c286b4291a3b8edc5ea9df06f0af1523935ddc0501a6b4e7964ce54076faeff7

Analysis

max time kernel
168s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NauDoc-4.exe
Size

48.2MB
MD5

983d2198deb9fffbaa66c1ddae89319e
SHA1

f67d81f0b5db0d0a1cd8562f93c62ddf48e5ce75
SHA256

c286b4291a3b8edc5ea9df06f0af1523935ddc0501a6b4e7964ce54076faeff7
SHA512

cbb397f95042aa248904333ae883f36b9b6c1d52baf545b98c5ef2cfeefb754c2a8cd29931061515d7894d492457db3a5bdd9a8058d613756ceac4fbe195a103
SSDEEP

1572864:57xTCIEVpRVVX+AR+JgfTQ9OQ2I0WLFwy0897RD:57xTabTVX+AR+Jga0KFsQRD

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2776	NauDoc-4.exe
2776	NauDoc-4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2776	NauDoc-4.exe

C:\Users\Admin\AppData\Local\Temp\NauDoc-4.exe
"C:\Users\Admin\AppData\Local\Temp\NauDoc-4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso8F07.tmp\ioSpecial.ini

Filesize
684B

MD5
86d2e0ce7ac28936b52f002a781114aa

SHA1
f78f8baf76224b99a7e654d85e1226c2e05ae5a3

SHA256
5f10254ecc8f5296a4303d7cea75b69ecf81a1119549bf95c188fa5e1f1e86b9

SHA512
970f6b6b529ed0cf37238334d78d5b2cef7bd9eb5cfc64e5bb9f8df93d6bfca9242ef7d45813dac69d5dbeb5c4fa9fcf203dfafe675eb4220a1185f0094e6581

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8F07.tmp\ioSpecial.ini

Filesize
723B

MD5
38efc2054af7f1b7a0e7d74983e8c63a

SHA1
39af4804afd8d989ac850fa932c6c0641393841b

SHA256
fc7bb50750f9b80b20c00b796672fb6ed8cbe98b9ce66ab5bb30aa7d14ca968f

SHA512
54838c2dc3fee54ab1ad1e226bb0de465ec47a028650e89001808a8dac523f2575b4077f29449b390493be7d297830d6e3c415df8a4befe0dc06dae159f781b1

Download Submit
\Users\Admin\AppData\Local\Temp\nso8F07.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit
\Users\Admin\AppData\Local\Temp\nso8F07.tmp\Splash.dll

Filesize
4KB

MD5
ff8340b98dbd0c4f38d06627b97637a4

SHA1
aae736a26fbb1ed5e9fddd956115699a910b3435

SHA256
6dad450c8b77a4827899eb54347d6f0c3a225c56920b0565dbc6b63c33bc176f

SHA512
58eda9fdc3e69c651f96d2994c76afd9e09624de5622177996b3ca9cfb9fbadb4489996ac49d220de16963acc734853239b807c65c50f79d39f4b292925ec685

Download Submit