Analysis
- max time kernel
148s - max time network
179s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/01/2024, 10:21
General
- Target abb84f7bbcc5585765153cd445c8c07d.exe
- Size 1.1MB
- Sample240106-mdm2rsege3
- SHA256 149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f
Malware Config
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe"C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe"C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8812.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8F56.tmp"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SecurityHealthService.exe
Tayz Woofer.exe
tmp8812.tmp
tmp8F56.tmp
memory/1244-21-0x00007FF75B220000-0x00007FF75B2C3000-memory.dmp
memory/1244-10-0x00007FF75B220000-0x00007FF75B2C3000-memory.dmp
memory/3832-39-0x000000001C190000-0x000000001C1A2000-memory.dmp
memory/3832-42-0x000000001CC70000-0x000000001CC7E000-memory.dmp
memory/3832-22-0x000000001BD90000-0x000000001BE2C000-memory.dmp
memory/3832-23-0x000000001BFE0000-0x000000001C086000-memory.dmp
memory/3832-24-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp
memory/3832-25-0x0000000000DB0000-0x0000000000DB8000-memory.dmp
memory/3832-26-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp
memory/3832-27-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/3832-28-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/3832-19-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/3832-18-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp
memory/3832-36-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/3832-37-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-38-0x000000001C940000-0x000000001C94A000-memory.dmp
memory/3832-17-0x00007FF9B62C0000-0x00007FF9B6C61000-memory.dmp
memory/3832-40-0x000000001CC50000-0x000000001CC6A000-memory.dmp
memory/3832-41-0x000000001C8D0000-0x000000001C8DE000-memory.dmp
memory/3832-20-0x000000001B8C0000-0x000000001BD8E000-memory.dmp
memory/3832-43-0x000000001CC80000-0x000000001CC8C000-memory.dmp
memory/3832-44-0x000000001CC90000-0x000000001CCA4000-memory.dmp
memory/3832-45-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/3832-46-0x0000000000DD0000-0x0000000000DE4000-memory.dmp
memory/3832-47-0x000000001B3D0000-0x000000001B3DE000-memory.dmp
memory/3832-48-0x000000001CCA0000-0x000000001CCBE000-memory.dmp
memory/3832-49-0x000000001CCF0000-0x000000001CCFA000-memory.dmp
memory/3832-50-0x000000001CD00000-0x000000001CD2E000-memory.dmp
memory/3832-52-0x000000001CCE0000-0x000000001CCF4000-memory.dmp
memory/3832-51-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-53-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-54-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-56-0x000000001DC10000-0x000000001DC72000-memory.dmp
memory/3832-57-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-59-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-60-0x000000001C260000-0x000000001C360000-memory.dmp
memory/3832-61-0x000000001C260000-0x000000001C360000-memory.dmp