Extracted

Extracted

Extracted

Extracted

• • Target

    driverupdate_report_windows_10_22h2.txt.exe

  • Size

    13.8MB

  • MD5

    8360a6245b4ae84a5b6e4784d7802472

  • SHA1

    192f6d4a68ec867c5919a5d5fd4c782bf9c39127

  • SHA256

    393732bdd7df3cbbcc35dca3397178466f32de8ebd266ad5791c000288771bc5

  • SHA512

    38b4630ab40c84f822fe860038c4c48d0ea31ceaa23d05d01f599c08f44a3fe45113f4386f1874799dfb15e7d7930c369c2eeba11129adfa3f9154264cbcc63b

  • SSDEEP

    49152:M3QhanbDdeZ6Hfa/nkNQzlJ7r5oP3TXyymMknH76EAaIilSH7YNjMn80iA+cpUGN:Mn

  Score

  10^/10

  nanocorenjratremcosaugust crypter toolz grace stubhackedbootkitdefense_evasiondiscoveryevasionexecutionkeyloggerpersistenceprivilege_escalationratspywarestealertrojanupxsup

  • Modifies WinLogon for persistence

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2