Malware Analysis Report

2024-08-06 15:23

Sample ID 240518-lb5y5adc56
Target 62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe
SHA256 62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83
Tags
nanocore execution keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83

Threat Level: Known bad

The file 62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe was found to be: Known bad.

Malicious Activity Summary

nanocore execution keylogger persistence spyware stealer trojan

NanoCore

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-18 09:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 09:22

Reported

2024-05-18 09:25

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Monitor = "C:\\Program Files (x86)\\LAN Monitor\\lanmon.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4480 set thread context of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\LAN Monitor\lanmon.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Program Files (x86)\LAN Monitor\lanmon.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 4480 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 4480 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4480 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2128 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2128 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2128 wrote to memory of 2952 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2128 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2128 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2128 wrote to memory of 2592 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe

"C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aJDyPjUKcXvqr.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aJDyPjUKcXvqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB779.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBAF3.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "LAN Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpBC8A.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 26.69.169.192.in-addr.arpa udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 december2nd.ddns.net udp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.178:443 www.bing.com tcp
BE 88.221.83.178:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 178.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 december2nd.ddns.net udp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

memory/4480-0-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

memory/4480-1-0x00000000007E0000-0x0000000000894000-memory.dmp

memory/4480-2-0x00000000058F0000-0x0000000005E94000-memory.dmp

memory/4480-3-0x0000000005340000-0x00000000053D2000-memory.dmp

memory/4480-4-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

memory/4480-5-0x0000000005290000-0x000000000529A000-memory.dmp

memory/4480-6-0x00000000058C0000-0x00000000058E2000-memory.dmp

memory/4480-7-0x00000000058E0000-0x00000000058EC000-memory.dmp

memory/4480-8-0x0000000002C60000-0x0000000002C70000-memory.dmp

memory/4480-9-0x000000000D2C0000-0x000000000D33C000-memory.dmp

memory/4480-10-0x0000000010AA0000-0x0000000010B3C000-memory.dmp

memory/4464-15-0x0000000004C70000-0x0000000004CA6000-memory.dmp

memory/4464-16-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

memory/4480-17-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

memory/4464-18-0x0000000005320000-0x0000000005948000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB779.tmp

MD5 77580ac48611ba539feacf7422dec739
SHA1 6e4c803311421bb945580b0a449e58dbafa5a1c5
SHA256 72a501e00367894577e7a389cf03c2e658d76d2126d64570cf8aefa0662abb23
SHA512 b9c657d8aa9d0a936f0d31757fb248bd66b6d3bd68dc6a4719fbf8295f7ec0f99f2093317bf4e612da07684557aafa8069fc94e725e172864821ab2ce000a836

memory/4464-21-0x0000000005280000-0x00000000052A2000-memory.dmp

memory/4464-23-0x0000000005BF0000-0x0000000005C56000-memory.dmp

memory/4464-22-0x0000000005A50000-0x0000000005AB6000-memory.dmp

memory/5056-20-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

memory/2128-24-0x0000000000400000-0x000000000043A000-memory.dmp

memory/4464-30-0x0000000005C60000-0x0000000005FB4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m4lcyr41.jww.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4464-45-0x0000000006230000-0x000000000624E000-memory.dmp

memory/4464-46-0x0000000006250000-0x000000000629C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpBAF3.tmp

MD5 8cad1b41587ced0f1e74396794f31d58
SHA1 11054bf74fcf5e8e412768035e4dae43aa7b710f
SHA256 3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c
SHA512 99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef

C:\Users\Admin\AppData\Local\Temp\tmpBC8A.tmp

MD5 ecf141ec69adbb2a5c3dd5c85cd0ec39
SHA1 0ad224632fa58d103142c05c44a142f3d7208291
SHA256 64d8cfa0b25afee269839cd5fc0b66e5643bc318e5f4d3ce1b9dba2456c83316
SHA512 4821b062d6672f3ed07833cfd7ab9abb533850b451b632d781fbfad8238fcd5ac52855f1f239547ae2d1c1477959f022430302a75cfd3c19a8473af72a1ef201

