General
-
Target
https://cdn.discordapp.com/attachments/1334529379874770976/1343240361568370698/PW_Loader.zip?ex=67bc8d92&is=67bb3c12&hm=b468e8144f424b4ef4976d075f24e22a25ff70cda87939f99027fa6e7b7289f1&
-
Sample
250224-aql9saxlg1
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1334529379874770976/1343240361568370698/PW_Loader.zip?ex=67bc8d92&is=67bb3c12&hm=b468e8144f424b4ef4976d075f24e22a25ff70cda87939f99027fa6e7b7289f1&
Score10/10-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Mark of the Web detected: This indicates that the page was originally saved or cloned.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1