Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 23:01

General

  • Target

    3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe

  • Size

    210KB

  • MD5

    e2783bd34e44f6de337f04e88f73249c

  • SHA1

    6f7f92dc471b1dbb2b2b9392eea0e1375b384eee

  • SHA256

    3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b

  • SHA512

    f567322e4a910e1c864dc65ab38afc994be204d34457a8c89a77eb7d0126718af3b0f70f304e48b99ef7f40dceb4b9a8a7cdab5986bb4327e7a2313816eafe59

  • SSDEEP

    3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIpO9nxTY8Rt9cAP5o4iDFC11/v:QLV6Bta6dtJmakIM5JxbEzDwj9rCkr

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe
    "C:\Users\Admin\AppData\Local\Temp\3dcdd7d9f93d651bfe8cac02938594a8de76cc11c07dbbce369432ab06e9084b.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAD7B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:372
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAED4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4660

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpAD7B.tmp

          Filesize

          1KB

          MD5

          37e353043872dd9871820b5a1b667a3c

          SHA1

          d957a0d83dad1fd90156b80260ed980c2215c2b3

          SHA256

          a8b0fcd21f2cd626bd19bca8900f6fa993ce554378cb48e670e90a6388e368a2

          SHA512

          b76d8e64de10c2df82248896adba3b01439f0fb71b3b890d4fcf0eef46a7cb60be7375b633a9daf2130696a4280131a82e34514c0e0cf7a6573227dd2e013fb2

        • C:\Users\Admin\AppData\Local\Temp\tmpAED4.tmp

          Filesize

          1KB

          MD5

          2f26d92c1eeead3896820e56ec46f6f1

          SHA1

          d95533b61eed7d89e4ada56bc566d60e42ac1f61

          SHA256

          99a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa

          SHA512

          6c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892

        • memory/1508-136-0x00000000750E0000-0x0000000075691000-memory.dmp

          Filesize

          5.7MB

        • memory/1508-140-0x00000000750E0000-0x0000000075691000-memory.dmp

          Filesize

          5.7MB