Analysis

  • max time kernel
    161s
  • max time network
    179s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2022, 23:01

General

  • Target

    3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

  • Size

    210KB

  • MD5

    e2783bd34e44f6de337f04e88f73249c

  • SHA1

    6f7f92dc471b1dbb2b2b9392eea0e1375b384eee

  • SHA256

    3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b

  • SHA512

    f567322e4a910e1c864dc65ab38afc994be204d34457a8c89a77eb7d0126718af3b0f70f304e48b99ef7f40dceb4b9a8a7cdab5986bb4327e7a2313816eafe59

  • SSDEEP

    3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIpO9nxTY8Rt9cAP5o4iDFC11/v:QLV6Bta6dtJmakIM5JxbEzDwj9rCkr

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
    "C:\Users\Admin\AppData\Local\Temp\3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "ISS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDA8.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1428
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "ISS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp20AC.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1480

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp20AC.tmp

          Filesize

          1KB

          MD5

          ea7095fa975a5ac043c9de2899ce61d0

          SHA1

          ba4e21d0728fb1b4b87006c2e8ceb6109c9046a3

          SHA256

          5a1ba7b1b91e0bb7aedcfa82dc687972abb31f72ae1613ac586938ef0843f30f

          SHA512

          b52c8f1b58f263a3d1ad1ef9939167853a5f55033d9ad8976130174c7118407711a0703266c7d2d542bc2ca8119f875e35cc791b9dd70ef83b5310ac1e7cd1cb

        • C:\Users\Admin\AppData\Local\Temp\tmpDA8.tmp

          Filesize

          1KB

          MD5

          37e353043872dd9871820b5a1b667a3c

          SHA1

          d957a0d83dad1fd90156b80260ed980c2215c2b3

          SHA256

          a8b0fcd21f2cd626bd19bca8900f6fa993ce554378cb48e670e90a6388e368a2

          SHA512

          b76d8e64de10c2df82248896adba3b01439f0fb71b3b890d4fcf0eef46a7cb60be7375b633a9daf2130696a4280131a82e34514c0e0cf7a6573227dd2e013fb2

        • memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

          Filesize

          8KB

        • memory/1628-55-0x0000000074620000-0x0000000074BCB000-memory.dmp

          Filesize

          5.7MB

        • memory/1628-60-0x0000000074620000-0x0000000074BCB000-memory.dmp

          Filesize

          5.7MB