Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 09:17

General

  • Target

    Sigmanly_0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46.exe

  • Size

    203KB

  • MD5

    18b476d37244cb0b435d7b06912e9193

  • SHA1

    9ccc7e5cc915e0ed3d1158328e56b50f4da694e2

  • SHA256

    0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46

  • SHA512

    5011ffc0328a27befb4407a4634d87bc8459b7513eb8d42d267349f5c45dc35f53e8dad6bf53689531124d3d95cca5d646bfceb1693aafa3a766c3b3243c3eda

  • SSDEEP

    6144:wLV6Bta6dtJmakIM5GHPDSL6YFj8qOCQE:wLV6BtpmklPbIj8qOC5

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Nanocore family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sigmanly_0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46.exe
    "C:\Users\Admin\AppData\Local\Temp\Sigmanly_0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2464-0-0x00000000754B2000-0x00000000754B3000-memory.dmp

    Filesize

    4KB

  • memory/2464-1-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2464-2-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2464-5-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2464-6-0x00000000754B2000-0x00000000754B3000-memory.dmp

    Filesize

    4KB

  • memory/2464-7-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2464-8-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2464-9-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB