccb013e3c16fe61fffa1fd631857f44bb335382b6c0c80d8bb178e72140178716312f49efbee45ccbe3467a01099561ab3ddf33b412b3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
Filesize
13KB

MD5
cf7e259dd0225ae86a29f5952bcb5b4d

SHA1
4c6b2363a754bcaa07edeee5b4837b464cfb5d5c

SHA256
bcf654651c834ff5f885a6ab272d000aa48acea1ebe68ce146c68c863c4736a8

SHA512
91c469f7b4d3c95177ccb013e3c16fe61fffa1fd631857f44bb335382b6c0c80d8bb178e72140178716312f49efbee45ccbe3467a01099561ab3ddf33b412b3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
Filesize
13KB

MD5
cf7e259dd0225ae86a29f5952bcb5b4d

SHA1
4c6b2363a754bcaa07edeee5b4837b464cfb5d5c

SHA256
bcf654651c834ff5f885a6ab272d000aa48acea1ebe68ce146c68c863c4736a8

SHA512
91c469f7b4d3c95177ccb013e3c16fe61fffa1fd631857f44bb335382b6c0c80d8bb178e72140178716312f49efbee45ccbe3467a01099561ab3ddf33b412b3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe
Filesize
13KB

MD5
cf7e259dd0225ae86a29f5952bcb5b4d

SHA1
4c6b2363a754bcaa07edeee5b4837b464cfb5d5c

SHA256
bcf654651c834ff5f885a6ab272d000aa48acea1ebe68ce146c68c863c4736a8

SHA512
91c469f7b4d3c95177ccb013e3c16fe61fffa1fd631857f44bb335382b6c0c80d8bb178e72140178716312f49efbee45ccbe3467a01099561ab3ddf33b412b3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe
Filesize
306KB

MD5
96e1a7ce16e8c0883c092dc085ade0ee

SHA1
83a790b2a645deb4566901f57a98c465685e972d

SHA256
6819b6f91d5942adfec4eaab33ed2d468a050dc91274c210545ec57aa9aae2e0

SHA512
20aa66eb2883691be1d3bf94c5b63482b2d9c8fe8427cc2d8c58ca4833d26e0c3ab3068d6f059159a8db3c0ab92cd46e7ad7864a5865fcb51bff1c7285d0bd61

Download Submit
memory/60-147-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/60-144-0x0000000000000000-mapping.dmp

Download
memory/60-146-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/1072-132-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/1072-133-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/1072-148-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/1516-142-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/1516-137-0x0000000000000000-mapping.dmp

Download
memory/1516-140-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/1516-149-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/2000-158-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/2000-153-0x0000000000000000-mapping.dmp

Download
memory/2000-165-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3024-176-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3024-172-0x0000000000000000-mapping.dmp

Download
memory/3024-175-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3152-151-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3152-159-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3152-157-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3152-150-0x0000000000000000-mapping.dmp

Download
memory/3280-170-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3280-167-0x0000000000000000-mapping.dmp

Download
memory/3280-171-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3464-195-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/3464-192-0x0000000000000000-mapping.dmp

Download
memory/4656-187-0x0000000000000000-mapping.dmp

Download
memory/4656-191-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4656-190-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4760-177-0x0000000000000000-mapping.dmp

Download
memory/4760-181-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4760-180-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4960-182-0x0000000000000000-mapping.dmp

Download
memory/4960-185-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/4960-186-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/5072-164-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/5072-166-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/5072-160-0x0000000000000000-mapping.dmp

Download
memory/5092-136-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download
memory/5092-134-0x0000000000000000-mapping.dmp

Download
memory/5092-141-0x0000000074D60000-0x0000000075311000-memory.dmp

Filesize
5.7MB

Download