Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/03/2025, 03:53
General
-
Target
0x000f000000017390-17.exe
-
Size
202KB
-
MD5
e2557f03a5d4de545313ba77de25139e
-
SHA1
74e271b02f314f8e1544d51ba3095c33b6015930
-
SHA256
ec9bba03d8dabd1ccaf0decd0bbe6fa6b8f23b8b81d67bc96b644f8751409ac6
-
SHA512
451eb59e76ec322c278f99e83af335d419ffc43d0485b4884b0ac519b5759fcf7a6770439894dd240ccc32678842df3b457aa74a82d0079a3e84ff52479d6929
-
SSDEEP
6144:wLV6Bta6dtJmakIM5FlE4UXkD2rovrO6mlOd:wLV6Btpmkm24ttvr5d
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Nanocore family
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000f000000017390-17.exe"C:\Users\Admin\AppData\Local\Temp\0x000f000000017390-17.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB