Analysis
-
max time kernel
294s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-07-2024 17:59
General
-
Target
Verified by Visa.exe
-
Size
203KB
-
MD5
317acdfc40a1101e24581e36cbedf08b
-
SHA1
18a4e6f44f5e40602e9a667ee0563ee344858c16
-
SHA256
05e59171a19c97bf2fa9dead4de20645fc41cf9fcbd59fc014cdc7a571c185d3
-
SHA512
5edaa32431dee3dc02c1d3b559ecc6984258876e9307bbaf367c9b1fb80fefee2ba11d46f6f1bedc9aee2481a0d8b904b6e66f909d759b50b94d3a8d05cf4c52
-
SSDEEP
6144:ULV6Bta6dtJmakIM5+72k3q7jrVGxP23GqRNL:ULV6BtpmkPq7jRKP23XL
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Verified by Visa.exe"C:\Users\Admin\AppData\Local\Temp\Verified by Visa.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp33AE.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3479.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp33AE.tmpFilesize
1KB
MD55a64bf7a3b7c0522f2cffdecb6a5bd3a
SHA151047690aec1d83371a537f2db77060128109724
SHA256809a9dadbd18413c89bce18aa3bffc955462a9aa32e930f570b14ae0e0f92847
SHA5129f57cfcbc3a898dffc7715f2dd7e216ae4a6e2ddeb1952fb3bd1af8cef9fbcc718cdd41694dfad0ee8cb3781c00d8c7212646c3e7fdf2b07767ee2647e5b5955
-
C:\Users\Admin\AppData\Local\Temp\tmp3479.tmpFilesize
1KB
MD5447ab194ab36cb1d20078d80e502b1b2
SHA1a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0
SHA2568d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5
SHA51249ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327
-
memory/1824-0-0x0000000074A11000-0x0000000074A12000-memory.dmpFilesize
4KB
-
memory/1824-1-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/1824-2-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/1824-10-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB