Analysis

  • max time kernel
    111s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2024 20:07

General

  • Target

    DeepFreeze2.exe

  • Size

    202KB

  • MD5

    83ec608306ccd5d3e266dd4b905b4d74

  • SHA1

    2e687938ea90c5a29b556262e14f5681d77a1b05

  • SHA256

    43e23435f86b410624d67ff00f323652262871be7d5efaf40c336ea59a570149

  • SHA512

    396715f7a400d8b967b92d079fd6404f98d698ea8d9924f2f73f1dc8e241e4ddf92093343746a0cad9d8d653eff9c9e2a108311a97d49ee7d9d08a336888de19

  • SSDEEP

    6144:QLV6Bta6dtJmakIM5tlE4UXkD2rovrO6mlOw:QLV6Btpmk624ttvr5w

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeepFreeze2.exe
    "C:\Users\Admin\AppData\Local\Temp\DeepFreeze2.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:4772
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:116
    • C:\Users\Admin\AppData\Local\Temp\DeepFreeze2.exe
      "C:\Users\Admin\AppData\Local\Temp\DeepFreeze2.exe"
      1⤵
        PID:4100

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4100-8-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

        Filesize

        64KB

      • memory/4100-7-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB

      • memory/4100-9-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB

      • memory/4100-11-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB

      • memory/4772-0-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB

      • memory/4772-1-0x0000000001250000-0x0000000001260000-memory.dmp

        Filesize

        64KB

      • memory/4772-2-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB

      • memory/4772-4-0x0000000001250000-0x0000000001260000-memory.dmp

        Filesize

        64KB

      • memory/4772-5-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB

      • memory/4772-6-0x0000000074EB0000-0x0000000075461000-memory.dmp

        Filesize

        5.7MB