Malware Analysis Report

2024-11-30 21:51

Sample ID 230205-z1kw5sah45
Target bbe4ba566d229a405da3af72193d297f.exe
SHA256 aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107
Tags
nanocore purecrypter downloader evasion keylogger loader persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107

Threat Level: Known bad

The file bbe4ba566d229a405da3af72193d297f.exe was found to be: Known bad.

Malicious Activity Summary

nanocore purecrypter downloader evasion keylogger loader persistence spyware stealer trojan

NanoCore

Modifies WinLogon for persistence

PureCrypter

Detect PureCrypter injector

Checks computer location settings

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-05 21:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-05 21:11

Reported

2023-02-05 21:13

Platform

win7-20221111-en

Max time kernel

59s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe"

Signatures

Detect PureCrypter injector

loader
Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player.exe\"," C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

PureCrypter

loader downloader purecrypter

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2032 set thread context of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 2032 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

"C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 rcontrol4sec.ddnsgeek.com udp
FR 185.81.157.236:5080 rcontrol4sec.ddnsgeek.com tcp

Files

memory/2032-54-0x0000000000CF0000-0x0000000000E40000-memory.dmp

memory/2032-55-0x0000000004D30000-0x0000000004FB2000-memory.dmp

memory/2032-56-0x00000000767B1000-0x00000000767B3000-memory.dmp

memory/1500-57-0x0000000000000000-mapping.dmp

memory/1500-59-0x0000000070010000-0x00000000705BB000-memory.dmp

memory/1500-60-0x0000000070010000-0x00000000705BB000-memory.dmp

memory/1500-61-0x0000000070010000-0x00000000705BB000-memory.dmp

memory/2032-62-0x00000000045E0000-0x0000000004646000-memory.dmp

memory/904-63-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-64-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-66-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-67-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-69-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-70-0x000000000041E792-mapping.dmp

memory/904-72-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-74-0x0000000000400000-0x0000000000438000-memory.dmp

memory/904-76-0x0000000000650000-0x000000000065A000-memory.dmp

memory/904-77-0x0000000000660000-0x000000000067E000-memory.dmp

memory/904-78-0x0000000000680000-0x000000000068A000-memory.dmp

memory/904-79-0x0000000000B00000-0x0000000000B12000-memory.dmp

memory/904-80-0x0000000000B50000-0x0000000000B6A000-memory.dmp

memory/904-81-0x0000000000B80000-0x0000000000B8E000-memory.dmp

memory/904-82-0x0000000000CE0000-0x0000000000CF2000-memory.dmp

memory/904-83-0x0000000004820000-0x000000000482E000-memory.dmp

memory/904-84-0x0000000004830000-0x000000000483C000-memory.dmp

memory/904-85-0x0000000004840000-0x0000000004854000-memory.dmp

memory/904-86-0x0000000004B70000-0x0000000004B7C000-memory.dmp

memory/904-87-0x0000000004B80000-0x0000000004B90000-memory.dmp

memory/904-88-0x0000000004B90000-0x0000000004BA4000-memory.dmp

memory/904-89-0x0000000004BB0000-0x0000000004BBE000-memory.dmp

memory/904-90-0x0000000004CD0000-0x0000000004CFE000-memory.dmp

memory/904-91-0x0000000004D00000-0x0000000004D14000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-05 21:11

Reported

2023-02-05 21:13

Platform

win10v2004-20221111-en

Max time kernel

91s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player.exe\"," C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4736 set thread context of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4736 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4736 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4736 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe
PID 4736 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

"C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==

C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

C:\Users\Admin\AppData\Local\Temp\bbe4ba566d229a405da3af72193d297f.exe

Network

Country Destination Domain Proto
NL 88.221.25.154:80 tcp
NL 104.80.225.205:443 tcp
US 8.8.8.8:53 rcontrol4sec.ddnsgeek.com udp
FR 185.81.157.236:5080 rcontrol4sec.ddnsgeek.com tcp
NL 52.178.17.3:443 tcp
NL 87.248.202.1:80 tcp
NL 87.248.202.1:80 tcp
US 209.197.3.8:80 tcp

Files

memory/4736-132-0x00000000009B0000-0x0000000000B00000-memory.dmp

memory/4736-133-0x0000000005890000-0x00000000058B2000-memory.dmp

memory/1028-134-0x0000000000000000-mapping.dmp

memory/1028-135-0x0000000004EE0000-0x0000000004F16000-memory.dmp

memory/1028-136-0x0000000005590000-0x0000000005BB8000-memory.dmp

memory/1028-137-0x0000000005C30000-0x0000000005C96000-memory.dmp

memory/1028-138-0x0000000005E90000-0x0000000005EF6000-memory.dmp

memory/1028-139-0x00000000064B0000-0x00000000064CE000-memory.dmp

memory/1028-140-0x0000000007CF0000-0x000000000836A000-memory.dmp

memory/1028-141-0x00000000069B0000-0x00000000069CA000-memory.dmp

memory/4928-142-0x0000000000000000-mapping.dmp

memory/4928-143-0x0000000000400000-0x0000000000438000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bbe4ba566d229a405da3af72193d297f.exe.log

MD5 a713c363be116d5ed1f971db6a657e4f
SHA1 90791863564c9ed38e7b4f047022dec4474060a1
SHA256 4b5c446ec8ed2a2696ba00a0890763d413006ce1ea1a7a32fda1655720aef46e
SHA512 5dc740414a6ec30908e924f3bdfae2f761a35a476ef2dda239b789575a0a3696169deb6dc84a14d5828eaa5644623f107b2c686bfa4f54a90f0688239b4b1739

memory/4928-145-0x00000000059C0000-0x0000000005F64000-memory.dmp

memory/4928-146-0x00000000054B0000-0x0000000005542000-memory.dmp

memory/4928-147-0x0000000005550000-0x00000000055EC000-memory.dmp

memory/4928-148-0x0000000005490000-0x000000000549A000-memory.dmp