Analysis

  • max time kernel
    148s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2022, 23:48

General

  • Target

    c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d.exe

  • Size

    577KB

  • MD5

    3620dd811026e8b6c28e7780be40fb98

  • SHA1

    bbed7ab4f72388398cfc561b878a6179bbfc59c7

  • SHA256

    c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d

  • SHA512

    e1844f56693665491079a02464722676251809821720eec530a6fd3fa2481631f4acb002ae832af1d149111dae9b271db5143d6655d5653b388546dea586fa42

  • SSDEEP

    12288:htsDO4UAN+AVoa+ueIG/8V9uQNSncmDij4bsSi5+R:qrN+AVoa+qG/K9uQNSncU4sycR

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d.exe
    "C:\Users\Admin\AppData\Local\Temp\c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "AGP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmp9C2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1640
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "AGP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD99.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:764

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp9C2.tmp

          Filesize

          1KB

          MD5

          3a73c4001d745adf4e70e4562531ffec

          SHA1

          fb10145c878e931fb318fc7c51817cf7e6fae687

          SHA256

          5f9514bf173f3f8403fe7f931e922629f839103d91bd73d77916561dcc13b019

          SHA512

          0299413bc5094710d399f8a50253f4aa0a68cd14024da4713917b305bc6e57ecf7385846563bd16bdfab88671237df31c943b7587c3fcd7137820f5f07c68534

        • C:\Users\Admin\AppData\Local\Temp\tmpD99.tmp

          Filesize

          1KB

          MD5

          885d6dd30570594e167fadb59d9ca0ea

          SHA1

          9981e583644c4eb9cf5056615a0e1c2913c8983b

          SHA256

          7155bc082d1713d77c2797575ee0ade8467fb7012f5376c1d6f4aa618141a7d2

          SHA512

          1623218143c2c25a7c85fa9da8e0f251f04a5eb848c4d0aa10bfb78688518b82393a2b3c7f287a9dc06a366ef9f46d0d4e2d246ad4cef4554a74c0bb6ff9dd2a

        • memory/1168-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

          Filesize

          8KB

        • memory/1168-57-0x0000000074720000-0x0000000074CCB000-memory.dmp

          Filesize

          5.7MB

        • memory/1168-60-0x0000000074720000-0x0000000074CCB000-memory.dmp

          Filesize

          5.7MB