Malware Analysis Report

2024-10-19 07:05

Sample ID 240805-azydeavgqf
Target 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8
SHA256 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8
Tags
nanocore discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8

Threat Level: Known bad

The file 98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8 was found to be: Known bad.

Malicious Activity Summary

nanocore discovery evasion keylogger persistence spyware stealer trojan

NanoCore

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-05 00:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-05 00:39

Reported

2024-08-05 00:42

Platform

win7-20240704-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2468 set thread context of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2468 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Processes

C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe

"C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sysupdate24.ddns.net udp

Files

memory/2120-0-0x0000000074161000-0x0000000074162000-memory.dmp

memory/2120-1-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2120-2-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2120-3-0x0000000074160000-0x000000007470B000-memory.dmp

\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 49c1c8b69ccd93aabe88df99714f5701
SHA1 47bb331b05f29229f425a7cba8b2cdd4b56a0128
SHA256 ec5fdeb914f81e0b6a16b304a18c269a39bf88e6509479f2e8306c35729b09a5
SHA512 961f2968d024cd465e438ddd989d6debb7c91c241aa02b4f147e3de55f07c5f08717b155e30109fde251aec7dd4b7673996397c8f9819c26d6a5dc44bf6fe927

memory/2120-12-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2468-15-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2468-13-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2468-14-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2468-16-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2612-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2612-31-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-22-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-19-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2468-33-0x0000000074160000-0x000000007470B000-memory.dmp

memory/2468-34-0x0000000074160000-0x000000007470B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-05 00:39

Reported

2024-08-05 00:42

Platform

win10v2004-20240802-en

Max time kernel

96s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe

"C:\Users\Admin\AppData\Local\Temp\98d5e4539d010d7fcfb6aa3d8d9b117f4f03ffb743f6fe345ef2c8ff7134e8d8.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/2916-0-0x0000000075242000-0x0000000075243000-memory.dmp

memory/2916-1-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/2916-2-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/2916-3-0x0000000075240000-0x00000000757F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 a8c5bd69b68e347fb06ae90976e83173
SHA1 172faa2975b97c602a5095780aed70c5ba495054
SHA256 f4c3ce570a29ffcefb6ebea585c939822ee17e5db4273b02952a9e1d759fb219
SHA512 52b1f4fbcd687578e5093d88f35828f350f85551a570d21a77a906b78b8cd1176630772b1ce76fa8e84361c8f8678c932d30c239520882d49d2e249c6837b157

memory/3956-17-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3956-19-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/2916-18-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3956-20-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3956-22-0x0000000075240000-0x00000000757F1000-memory.dmp