Analysis Overview
SHA256
83d064ee508b2543d3f9fc16f4ed16fee34cf130713d3cee54d5f20ce7f452cc
Threat Level: Known bad
The file SolaraV2.1 nano.exe was found to be: Known bad.
Malicious Activity Summary
Nanocore family
NanoCore
Adds Run key to start application
Checks whether UAC is enabled
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-11 00:43
Signatures
Nanocore family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-11 00:43
Reported
2024-08-11 00:47
Platform
win10v2004-20240802-en
Max time kernel
209s
Max time network
206s
Command Line
Signatures
NanoCore
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNS Monitor = "C:\\Program Files (x86)\\DNS Monitor\\dnsmon.exe" | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\DNS Monitor\dnsmon.exe | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| File opened for modification | C:\Program Files (x86)\DNS Monitor\dnsmon.exe | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4948 wrote to memory of 4748 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 4948 wrote to memory of 4748 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 4948 wrote to memory of 4748 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 4948 wrote to memory of 4952 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 4948 wrote to memory of 4952 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
| PID 4948 wrote to memory of 4952 | N/A | C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe | C:\Windows\SysWOW64\schtasks.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DNS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA066.tmp"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DNS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA0F4.tmp"
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:54984 | tcp | |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp | |
| N/A | 127.0.0.1:54984 | tcp |
Files
memory/4948-0-0x0000000074782000-0x0000000074783000-memory.dmp
memory/4948-1-0x0000000074780000-0x0000000074D31000-memory.dmp
memory/4948-2-0x0000000074780000-0x0000000074D31000-memory.dmp
memory/4948-4-0x0000000074780000-0x0000000074D31000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpA066.tmp
| MD5 | 4bb70ae457112a038573b994ab89c3ae |
| SHA1 | 7e5057e0034d70f94c17c10438437b138f055780 |
| SHA256 | 411a8d9306b8233d8dad43faae19467494e84a5458e6e2c461bc9db4c10a940c |
| SHA512 | aaba48de49eb6fef60ec38e3f9f7ec3b4fc5962ff95259c9362afd01a30c6d290475b4c9c4dc5ba442de106ad4bde38d28768caf3f6aaf309e613cc115711dd1 |
C:\Users\Admin\AppData\Local\Temp\tmpA0F4.tmp
| MD5 | 7620b805f7bc12c79e126656c858d0e0 |
| SHA1 | 89f09b8b4ef1fc421ddf5ed0cbbe012fab7fd666 |
| SHA256 | 4d6ea014d135bdc4a5fd4281ce705672561b0279deab4302e06cbfe95e1080a6 |
| SHA512 | b02ac735c98b20020251a23ffa1b0308ad3a1c99593a15a8020d742472b0d5c36caa31c6ca2372e88cfd3b6792206ea7920162c2a33c83da24f0098c0513f562 |
memory/4948-11-0x0000000074780000-0x0000000074D31000-memory.dmp
memory/4948-12-0x0000000074782000-0x0000000074783000-memory.dmp
memory/4948-13-0x0000000074780000-0x0000000074D31000-memory.dmp
memory/4948-14-0x0000000074780000-0x0000000074D31000-memory.dmp
memory/4948-15-0x0000000074780000-0x0000000074D31000-memory.dmp