Malware Analysis Report

2025-08-10 19:47

Sample ID 221114-hvaesafe29
Target 112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5
SHA256 112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5

Threat Level: Known bad

The file 112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-14 07:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-14 07:02

Reported

2022-11-14 07:05

Platform

win7-20220901-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wndndwzajse = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xhucnfxdy\\Wndndwzajse.exe\"" C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1696 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1696 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1696 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1696 wrote to memory of 1124 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 1696 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

"C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==

C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp

Files

memory/1696-54-0x0000000001100000-0x00000000012D0000-memory.dmp

memory/1696-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

memory/1696-56-0x0000000005DA0000-0x0000000005E8A000-memory.dmp

memory/1696-57-0x0000000005F70000-0x0000000006002000-memory.dmp

memory/1124-58-0x0000000000000000-mapping.dmp

memory/1124-60-0x000000006F090000-0x000000006F63B000-memory.dmp

memory/1124-61-0x000000006F090000-0x000000006F63B000-memory.dmp

memory/1124-62-0x000000006F090000-0x000000006F63B000-memory.dmp

memory/336-63-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-64-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-66-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-67-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-70-0x000000000041E792-mapping.dmp

memory/336-69-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-72-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-74-0x0000000000400000-0x0000000000438000-memory.dmp

memory/336-76-0x0000000000580000-0x000000000058A000-memory.dmp

memory/336-77-0x0000000000820000-0x000000000083E000-memory.dmp

memory/336-78-0x0000000000840000-0x000000000084A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-14 07:02

Reported

2022-11-14 07:05

Platform

win10v2004-20220812-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wndndwzajse = "\"C:\\Users\\Admin\\AppData\\Roaming\\Xhucnfxdy\\Wndndwzajse.exe\"" C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4152 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4152 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4152 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe
PID 4152 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

"C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==

C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

C:\Users\Admin\AppData\Local\Temp\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe

Network

Country Destination Domain Proto
N/A 93.184.220.29:80 tcp
N/A 93.184.220.29:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 104.80.225.205:443 tcp
N/A 8.8.8.8:53 106.89.54.20.in-addr.arpa udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 93.184.221.240:80 tcp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp
N/A 8.8.8.8:53 rze6.sytes.net udp

Files

memory/4152-132-0x0000000000FD0000-0x00000000011A0000-memory.dmp

memory/4152-133-0x0000000006000000-0x00000000065A4000-memory.dmp

memory/4152-134-0x0000000005B30000-0x0000000005BC2000-memory.dmp

memory/4152-135-0x0000000005BF0000-0x0000000005BFA000-memory.dmp

memory/4152-136-0x0000000008510000-0x0000000008532000-memory.dmp

memory/920-137-0x0000000000000000-mapping.dmp

memory/920-138-0x0000000004DD0000-0x0000000004E06000-memory.dmp

memory/920-139-0x0000000005470000-0x0000000005A98000-memory.dmp

memory/920-140-0x0000000005C90000-0x0000000005CF6000-memory.dmp

memory/920-141-0x0000000005D70000-0x0000000005DD6000-memory.dmp

memory/920-142-0x0000000006390000-0x00000000063AE000-memory.dmp

memory/920-143-0x0000000007C80000-0x00000000082FA000-memory.dmp

memory/920-144-0x0000000006870000-0x000000000688A000-memory.dmp

memory/408-145-0x0000000000000000-mapping.dmp

memory/408-146-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\112843e910e5bef697600933153dfc07852c3b6c5c1d1e2258da31c1c50d1fb5.exe.log

MD5 3da8c0e0973f3328da5363ce1d655b26
SHA1 12e5547ce28ac5e8b8cfea10cb228fdb207f3d6f
SHA256 1986c5a00286a7bbb272103161f960b11d47e6b67900eaa14e0160bc7d27ca94
SHA512 7a351d62d80a19a1682b54a8850afbb58819f03a7beae9b1feac7246a2d7f275e253ed40e4a9f3ecfecbca4420dae2571cf88872c8543221d490b51949e949c4

memory/408-148-0x0000000005170000-0x000000000520C000-memory.dmp