Extracted

• • Target
    www.text2mindmap.com_new.exe
  • Size 25KB
  • SHA256 2b0d5f248970b5da9099ac6b97473dae652edadc234ac7d89ec26f2efe5172f1
  • MD5 9ba3421e3610e1dc5156910cf2e5fb6b
  • SHA1 d365eb2d71d4724fdb5f380e5b62f1451a69a798
  • SHA512 42131211b5d0777b18176153753160b333e0a1cc52a23f57ff35540350943f5074e36b7870e890c4212a8485da1dfd1712fb42d9d6ffad7be539c1eaba72ea67
  • SSDEEP 384:D+D867eyayiqhKHlvrPPgttCziCFW7NT5+2VNcHl4+FIzUx90TGwNY8G+H+8z9yn:qIjFFvTPgO9WkmyIs9uO8zPBySB
  • TLSH
    T134C2E64577FCC229E0BF1BB65C7247004775B89B8E17CB4D0ED9808E1E77B444AA4BA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2