General
- Target NohBoard.exe
- Size 834KB
- Sample240428-s9554sbb65
- SHA256 8df2babaa8c93c6012f7474a019854c1ac6cdada88a4a4e9c5a8c6e593efe70d
Score
8/10
Malware Config
Targets
-
- Target NohBoard.exe
- Size 834KB
- SHA256 8df2babaa8c93c6012f7474a019854c1ac6cdada88a4a4e9c5a8c6e593efe70d
Score8/10Downloads MZ/PE file
Modifies Installed Components in the registry
Sets file execution options in registry
Executes dropped EXE
Loads dropped DLL
Registers COM server for autorun
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Drops desktop.ini file(s)
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4