Analysis

  • max time kernel
    0s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 10:21

General

  • Target

    abb84f7bbcc5585765153cd445c8c07d.exe

  • Size

    1.1MB

  • MD5

    abb84f7bbcc5585765153cd445c8c07d

  • SHA1

    69707e556ebd88aec6414c0c5a481b235ad2eead

  • SHA256

    149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f

  • SHA512

    12752cdde51c29b3fb4afc16405881681f06e3f4abc8b4912c35f366af6d2bc84ae321110a6ee11f1b8d0ab557975c9892ca0977b149c59f24735c0076d33a38

  • SSDEEP

    12288:TGPoV34JStlA/afwCtrduIyCuUy21lbyOuJOmBws5o8pewY3:T0uqipuIySjQes5oSel

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe
    "C:\Users\Admin\AppData\Local\Temp\abb84f7bbcc5585765153cd445c8c07d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2172
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C taskkill /f /im "SecurityHealthService.exe" & ping -n 1 -w 3000 1.1.1.1 & type nul > "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe" & del /f /q "C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe"
        3⤵
          PID:2844
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /delete /f /tn "TCP Service Task"
          3⤵
            PID:2944
          • C:\Windows\system32\schtasks.exe
            "schtasks.exe" /delete /f /tn "TCP Service"
            3⤵
              PID:2672
          • C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe
            "C:\Users\Admin\AppData\Local\Temp\Tayz Woofer.exe"
            2⤵
            • Executes dropped EXE
            PID:1804
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1585.tmp"
          1⤵
          • Creates scheduled task(s)
          PID:2556
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1526.tmp"
          1⤵
          • Creates scheduled task(s)
          PID:2532
        • C:\Windows\system32\PING.EXE
          ping -n 1 -w 3000 1.1.1.1
          1⤵
          • Runs ping.exe
          PID:1832
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "SecurityHealthService.exe"
          1⤵
          • Kills process with taskkill
          PID:1600

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1804-14-0x000000013F340000-0x000000013F3E3000-memory.dmp

                Filesize

                652KB

              • memory/1804-47-0x000000013F340000-0x000000013F3E3000-memory.dmp

                Filesize

                652KB

              • memory/2076-6-0x0000000002A70000-0x0000000002B13000-memory.dmp

                Filesize

                652KB

              • memory/2172-36-0x0000000002090000-0x00000000020A0000-memory.dmp

                Filesize

                64KB

              • memory/2172-33-0x0000000000830000-0x000000000083E000-memory.dmp

                Filesize

                56KB

              • memory/2172-43-0x000000001BF30000-0x000000001C030000-memory.dmp

                Filesize

                1024KB

              • memory/2172-41-0x0000000002380000-0x00000000023AE000-memory.dmp

                Filesize

                184KB

              • memory/2172-44-0x000000001BF30000-0x000000001C030000-memory.dmp

                Filesize

                1024KB

              • memory/2172-40-0x00000000002E0000-0x00000000002EA000-memory.dmp

                Filesize

                40KB

              • memory/2172-38-0x0000000002230000-0x000000000223E000-memory.dmp

                Filesize

                56KB

              • memory/2172-37-0x0000000002220000-0x0000000002234000-memory.dmp

                Filesize

                80KB

              • memory/2172-17-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

                Filesize

                9.6MB

              • memory/2172-35-0x0000000002080000-0x0000000002094000-memory.dmp

                Filesize

                80KB

              • memory/2172-34-0x0000000002070000-0x000000000207C000-memory.dmp

                Filesize

                48KB

              • memory/2172-42-0x00000000023B0000-0x00000000023C4000-memory.dmp

                Filesize

                80KB

              • memory/2172-32-0x0000000000290000-0x000000000029E000-memory.dmp

                Filesize

                56KB

              • memory/2172-31-0x0000000000810000-0x000000000082A000-memory.dmp

                Filesize

                104KB

              • memory/2172-29-0x0000000000800000-0x000000000080A000-memory.dmp

                Filesize

                40KB

              • memory/2172-28-0x00000000020A0000-0x0000000002120000-memory.dmp

                Filesize

                512KB

              • memory/2172-19-0x00000000020A0000-0x0000000002120000-memory.dmp

                Filesize

                512KB

              • memory/2172-39-0x0000000002240000-0x000000000225E000-memory.dmp

                Filesize

                120KB

              • memory/2172-30-0x00000000002B0000-0x00000000002C2000-memory.dmp

                Filesize

                72KB

              • memory/2172-20-0x00000000020A0000-0x0000000002120000-memory.dmp

                Filesize

                512KB

              • memory/2172-18-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

                Filesize

                9.6MB

              • memory/2172-54-0x00000000020A0000-0x0000000002120000-memory.dmp

                Filesize

                512KB

              • memory/2172-55-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

                Filesize

                9.6MB