��rȝo8R�A Z� =�G��O#�=3|��J���� I�e��l��h� �s��.��NW__�n����6�z�����P�u9�A���*�X<)��\}�2P��-�~ð��h�X�06�{���)4hoʐ���t��û��v�GB�p��ZBh^�vkv.W�Ag�í�2�4�|e�HnwN ?֎~^�]��=�D��A��]�P&4; -����/Z��[Z&��=\�3p���jq� {:L7r��� �X TU�6F��#�������MY7Di9*]`�9��G���h$'y�F�$��ce��ٌ74>t��4�<���ڧ_��f�α�&ה�Ւ��]G�ʞ���f���P8��Io��������������`j)�a��� �2�]0�ͭ��ɰ��ܤ����.g| ���2����K�a��(4�GWg��,M�& 9��T2��j��O��.9f�W�t/X�X-���1gZx��-��1p�vC*q��X3�r^� ��|��<�w �A�OO������QAy��;�V�P���wA0VIO!�8�jx�+�'�1�7m������~�O����<��ػL���eɞAB�|͓M�����egE�Nʢ�S�:�x8�vv�֫O7�&��܌���蠜��P�*LY��E��Ʊ^0zv�{�)�Wy��M�CH|s�a0w����8�~����ˆ~�UC ��3���Zf�o�C�6� ������t�>��$}��x�����J,�gQ�]��%b����a}. ^ǧZ��b��X���n�_^.��ң��j�~T�n<�m{�輥�`4���xt�w��6���A�¡\!GO���Nr%Nz\=P�|;Õ`jΈ1��?���Ya�JK��a��Ww����+4e�<� �h= Z wG��� ��5�=*�$�c��D�@�W c'�%R���$ ��I��ڴ�Q�*:���E\�4m�v-��\���z���O��l��>��>�wcFn�N }.�A#} �?���"_���j�?���{u�~24|�o��� �2"����= ���?x��!Ҩ@�yɱ��Tj���"i��+){:N�������mD=����b$~���ܥ��S7�����ҿ0[<��F�ޕ�����ů��R�+F/V�t��щ���� s�ow�F�n�b� [�������bp����_0@ovvK���i��t�'4mJDf��h�а 8���(��?����\^{@Ć:�Xq��p�'{������B]_���^V���6u.���14�D���a"�5��ƍ ����p��k�7�*3��]Y��ȍL@~:��nd�qC���K��p�e6K�5�$\:�xF�g�0�M_��,m�d�9�B�T�H<Yw 翍d�����*̆u&id�y?�Ӭ)������+���-����f�� ?�� 6��^��L�|�8A�z��#CJZ�/Ө�o�3�VQO��8�� ���P�������;`fy�M���I��ـ�S��?�Y��7F�H�k����J����|k��eq���������Vpnbx��U ����N��<��u���^����z�l g�=����I�7�����Yw �+�����/�f́_��/�q��k�T��ڇ�i{�Y*,fg9�:������\�y]�]���k���@W�RE�<e!u�~~ײ�z�3��yNm+�%&�Ë#�(i�%{b]HjSTCl�Vt��HR��@�wh�PH��9]C�� �+�@~a�����D��Ӕ�¹s?��U{#Jb!���0��k�i�PT���3��3��v5�-DQ��O�qo��!3<�]��n�4J�rEo��yIn�u^�:�3*�V9Y�83ad�����_�M�����D&4q,o��c��5�����ui�')_Eu��;ca�%[��g�;}�T�S�"ܲ�M��2 �=$]H�0�g��,'�T�6��ѝ'�%�����/��_n���]��\�Ę% W�wTbMzr�L��/�+�9G�����E�Ҥ�ӫU��T�p��9+�'���|���"�ȉ��AV}����sE�wi8�ր�m8a� �9d �A�U([RF�n ���W�^� ��/�k|�5��t�\��Wԇ�g$���1�g�2O%J�»�~`���tYk�R�}�L4��.AL�C?��Y.�^<���C�~)���v���ڤm�,�|��>�>ba���z_!Ar���>VisK�\Zj�� �$に�wfjV�5�p)OE�Ǜ-�8+��>+R,�\���n�jdN�(�֪��Ԓ+����2*��7�x(^�f3�萾ǻ����(`��S�]��&9��x$�-���]1x*��R4Ը��1���|������C��]��Uy��o%���M$\ZzTˇu���!K�Q��/��3 Pm"Z�2>��d�]�f�Y�r��4ɕ�"L��oD�Vnl�<��_�?� 2�����,��>�j���G�:�O) ��7�$0�P�J��Ȩ���N���L�ܣ��H���]�=�U8�S� �ț���_p�N)�i�t��� p��g��-(�� ��;��G�T�*Ҥ��V[Sj])��%t��|E%��U�fg�P �O�OI��[ha�u���G�tb�ћ��_���lߏ���� �f�KԒ����� yw��0�#������"r&Wc�E�da�pg�=YK[��� ǒGH�-Xٵ�;�A����!���ņln����DA��̩ ��%d��B;������8�*<�P�*�{Pg2��v��Ȫ�j��\h��� �������Oy{��鴺����=UN;fi���t���HU��GEk����Y8]`n�^&������D.#$\2�sC����?�L}�?#�0|�?1�4��<�*GY����[y��@�j)<��52V톛�L1��d���(�s���������#�+4�j6�ɰ��������,��I��������0�F��C�7)>��;S-�;�?��t�BZ&�kV�i�0�$G�L��������8.d�4���>.l��,�FS�íc �G
Static task
static1
Behavioral task
behavioral1
Sample
nanosense.exe
Resource
win10v2004-20230703-en
General
-
Target
nanosense.exe
-
Size
12.2MB
-
MD5
a7834a25701e0fc579004f9bbaf06503
-
SHA1
c0e65469b3c960432809f21ca30adc8b8c00c5a8
-
SHA256
a9a5598c0aafb4a51da1a42cac9e1af585ec4daaabe125597bd9b1e90bd2836b
-
SHA512
6d37478b503127c5d3ee7476c2276005c40d0d186cf689d973c310ec517fd49fe5de7ec18b473a4f48af651bf7e606f2833299415b818bb9d15684e674fcca80
-
SSDEEP
196608:BDpRDP8OsSL7quyy2CkTI6fkjZQ7+KWkfgAw3oMvVqrC4SQmBk4r7vxTf/Rp:lp9Ls0XQE6oQ7XNw3vJLW4r7v5/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nanosense.exe
Files
-
nanosense.exe.exe windows x64
e6b1173739646f1a45168f13abe03bea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteA
imm32
ImmReleaseContext
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
ntdll
NtRaiseHardError
d3d9
Direct3DCreate9
wininet
InternetOpenA
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertGetCertificateChain
ws2_32
ntohl
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
Exports
Exports
Sections
.text Size: - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.41P Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.oAu Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XjX Size: 12.2MB - Virtual size: 12.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