memory/2128-54-0x00000000058A0000-0x00000000058AA000-memory.dmp

memory/2128-57-0x0000000005A80000-0x0000000005A8A000-memory.dmp

memory/2128-56-0x00000000059E0000-0x00000000059FE000-memory.dmp

memory/2128-55-0x00000000058B0000-0x00000000058BC000-memory.dmp

memory/5056-59-0x00000000751E0000-0x000000007522C000-memory.dmp

memory/5056-58-0x0000000007480000-0x00000000074B2000-memory.dmp

memory/5056-69-0x00000000076E0000-0x00000000076FE000-memory.dmp

memory/5056-71-0x0000000007700000-0x00000000077A3000-memory.dmp

memory/4464-70-0x00000000751E0000-0x000000007522C000-memory.dmp

memory/5056-81-0x0000000007E70000-0x00000000084EA000-memory.dmp

memory/5056-82-0x0000000007830000-0x000000000784A000-memory.dmp

memory/4464-83-0x00000000075E0000-0x00000000075EA000-memory.dmp

memory/4464-84-0x00000000077F0000-0x0000000007886000-memory.dmp

memory/4464-85-0x0000000007770000-0x0000000007781000-memory.dmp

memory/5056-86-0x0000000007A60000-0x0000000007A6E000-memory.dmp

memory/4464-87-0x00000000077B0000-0x00000000077C4000-memory.dmp

memory/4464-88-0x00000000078B0000-0x00000000078CA000-memory.dmp

memory/5056-89-0x0000000007B50000-0x0000000007B58000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1a5ff9597c4836920f8212b2fc8271b8
SHA1 6d72a9f5d6f32192a366d5effffc8f4aad70b7f1
SHA256 259beb6e2769ca0787e3264a3810cdaa70f1fab1f8090ba1191d20b950450bc5
SHA512 f2ad65b45b74ef8b8ba19d4b2576c320d472ff750fe7721b571dd49489ebf888a8613981d398fcb281a79183c2fe270e9bc38ff64afcdd9f07cd01fa73886a14

memory/4464-94-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

memory/5056-95-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 09:22

Reported

2024-05-18 09:25

Platform

win7-20240220-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Subsystem = "C:\\Program Files (x86)\\TCP Subsystem\\tcpss.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1120 set thread context of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\TCP Subsystem\tcpss.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Program Files (x86)\TCP Subsystem\tcpss.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1120 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 1120 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 1120 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 1120 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\SysWOW64\schtasks.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2468 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe

"C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aJDyPjUKcXvqr.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aJDyPjUKcXvqr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CEF.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5EC3.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "TCP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5F6F.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 december2nd.ddns.net udp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 192.169.69.26:65140 december2n.duckdns.org tcp
US 8.8.8.8:53 december2nd.ddns.net udp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
NL 94.156.66.54:65140 december2nd.ddns.net tcp
US 8.8.8.8:53 december2n.duckdns.org udp
US 192.169.69.26:65140 december2n.duckdns.org tcp

Files

memory/1120-0-0x00000000742DE000-0x00000000742DF000-memory.dmp

memory/1120-1-0x0000000000CD0000-0x0000000000D84000-memory.dmp

memory/1120-2-0x00000000742D0000-0x00000000749BE000-memory.dmp

memory/1120-3-0x0000000000590000-0x00000000005B2000-memory.dmp

memory/1120-4-0x00000000003C0000-0x00000000003CC000-memory.dmp

memory/1120-5-0x00000000004B0000-0x00000000004C0000-memory.dmp

memory/1120-6-0x000000000D570000-0x000000000D5EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5CEF.tmp

MD5 e45f7b24f0501f10a6b8ac1d469db035
SHA1 3eb232cc0041fede597e5b47498da1ea2a154446
SHA256 677b0cc4b17aa2cfb093d32b831fe048a62f515f7e28a36ddd863f29cf931d86
SHA512 baf996158b4f849efda2bb894f3b43f8985597ae3686671e5d485948eac8334bb252fe79596fd0a4159091f78c5d20e880e6fc77d75a720766c44440f288cf67

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 4fca6dbcf079e5d4d22e3e723a4cd340
SHA1 d2311712c7b045ff408a93c986a9054e0a3b2fc7
SHA256 5e674fb8a80c5e71d07fa1703c34f9f4ca90267c9900711f42efb3099334aff4
SHA512 c12aaeb2dacd833cf83da6246e2f2c9b8ae721e3fc86817de45e1a9ff8f76362462f9e3cb687291381158135e8afe111145a6b2d6d516185eca5551aa7537ff9

memory/2468-19-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2468-30-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2468-29-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2468-28-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2468-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2468-23-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2468-21-0x0000000000400000-0x000000000043A000-memory.dmp

memory/2468-25-0x0000000000400000-0x000000000043A000-memory.dmp

memory/1120-31-0x00000000742D0000-0x00000000749BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5EC3.tmp

MD5 8cad1b41587ced0f1e74396794f31d58
SHA1 11054bf74fcf5e8e412768035e4dae43aa7b710f
SHA256 3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c
SHA512 99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef

C:\Users\Admin\AppData\Local\Temp\tmp5F6F.tmp

MD5 4b7ef560289c0f62d0baf6f14f48a57a
SHA1 8331acb90dde588aa3196919f6e847f398fd06d1
SHA256 062844155306130d6fafc4fe10ac9e5ddd2ed462532b729c50cdc979c0d83207
SHA512 ecaa27c4b703d95f9f9b37d8c339982970482e7dab968c2010e0aa644bbfa31973111aafb827565af30c423d1d14e4ff997ec149614e713ff7ef3456894d02d8

memory/2468-39-0x0000000000920000-0x000000000092A000-memory.dmp

memory/2468-40-0x0000000000A20000-0x0000000000A2C000-memory.dmp

memory/2468-41-0x0000000000A30000-0x0000000000A4E000-memory.dmp

memory/2468-42-0x0000000000A50000-0x0000000000A5A000-memory.dmp