Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 23:48

General

  • Target

    c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d.exe

  • Size

    577KB

  • MD5

    3620dd811026e8b6c28e7780be40fb98

  • SHA1

    bbed7ab4f72388398cfc561b878a6179bbfc59c7

  • SHA256

    c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d

  • SHA512

    e1844f56693665491079a02464722676251809821720eec530a6fd3fa2481631f4acb002ae832af1d149111dae9b271db5143d6655d5653b388546dea586fa42

  • SSDEEP

    12288:htsDO4UAN+AVoa+ueIG/8V9uQNSncmDij4bsSi5+R:qrN+AVoa+qG/K9uQNSncU4sycR

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d.exe
    "C:\Users\Admin\AppData\Local\Temp\c3237e897a6290571c6311cbc4fab1507ea2ad631342a1f2824f2980fb07d38d.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDF58.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4924
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE14D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:364

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpDF58.tmp

          Filesize

          1KB

          MD5

          3a73c4001d745adf4e70e4562531ffec

          SHA1

          fb10145c878e931fb318fc7c51817cf7e6fae687

          SHA256

          5f9514bf173f3f8403fe7f931e922629f839103d91bd73d77916561dcc13b019

          SHA512

          0299413bc5094710d399f8a50253f4aa0a68cd14024da4713917b305bc6e57ecf7385846563bd16bdfab88671237df31c943b7587c3fcd7137820f5f07c68534

        • C:\Users\Admin\AppData\Local\Temp\tmpE14D.tmp

          Filesize

          1KB

          MD5

          2f26d92c1eeead3896820e56ec46f6f1

          SHA1

          d95533b61eed7d89e4ada56bc566d60e42ac1f61

          SHA256

          99a158463ce40c750bad6991ae1fceece305a0dbf8e209dd7147b5d539756bfa

          SHA512

          6c1ed12d5e1afcd9e7f327e0153786fd8594f75a995f341c408ef014e69917452a9fe99c511f0249aceb57b3045b707f1fd3f404e4086cfbf0aadcb3318db892

        • memory/3868-132-0x0000000074750000-0x0000000074D01000-memory.dmp

          Filesize

          5.7MB

        • memory/3868-137-0x0000000074750000-0x0000000074D01000-memory.dmp

          Filesize

          5.7MB