Resubmissions

11-08-2024 16:29

240811-tzfcdaxdmq 10

11-08-2024 00:43

240811-a3bntawhjk 10

Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11-08-2024 16:29

General

  • Target

    SolaraV2.1 nano.exe

  • Size

    698KB

  • MD5

    0861b1b5f623ebf122b517cd3250357f

  • SHA1

    6ce6bf05c7bad841edeb1c9c5e4772b4d6de9707

  • SHA256

    83d064ee508b2543d3f9fc16f4ed16fee34cf130713d3cee54d5f20ce7f452cc

  • SHA512

    194852228b7ac1763a37c672c4f139548541b026f2d7835b136e5751c11c82dfb3cbaefbc732b29d02900db33ac0324c8be2fc8ab57b179a06fec8e7c73e8c4d

  • SSDEEP

    12288:0LV6BtpmkBl5sqhmzNgpM/9J67+VDNcuOIJfnQLLm:GApfBl5sqhmzNyM/f6ytOsoLS

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraV2.1 nano.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "LAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC5CF.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2440
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "LAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC67B.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpC5CF.tmp

    Filesize

    1KB

    MD5

    4bb70ae457112a038573b994ab89c3ae

    SHA1

    7e5057e0034d70f94c17c10438437b138f055780

    SHA256

    411a8d9306b8233d8dad43faae19467494e84a5458e6e2c461bc9db4c10a940c

    SHA512

    aaba48de49eb6fef60ec38e3f9f7ec3b4fc5962ff95259c9362afd01a30c6d290475b4c9c4dc5ba442de106ad4bde38d28768caf3f6aaf309e613cc115711dd1

  • C:\Users\Admin\AppData\Local\Temp\tmpC67B.tmp

    Filesize

    1KB

    MD5

    924694e208642d4d8a4c7e0f0cba0de1

    SHA1

    87e9496a918036c3e3902f125b95a47e38548828

    SHA256

    8de0bab59a9fe15f312e81a373382ed992ce5110deb3813f663b92cfc5eae0b6

    SHA512

    ef3cfc08df53777f13fb51fdc0269f6f686c0df57c4dd72f395dc53d1d8ef2b08e33c3601507a45c3cc31a25b70ebf365d0fa93db64e1e851173216a45c49c2c

  • memory/2552-0-0x0000000074B41000-0x0000000074B42000-memory.dmp

    Filesize

    4KB

  • memory/2552-1-0x0000000074B40000-0x00000000750EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2552-2-0x0000000074B40000-0x00000000750EB000-memory.dmp

    Filesize

    5.7MB