Malware Analysis Report

2025-08-10 19:47

Sample ID 221114-chjvsshd3x
Target 3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8
SHA256 3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8
Tags
nanocore keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8

Threat Level: Known bad

The file 3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8 was found to be: Known bad.

Malicious Activity Summary

nanocore keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-14 02:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-14 02:04

Reported

2022-11-14 02:07

Platform

win10v2004-20220812-en

Max time kernel

136s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3016 set thread context of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\SysWOW64\schtasks.exe
PID 3016 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 3016 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe

"C:\Users\Admin\AppData\Local\Temp\3f0a89e3647d4ff575fc0c8db1ea5e9f7dbf2c0041f90ec2ef26c7eab69b34f8.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TztnPxRQQq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp58DE.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"{path}"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"{path}"

Network

Country Destination Domain Proto
N/A 20.42.73.24:443 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp
N/A 8.8.8.8:53 maxlogs.webhop.me udp
N/A 23.105.131.249:1620 maxlogs.webhop.me tcp

Files

memory/3016-132-0x00000000001E0000-0x00000000002CA000-memory.dmp

memory/3016-133-0x00000000051C0000-0x0000000005764000-memory.dmp

memory/3016-134-0x0000000004CB0000-0x0000000004D42000-memory.dmp

memory/3016-135-0x0000000004D50000-0x0000000004DEC000-memory.dmp

memory/3016-136-0x0000000004C70000-0x0000000004C7A000-memory.dmp

memory/4260-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp58DE.tmp

MD5 c6f64c3b01b86dfd519e79579ba61828
SHA1 5d7ba3c1f1a950331e5e00118d33004b4aa44311
SHA256 6ff05efee15a7a02109bad8beed7f41b001c7762e96849e63183930179f50c42
SHA512 7c915ea518bb8c989c6aef8c19b73538be93f6eff01ced2b617b7abf15b825281ac4200145b492ddd7648c401a5194e735e3134923d0429bf6f05098b9eb96ec

memory/1632-139-0x0000000000000000-mapping.dmp

memory/3488-140-0x0000000000000000-mapping.dmp

memory/3488-141-0x0000000000400000-0x0000000000438000-memory.dmp