General
- Target new.exe
- Size 25KB
- Sample260508-2kkmjsaz2j
- SHA256 25277b13bda26c555df289071afeb07cc13ac295a2569c8c63abc967188ab861
Score
10/10
Malware Config
Targets
-
- Target new.exe
- Size 25KB
- SHA256 25277b13bda26c555df289071afeb07cc13ac295a2569c8c63abc967188ab861
Score10/10Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
Grants admin privileges
Uses net.exe to modify the user's privileges.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1