nanocore | 70b89cc9b030d9f21b278edda0277a9ed5d7956df026b4a407e94423198549f5

General

Target

bypassdev.exe
Size

410KB
MD5

201787cd33e5530811265cd836d32d34
SHA1

5b3cac1e442996911acc2061b1c5ac54e5912aac
SHA256

bca6e27840de5c2375667cd775b9d02851229cdd60916770991acfd0ad37d62a
SHA512

2df1840ee6453dc458e20f4446a60cc3484d7c9ab6a9f8a227968f43f8b16d45215a87e66b1c93ce11995f267e70daadf720bc95b46c45e1de0d6426198bb8e4
SSDEEP

6144:avEN2U+T6i5LirrllHy4HUcMQY6rLV6Bta6dtJmakIM5/tfqlGgBFUZZPiAE:EENN+T5xYrllrU7QY6rLV6BtpmkaJmEE

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

gayagoris.ddns.net:7005

Mutex

444ca634-7148-4ffa-81b4-5959bb4b4e5e

Attributes

activate_away_mode
true
backup_connection_host
gayagoris.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-08-05T00:46:31.519038936Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7005
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
444ca634-7148-4ffa-81b4-5959bb4b4e5e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
gayagoris.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 6 IoCs

Processes:

bypassdev.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2252 bypassdev.exe
1456 icsys.icn.exe
4624 explorer.exe
3768 spoolsv.exe
4628 svchost.exe
4936 spoolsv.exe

pid	process
2252	bypassdev.exe
1456	icsys.icn.exe
4624	explorer.exe
3768	spoolsv.exe
4628	svchost.exe
4936	spoolsv.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exebypassdev.exe explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Monitor = "C:\\Program Files (x86)\\LAN Monitor\\lanmon.exe"	bypassdev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bypassdev.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bypassdev.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bypassdev.exe

Drops file in Program Files directory 2 IoCs

Processes:

bypassdev.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\LAN Monitor\lanmon.exe	bypassdev.exe
File created	C:\Program Files (x86)\LAN Monitor\lanmon.exe	bypassdev.exe

Drops file in Windows directory 6 IoCs

Processes:

explorer.exeicsys.icn.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3776 schtasks.exe
3740 schtasks.exe

pid	process
3776	schtasks.exe
3740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

icsys.icn.exeexplorer.exesvchost.exe

pid	process
1456	icsys.icn.exe
1456	icsys.icn.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4624	explorer.exe
4628	svchost.exe
4624	explorer.exe
4628	svchost.exe
4624	explorer.exe
4628	svchost.exe
4624	explorer.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe
4628	svchost.exe
4628	svchost.exe
4624	explorer.exe
4624	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

bypassdev.exe explorer.exesvchost.exe

pid process

2252 bypassdev.exe
4624 explorer.exe
4628 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bypassdev.exe

description pid process

Token: SeDebugPrivilege 2252 bypassdev.exe
Token: SeDebugPrivilege 2252 bypassdev.exe

pid	process
2252	bypassdev.exe
4624	explorer.exe
4628	svchost.exe

description	pid	process
Token: SeDebugPrivilege	2252	bypassdev.exe
Token: SeDebugPrivilege	2252	bypassdev.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

bypassdev.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
656	bypassdev.exe
656	bypassdev.exe
1456	icsys.icn.exe
1456	icsys.icn.exe
4624	explorer.exe
4624	explorer.exe
3768	spoolsv.exe
3768	spoolsv.exe
4628	svchost.exe
4628	svchost.exe
4936	spoolsv.exe
4936	spoolsv.exe
4624	explorer.exe
4624	explorer.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

bypassdev.exebypassdev.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 656 wrote to memory of 2252	656	bypassdev.exe	bypassdev.exe
PID 656 wrote to memory of 2252	656	bypassdev.exe	bypassdev.exe
PID 656 wrote to memory of 2252	656	bypassdev.exe	bypassdev.exe
PID 2252 wrote to memory of 3740	2252	bypassdev.exe	schtasks.exe
PID 2252 wrote to memory of 3740	2252	bypassdev.exe	schtasks.exe
PID 2252 wrote to memory of 3740	2252	bypassdev.exe	schtasks.exe
PID 656 wrote to memory of 1456	656	bypassdev.exe	icsys.icn.exe
PID 656 wrote to memory of 1456	656	bypassdev.exe	icsys.icn.exe
PID 656 wrote to memory of 1456	656	bypassdev.exe	icsys.icn.exe
PID 1456 wrote to memory of 4624	1456	icsys.icn.exe	explorer.exe
PID 1456 wrote to memory of 4624	1456	icsys.icn.exe	explorer.exe
PID 1456 wrote to memory of 4624	1456	icsys.icn.exe	explorer.exe
PID 2252 wrote to memory of 3776	2252	bypassdev.exe	schtasks.exe
PID 2252 wrote to memory of 3776	2252	bypassdev.exe	schtasks.exe
PID 2252 wrote to memory of 3776	2252	bypassdev.exe	schtasks.exe
PID 4624 wrote to memory of 3768	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 3768	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 3768	4624	explorer.exe	spoolsv.exe
PID 3768 wrote to memory of 4628	3768	spoolsv.exe	svchost.exe
PID 3768 wrote to memory of 4628	3768	spoolsv.exe	svchost.exe
PID 3768 wrote to memory of 4628	3768	spoolsv.exe	svchost.exe
PID 4628 wrote to memory of 4936	4628	svchost.exe	spoolsv.exe
PID 4628 wrote to memory of 4936	4628	svchost.exe	spoolsv.exe
PID 4628 wrote to memory of 4936	4628	svchost.exe	spoolsv.exe
PID 4628 wrote to memory of 4508	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 4508	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 4508	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 1736	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 1736	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 1736	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 1176	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 1176	4628	svchost.exe	at.exe
PID 4628 wrote to memory of 1176	4628	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\bypassdev.exe
"C:\Users\Admin\AppData\Local\Temp\bypassdev.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656

