Analysis
-
max time kernel
107s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 11:01
General
-
Target
e45990b6a35b8a8c5b0f9a50945893fbd1d6c7d1bcf2bdc585867490d25ae100.exe
-
Size
202KB
-
MD5
464ff5ba7c5d24349803fd2547acf6a0
-
SHA1
202fb6cbac6f19a793b8406247674b3245ae51a7
-
SHA256
e45990b6a35b8a8c5b0f9a50945893fbd1d6c7d1bcf2bdc585867490d25ae100
-
SHA512
9ea0a2e6673d8dc9adf8937a997681a39104af0277d88b7298a96dbfba39198aa44bb9d51adebbc0634aecfcb2c5282fcd7df2a4f361a53e919bed6f53109953
-
SSDEEP
3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/2sb4F5e9nOjbdIlmvujtJrAq:gLV6Bta6dtJmakIM5zSOvh2RCh2N
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e45990b6a35b8a8c5b0f9a50945893fbd1d6c7d1bcf2bdc585867490d25ae100.exe"C:\Users\Admin\AppData\Local\Temp\e45990b6a35b8a8c5b0f9a50945893fbd1d6c7d1bcf2bdc585867490d25ae100.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB