Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 05:19

General

  • Target

    795f466f1d7046801dff29d26e922b35.exe

  • Size

    906KB

  • MD5

    795f466f1d7046801dff29d26e922b35

  • SHA1

    95d942b20ec16b4311e35cfb12a94293cad69851

  • SHA256

    81c5ece1954156740f639f838730f9f27f2dbb17b7752f525a715d4bc0fa03e8

  • SHA512

    81aab8bb72c1c379d40dd50572c748b296a83dde127ecae441140ba0fe40da9609ad629e5d3a67cae1069183ee3db3e3cbb8fcbd72ef7d24528a758121ee21ca

  • SSDEEP

    24576:ahkYErrvfgKDMq4SiagonfDb451LHCKjZOlNr45cIzCAxOj9mNL6rGB4:1YarIOMq4ShffDUPLi3P4D

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe
    "C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe
      "C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe"
      2⤵
        PID:2468
      • C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe
        "C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe"
        2⤵
          PID:2728
        • C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe
          "C:\Users\Admin\AppData\Local\Temp\795f466f1d7046801dff29d26e922b35.exe"
          2⤵
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "WPA Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4A1A.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:2836
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks.exe" /create /f /tn "WPA Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4CAB.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:1236

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp4A1A.tmp

        Filesize

        1KB

        MD5

        1e066fb33041a599e72459f8e659972e

        SHA1

        1c4787d843093c56a328003247a74b23238224e7

        SHA256

        44d6b3fbd67563b2f32086a6ec66d726db9ef425821af249ece97da48854d361

        SHA512

        f1e8d8055951009a3289a4237df6597cd0aac83ba5b379f535b127459c8e04ddcf2e17346840a180409f4ed212113b3f9545e2e623b9a6e203bca4e35ff9e395

      • C:\Users\Admin\AppData\Local\Temp\tmp4CAB.tmp

        Filesize

        1KB

        MD5

        819bdbdac3be050783d203020e6c4c30

        SHA1

        a373521fceb21cac8b93e55ee48578e40a6e740b

        SHA256

        0e5dedca6d0d3c50ebcedb5bbf51ef3d434eb6b43da46764205de7636131f053

        SHA512

        cece1c4d8b4db79fc6e3cd225efaccdf9d2493f28991b1d48439944af38aaa61a215bd00a0beedcbdecc4f1ec5be0843774375a483f3d4a573a3980c54798cbd

      • memory/2668-16-0x0000000073F50000-0x00000000744FB000-memory.dmp

        Filesize

        5.7MB

      • memory/2668-1-0x0000000073F50000-0x00000000744FB000-memory.dmp

        Filesize

        5.7MB

      • memory/2668-2-0x0000000000520000-0x0000000000560000-memory.dmp

        Filesize

        256KB

      • memory/2668-3-0x0000000000520000-0x0000000000560000-memory.dmp

        Filesize

        256KB

      • memory/2668-4-0x0000000000520000-0x0000000000560000-memory.dmp

        Filesize

        256KB

      • memory/2668-0-0x0000000073F50000-0x00000000744FB000-memory.dmp

        Filesize

        5.7MB

      • memory/2716-28-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-29-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-13-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-15-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-10-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-18-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-19-0x00000000739A0000-0x0000000073F4B000-memory.dmp

        Filesize

        5.7MB

      • memory/2716-22-0x0000000000540000-0x0000000000580000-memory.dmp

        Filesize

        256KB

      • memory/2716-24-0x00000000739A0000-0x0000000073F4B000-memory.dmp

        Filesize

        5.7MB

      • memory/2716-25-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-26-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-27-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-9-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-23-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-21-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2716-31-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-33-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-34-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-37-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-39-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-40-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-42-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-43-0x0000000000540000-0x0000000000580000-memory.dmp

        Filesize

        256KB

      • memory/2716-45-0x0000000000540000-0x0000000000580000-memory.dmp

        Filesize

        256KB

      • memory/2716-7-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-5-0x0000000000400000-0x0000000000472000-memory.dmp

        Filesize

        456KB

      • memory/2716-52-0x00000000739A0000-0x0000000073F4B000-memory.dmp

        Filesize

        5.7MB

      • memory/2716-53-0x0000000000540000-0x0000000000580000-memory.dmp

        Filesize

        256KB

      • memory/2716-54-0x00000000739A0000-0x0000000073F4B000-memory.dmp

        Filesize

        5.7MB

      • memory/2716-55-0x0000000000540000-0x0000000000580000-memory.dmp

        Filesize

        256KB

      • memory/2716-56-0x0000000000540000-0x0000000000580000-memory.dmp

        Filesize

        256KB