Analysis

  • max time kernel
    0s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 10:21

General

  • Target

    abb84f7bbcc5585765153cd445c8c07d.exe

  • Size

    1.1MB

  • MD5

    abb84f7bbcc5585765153cd445c8c07d

  • SHA1

    69707e556ebd88aec6414c0c5a481b235ad2eead

  • SHA256

    149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f

  • SHA512

    12752cdde51c29b3fb4afc16405881681f06e3f4abc8b4912c35f366af6d2bc84ae321110a6ee11f1b8d0ab557975c9892ca0977b149c59f24735c0076d33a38

  • SSDEEP

    12288:TGPoV34JStlA/afwCtrduIyCuUy21lbyOuJOmBws5o8pewY3:T0uqipuIySjQes5oSel

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe
    "C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C taskkill /f /im "SecurityHealthService.exe" & ping -n 1 -w 3000 1.1.1.1 & type nul > "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe" & del /f /q "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"
        3⤵
          PID:2636
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /delete /f /tn "AGP Service Task"
          3⤵
            PID:2840
          • C:\Windows\system32\schtasks.exe
            "schtasks.exe" /delete /f /tn "AGP Service"
            3⤵
              PID:2776
          • C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe
            "C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe"
            2⤵
            • Executes dropped EXE
            PID:2628
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2444.tmp"
          1⤵
          • Creates scheduled task(s)
          PID:2640
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp23E5.tmp"
          1⤵
          • Creates scheduled task(s)
          PID:2656
        • C:\Windows\system32\PING.EXE
          ping -n 1 -w 3000 1.1.1.1
          1⤵
          • Runs ping.exe
          PID:2500
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "SecurityHealthService.exe"
          1⤵
          • Kills process with taskkill
          PID:2964

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2312-8-0x0000000002930000-0x00000000029D3000-memory.dmp

                Filesize

                652KB

              • memory/2628-14-0x000000013FBF0000-0x000000013FC93000-memory.dmp

                Filesize

                652KB

              • memory/2748-37-0x000000001AD70000-0x000000001AD84000-memory.dmp

                Filesize

                80KB

              • memory/2748-34-0x0000000000910000-0x000000000091C000-memory.dmp

                Filesize

                48KB

              • memory/2748-40-0x00000000006A0000-0x00000000006AA000-memory.dmp

                Filesize

                40KB

              • memory/2748-43-0x000000001BDB0000-0x000000001BEB0000-memory.dmp

                Filesize

                1024KB

              • memory/2748-42-0x000000001AD90000-0x000000001ADA4000-memory.dmp

                Filesize

                80KB

              • memory/2748-44-0x000000001BDB0000-0x000000001BEB0000-memory.dmp

                Filesize

                1024KB

              • memory/2748-41-0x000000001B080000-0x000000001B0AE000-memory.dmp

                Filesize

                184KB

              • memory/2748-39-0x000000001AF80000-0x000000001AF9E000-memory.dmp

                Filesize

                120KB

              • memory/2748-38-0x000000001AD80000-0x000000001AD8E000-memory.dmp

                Filesize

                56KB

              • memory/2748-17-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

                Filesize

                9.6MB

              • memory/2748-36-0x0000000002160000-0x0000000002170000-memory.dmp

                Filesize

                64KB

              • memory/2748-35-0x0000000002150000-0x0000000002164000-memory.dmp

                Filesize

                80KB

              • memory/2748-33-0x0000000000750000-0x000000000075E000-memory.dmp

                Filesize

                56KB

              • memory/2748-32-0x0000000000510000-0x000000000051E000-memory.dmp

                Filesize

                56KB

              • memory/2748-31-0x00000000008E0000-0x00000000008FA000-memory.dmp

                Filesize

                104KB

              • memory/2748-30-0x0000000000550000-0x0000000000562000-memory.dmp

                Filesize

                72KB

              • memory/2748-28-0x0000000000740000-0x000000000074A000-memory.dmp

                Filesize

                40KB

              • memory/2748-18-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

                Filesize

                9.6MB

              • memory/2748-29-0x00000000006C0000-0x0000000000740000-memory.dmp

                Filesize

                512KB

              • memory/2748-19-0x00000000006C0000-0x0000000000740000-memory.dmp

                Filesize

                512KB

              • memory/2748-20-0x00000000006C0000-0x0000000000740000-memory.dmp

                Filesize

                512KB

              • memory/2748-54-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

                Filesize

                9.6MB

              • memory/2748-53-0x00000000006C0000-0x0000000000740000-memory.dmp

                Filesize

                512KB