Analysis
- max time kernel
109s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
30/09/2024, 00:00
General
- Target ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe
- Size 210KB
- Sample240930-aap1qsxanm
- SHA256 ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268ad
Malware Config
Signatures
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe"C:\Users\Admin\AppData\Local\Temp\ea69951896685ab2f6a88969e5448d529783d9465457240ee1353b0c393268adN.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "DNS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBBED.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /tn "DNS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBC5C.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
tmpBBED.tmp
tmpBC5C.tmp
memory/4772-16-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-15-0x000000001D1C0000-0x000000001D1CA000-memory.dmp
memory/4772-4-0x000000001C940000-0x000000001C9E6000-memory.dmp
memory/4772-5-0x000000001BD50000-0x000000001BD58000-memory.dmp
memory/4772-6-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-7-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-2-0x000000001C2C0000-0x000000001C78E000-memory.dmp
memory/4772-19-0x000000001D3D0000-0x000000001D3DA000-memory.dmp
memory/4772-18-0x000000001D3F0000-0x000000001D40E000-memory.dmp
memory/4772-17-0x000000001BDD0000-0x000000001BDDC000-memory.dmp
memory/4772-3-0x000000001BC90000-0x000000001BD2C000-memory.dmp
memory/4772-0-0x00007FFCD36B5000-0x00007FFCD36B6000-memory.dmp
memory/4772-1-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-20-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-21-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-22-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-23-0x00007FFCD36B5000-0x00007FFCD36B6000-memory.dmp
memory/4772-24-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-25-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-26-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-27-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-28-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp
memory/4772-29-0x00007FFCD3400000-0x00007FFCD3DA1000-memory.dmp