Malware Analysis Report

2025-08-05 14:34

Sample ID 221126-2y484sfa5s
Target 7af3f74a9b98a1c79a73d32c9d63ddb4ba8ae48f707d33547cdebb8b99014a8f
SHA256 7af3f74a9b98a1c79a73d32c9d63ddb4ba8ae48f707d33547cdebb8b99014a8f
Tags
nanocore keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7af3f74a9b98a1c79a73d32c9d63ddb4ba8ae48f707d33547cdebb8b99014a8f

Threat Level: Known bad

The file 7af3f74a9b98a1c79a73d32c9d63ddb4ba8ae48f707d33547cdebb8b99014a8f was found to be: Known bad.

Malicious Activity Summary

nanocore keylogger persistence spyware stealer trojan

Modifies WinLogon for persistence

NanoCore

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-26 23:00

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-26 23:00

Reported

2022-11-27 16:42

Platform

win7-20221111-en

Max time kernel

240s

Max time network

336s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\x4c6lpG5\\MGDvRNf.exe,explorer.exe" C:\Windows\SysWOW64\reg.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 520 set thread context of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A
File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 520 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 520 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 520 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 520 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 572 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 572 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 572 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 572 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 520 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Processes

C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe

"C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe,explorer.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe,explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 informer.ddns.net udp

Files

memory/520-54-0x0000000076D71000-0x0000000076D73000-memory.dmp

memory/520-55-0x0000000074D50000-0x00000000752FB000-memory.dmp

memory/520-56-0x0000000074D50000-0x00000000752FB000-memory.dmp

\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe

MD5 9deae9ea695e8e5fdab35294f848e6b2
SHA1 73314c20de4b46a6ddb5c9b224e22c1c20ef0183
SHA256 38e14f1ab8dab71a76cbbc260d5c43d41023f2b23e8955f29dc81213454660f2
SHA512 89b70646c7789b81c029829a47888b93af8033b92665104e0513446b4ca08fb3e04579480a5d00ef50817104742ff747b20c0b03f9ab82d6c8cf5738bf369d76

memory/572-58-0x0000000000000000-mapping.dmp

memory/1788-59-0x0000000000000000-mapping.dmp

memory/1440-60-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1440-61-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1440-64-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1440-63-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1440-67-0x000000000041D8D6-mapping.dmp

memory/1440-66-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1440-69-0x0000000000400000-0x0000000000436000-memory.dmp

memory/1440-71-0x0000000000400000-0x0000000000436000-memory.dmp

memory/520-73-0x0000000074D50000-0x00000000752FB000-memory.dmp

memory/1440-74-0x0000000074D50000-0x00000000752FB000-memory.dmp

memory/1440-75-0x0000000074D50000-0x00000000752FB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-26 23:00

Reported

2022-11-27 16:40

Platform

win10v2004-20221111-en

Max time kernel

149s

Max time network

205s

Command Line

"C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\x4c6lpG5\\MGDvRNf.exe,explorer.exe" C:\Windows\SysWOW64\reg.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Manager = "C:\\Program Files (x86)\\DSL Manager\\dslmgr.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4600 set thread context of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\DSL Manager\dslmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A
File opened for modification C:\Program Files (x86)\DSL Manager\dslmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4600 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\SysWOW64\cmd.exe
PID 3716 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3716 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3716 wrote to memory of 4424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
PID 4600 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Processes

C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe

"C:\Users\Admin\AppData\Local\Temp\IMG_88967569.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe,explorer.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\x4c6lpG5\MGDvRNf.exe,explorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"

Network

Country Destination Domain Proto
N/A 20.42.65.84:443 tcp
N/A 178.79.208.1:80 tcp
N/A 178.79.208.1:80 tcp
N/A 8.8.8.8:53 226.101.242.52.in-addr.arpa udp
N/A 8.8.8.8:53 informer.ddns.net udp

Files

memory/4600-132-0x0000000074E50000-0x0000000075401000-memory.dmp

memory/4600-133-0x0000000074E50000-0x0000000075401000-memory.dmp

memory/3716-134-0x0000000000000000-mapping.dmp

memory/4424-135-0x0000000000000000-mapping.dmp

memory/4008-136-0x0000000000000000-mapping.dmp

memory/4008-137-0x0000000000400000-0x0000000000436000-memory.dmp

memory/4600-138-0x0000000074E50000-0x0000000075401000-memory.dmp

memory/4008-139-0x0000000074E50000-0x0000000075401000-memory.dmp

memory/4008-140-0x0000000074E50000-0x0000000075401000-memory.dmp