Analysis Overview
SHA256
adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
Threat Level: Known bad
The file adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5 was found to be: Known bad.
Malicious Activity Summary
NanoCore
Nanocore family
Checks whether UAC is enabled
Adds Run key to start application
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-12 01:04
Signatures
Nanocore family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-12 01:04
Reported
2024-08-12 01:07
Platform
win7-20240704-en
Max time kernel
144s
Max time network
148s
Command Line
Signatures
NanoCore
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\ARP Host\arphost.exe | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
| File opened for modification | C:\Program Files (x86)\ARP Host\arphost.exe | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe
"C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAF62.tmp"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp"
Network
| Country | Destination | Domain | Proto |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp |
Files
memory/2384-0-0x0000000074B51000-0x0000000074B52000-memory.dmp
memory/2384-1-0x0000000074B50000-0x00000000750FB000-memory.dmp
memory/2384-2-0x0000000074B50000-0x00000000750FB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpAF62.tmp
| MD5 | 6fc47cb8fdf5fef86008857843213de7 |
| SHA1 | 5d445584d5fb94a7882b1aac3fe83ac73d5a559d |
| SHA256 | 86cec4e3fd86ad39364336d9e210911e5a84011acd68d25e7c93cbba02a2e285 |
| SHA512 | d88269a6f995fcce4a8a5949cf0e53f27187eedff5234b4d9178232d88bfe3f86e376320726aea130914a5235f37ce931ffd82803ce8969dac62d396d75bd56e |
C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp
| MD5 | 447ab194ab36cb1d20078d80e502b1b2 |
| SHA1 | a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0 |
| SHA256 | 8d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5 |
| SHA512 | 49ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327 |
memory/2384-10-0x0000000074B50000-0x00000000750FB000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-12 01:04
Reported
2024-08-12 01:07
Platform
win10v2004-20240802-en
Max time kernel
146s
Max time network
148s
Command Line
Signatures
NanoCore
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNS Manager = "C:\\Program Files (x86)\\DNS Manager\\dnsmgr.exe" | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\DNS Manager\dnsmgr.exe | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
| File created | C:\Program Files (x86)\DNS Manager\dnsmgr.exe | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe
"C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DNS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB8C1.tmp"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DNS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB91F.tmp"
Network
| Country | Destination | Domain | Proto |
| N/A | 10.0.0.21:49356 | tcp | |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| N/A | 10.0.0.21:49356 | tcp | |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| N/A | 10.0.0.21:49356 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp | |
| N/A | 10.0.0.21:49356 | tcp |
Files
memory/3608-0-0x0000000074EA2000-0x0000000074EA3000-memory.dmp
memory/3608-1-0x0000000074EA0000-0x0000000075451000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpB8C1.tmp
| MD5 | 6fc47cb8fdf5fef86008857843213de7 |
| SHA1 | 5d445584d5fb94a7882b1aac3fe83ac73d5a559d |
| SHA256 | 86cec4e3fd86ad39364336d9e210911e5a84011acd68d25e7c93cbba02a2e285 |
| SHA512 | d88269a6f995fcce4a8a5949cf0e53f27187eedff5234b4d9178232d88bfe3f86e376320726aea130914a5235f37ce931ffd82803ce8969dac62d396d75bd56e |
C:\Users\Admin\AppData\Local\Temp\tmpB91F.tmp
| MD5 | bf0287a4e4ec6b543e5f2c020d4f88b2 |
| SHA1 | da151b3e3f382ec107053e487b08035616db2694 |
| SHA256 | ef704c92466ea7f43c33880380c3fbc8bee8d8ce7a041abefb23fd610baff13c |
| SHA512 | 94c9b8f53120a0024031996a91ee54de0a791e49e45a9e2c6e56c51a363b3b3cac206f19b84861a21054bcd3ee8031ab684596502a126fea47352474a4ecd8be |
memory/3608-9-0x0000000074EA0000-0x0000000075451000-memory.dmp
memory/3608-10-0x0000000074EA0000-0x0000000075451000-memory.dmp
memory/3608-11-0x0000000074EA2000-0x0000000074EA3000-memory.dmp
memory/3608-12-0x0000000074EA0000-0x0000000075451000-memory.dmp
memory/3608-13-0x0000000074EA0000-0x0000000075451000-memory.dmp