\??\c:\users\admin\appdata\local\temp\bypassdev.exe
c:\users\admin\appdata\local\temp\bypassdev.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "LAN Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5573.tmp"
3⤵
- Creates scheduled task(s)
PID:3740

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "LAN Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp562F.tmp"
3⤵
- Creates scheduled task(s)
PID:3776

C:\Users\Admin\AppData\Local\icsys.icn.exe
C:\Users\Admin\AppData\Local\icsys.icn.exe
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\SysWOW64\at.exe
at 18:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
6⤵
PID:4508

C:\Windows\SysWOW64\at.exe
at 18:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
6⤵
PID:1736

C:\Windows\SysWOW64\at.exe
at 18:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
6⤵
PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bypassdev.exe
Filesize
203KB

MD5
2dacc63c7b382248b2034585e527b19f

SHA1
8a5cf2aacfcb111a4703f4adc88a0f3e752a9f37

SHA256
2c92de520918b894d1934c99cfc74f46f979097c125b093077eee38218b01cee

SHA512
0a5a5be8583e41d947f635303121d2246de09b68a4aff08aa81f9e675385bcf6a10246c52aff3669066a1ac056aec90db72212d00a0e9a9ea80b6ecbc17e467b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5573.tmp
Filesize
1KB

MD5
9418fc2c3eae3391cbd47e4a97427229

SHA1
b66bfc0acb17f40bfc31d73920b899cff196710c

SHA256
467fcbd388cb87138ce9383a710c5db70adb502de1c4b9279c282badf2cdf986

SHA512
cba6eb70ee1c3a4ef9df95af41f32631cfda57225af1217d3c918937888320d1666bc86be599b3f6309d013963bcb8f2e88a42b9b4d3f9e83214ea53a9d66f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp562F.tmp
Filesize
1KB

MD5
ecf141ec69adbb2a5c3dd5c85cd0ec39

SHA1
0ad224632fa58d103142c05c44a142f3d7208291

SHA256
64d8cfa0b25afee269839cd5fc0b66e5643bc318e5f4d3ce1b9dba2456c83316

SHA512
4821b062d6672f3ed07833cfd7ab9abb533850b451b632d781fbfad8238fcd5ac52855f1f239547ae2d1c1477959f022430302a75cfd3c19a8473af72a1ef201

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe
Filesize
206KB

MD5
ee5186c032fa5b49d8ef9121c69770ed

SHA1
3a73e644fee016d444d06ecb20818ab7c15bafbc

SHA256
eed51642726258b849f74c0a00f5989c6c2257c7f1a09fe3488b3e648c35bc27

SHA512
bea8e41f0bec4b98fa314082bbbfddf8688000aa4ab34cf495d0ceac2cef73bc9c3dc18a527a44f2f9508a4bc56b410bcc3091419927ecf02d559ccc6a452e42

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
206KB

MD5
ffb2d03cdabbdac2fe159855aa737c6e

SHA1
1470136e7a8383ff29986c11437855ea134f96f4

SHA256
46f432d545a670b8623b44d4df41d3b4b0eb05e84d5643d7e8ee3b36b300e73d

SHA512
36cdfda131f4a39ed434a53d38d4b9455b91e2b0b4a047ad49fb5fc8c7ee86d654722aca7dc4e668a62ec21715915aa970cd4be7d26e2b954856016d3287f2cb

Download Submit
C:\Windows\System\explorer.exe
Filesize
206KB

MD5
9c9ab32172abfecfa9b7c4974de5c0a4

SHA1
e1ad276f21c326845143093c1a461f34e72773ff

SHA256
c498af3dbba549c7515d3cff7e0612ccf7e4b7223fd20bf001f7d2f1f6c5dbe7

SHA512
8beba62287d514f63a0536c1d85487abfc4c7ef0db1dbd7c3ce651e1cccda58ee1c860891db93f82d2b426e561dc57e918ca1eefe2d8d3a39da5051bb6fa6ae6

Download Submit
\??\c:\windows\system\spoolsv.exe
Filesize
207KB

MD5
d2afe09d128d8bc9e0327adcfd754602

SHA1
ec232163d1c5ca61bea237d0091e1718a0fb8075

SHA256
62e6c7b013172f2d388b6383fa3b55c3dce465fc92bc3e46570d1e5979500e7d

SHA512
abe39f65e8b8334a2d96892d6ba44f12e22b0b390f965aa5a54334f3b6971f219954f2e6b46c529f8388a1fe9376f8098dda9278bb532a6048800512e03c642c

Download Submit
\??\c:\windows\system\svchost.exe
Filesize
206KB

MD5
add7600d08ae6846034a4cab4be087c4

SHA1
715314ca44ba7b6539a52a9186c97f8b26f5cd82

SHA256
f025c7ebae1c3371375b8c3c19ca4257677f4cf73318ed5b9e03cd0a6923c8e3

SHA512
eef43779300f9909c92e1c04dbbd7e17393ab1b085f0106ca5e213d1b2f8e73ce85d10914e133a98191465c420b64ce9e908c210480f6a438cc474236234691f

Download Submit
memory/656-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/656-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1456-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1456-19-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2252-13-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2252-64-0x00000000749B2000-0x00000000749B3000-memory.dmp

Filesize
4KB

Download
memory/2252-67-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2252-66-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2252-11-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2252-10-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2252-65-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2252-9-0x00000000749B2000-0x00000000749B3000-memory.dmp

Filesize
4KB

Download
memory/3768-42-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3768-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads