Malware Analysis Report

2025-08-05 14:34

Sample ID 221127-aa131aed48
Target 1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062
SHA256 1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062
Tags
upx nanocore keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062

Threat Level: Known bad

The file 1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062 was found to be: Known bad.

Malicious Activity Summary

upx nanocore keylogger persistence spyware stealer trojan

NanoCore

UPX packed file

Checks computer location settings

Uses the VBS compiler for execution

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in Program Files directory

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-27 00:01

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-27 00:01

Reported

2022-11-27 17:40

Platform

win7-20221111-en

Max time kernel

190s

Max time network

207s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Manager = "C:\\Program Files (x86)\\ISS Manager\\issmgr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1768 set thread context of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\ISS Manager\issmgr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
File opened for modification C:\Program Files (x86)\ISS Manager\issmgr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 960 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 960 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 960 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 960 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1768 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"

C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" "1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 moftsvs.ig42.org udp
N/A 8.8.4.4:53 moftsvs.ig42.org udp
N/A 8.8.8.8:53 moftsvs.ig42.org udp
N/A 8.8.8.8:53 moftsvs.ig42.org udp
N/A 8.8.4.4:53 moftsvs.ig42.org udp
N/A 8.8.8.8:53 moftsvs.ig42.org udp
N/A 8.8.4.4:53 moftsvs.ig42.org udp
N/A 212.7.192.242:9045 tcp
N/A 212.7.192.242:9045 tcp
N/A 212.7.192.242:9045 tcp

Files

memory/960-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

memory/960-55-0x0000000000040000-0x00000000001A5000-memory.dmp

memory/960-56-0x0000000003E70000-0x0000000003FD5000-memory.dmp

memory/1768-57-0x0000000000000000-mapping.dmp

memory/960-59-0x0000000000040000-0x00000000001A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lf2

MD5 be7a4ea468b142994adae5c442dfdd06
SHA1 606fb007510259993f4726a8d0b1f41fa1de23d9
SHA256 d399db8ae87b1d97732184cd2bbf67d745c4146cf8d6d33e26bedcfd53384064
SHA512 c55609f24408106a2e171cd7f691eeecb81b99be6023bdec672e578bf5bfc5ca787d94d9a5affff98a0c996771ba5da5d53d4b499240571b957a90c0e3059511

C:\Users\Admin\AppData\Local\Temp\ger

MD5 62cddffde88715a338548dbfa47b555c
SHA1 17d9eed664beee32f9fa62d61daaaac931885e51
SHA256 06538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
SHA512 0fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442

memory/844-63-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-65-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-62-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-66-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-68-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-69-0x000000000041E792-mapping.dmp

memory/1768-71-0x0000000000040000-0x00000000001A5000-memory.dmp

memory/844-72-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-74-0x0000000000400000-0x0000000000438000-memory.dmp

memory/844-76-0x0000000000350000-0x000000000035A000-memory.dmp

memory/844-77-0x0000000000360000-0x000000000037E000-memory.dmp

memory/844-78-0x00000000003C0000-0x00000000003CA000-memory.dmp

memory/844-79-0x0000000005055000-0x0000000005066000-memory.dmp

memory/844-80-0x0000000005055000-0x0000000005066000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-27 00:01

Reported

2022-11-27 17:38

Platform

win10v2004-20220901-en

Max time kernel

112s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4304 set thread context of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4252 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 4252 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 4252 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4304 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"

C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe

"C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe" "1b7ba0a5a26b2a0fe9d98fdddb8e2be089bd502daceaece542b91848e75d1062.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3968 -ip 3968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 12

Network

Country Destination Domain Proto
N/A 2.18.109.224:443 tcp
N/A 20.50.80.209:443 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp

Files

memory/4252-132-0x0000000000CE0000-0x0000000000E45000-memory.dmp

memory/4304-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\lf2

MD5 be7a4ea468b142994adae5c442dfdd06
SHA1 606fb007510259993f4726a8d0b1f41fa1de23d9
SHA256 d399db8ae87b1d97732184cd2bbf67d745c4146cf8d6d33e26bedcfd53384064
SHA512 c55609f24408106a2e171cd7f691eeecb81b99be6023bdec672e578bf5bfc5ca787d94d9a5affff98a0c996771ba5da5d53d4b499240571b957a90c0e3059511

memory/4252-135-0x0000000000CE0000-0x0000000000E45000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ger

MD5 62cddffde88715a338548dbfa47b555c
SHA1 17d9eed664beee32f9fa62d61daaaac931885e51
SHA256 06538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
SHA512 0fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442

memory/3968-137-0x0000000000000000-mapping.dmp

memory/3968-138-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4304-139-0x0000000000CE0000-0x0000000000E45000-memory.dmp