Malware Analysis Report

2024-10-19 07:05

Sample ID 240805-hbpqcsyfrj
Target klar_tool.exe
SHA256 1e31133a1333a697922f742d1a4c11ee8c20583bbdfd2f65030787a940a3e877
Tags
nanocore evasion keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e31133a1333a697922f742d1a4c11ee8c20583bbdfd2f65030787a940a3e877

Threat Level: Known bad

The file klar_tool.exe was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger spyware stealer trojan

NanoCore

Checks whether UAC is enabled

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-05 06:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-05 06:33

Reported

2024-08-05 06:34

Platform

win10-20240404-en

Max time kernel

25s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\klar_tool.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\klar_tool.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\klar_tool.exe

"C:\Users\Admin\AppData\Local\Temp\klar_tool.exe"

Network

Country Destination Domain Proto
N/A 127.0.0.1:9033 tcp
N/A 127.0.0.1:9033 tcp
N/A 127.0.0.1:9033 tcp
N/A 127.0.0.1:9033 tcp
N/A 127.0.0.1:9033 tcp
N/A 127.0.0.1:9033 tcp

Files

memory/3608-0-0x00007FF8BC563000-0x00007FF8BC564000-memory.dmp

memory/3608-1-0x0000024C90F30000-0x0000024C90F92000-memory.dmp

memory/3608-2-0x0000024C92B10000-0x0000024C92BA0000-memory.dmp

memory/3608-4-0x00007FF8BC560000-0x00007FF8BCF4C000-memory.dmp

memory/3608-5-0x00007FF8BC563000-0x00007FF8BC564000-memory.dmp

memory/3608-6-0x00007FF8BC560000-0x00007FF8BCF4C000-memory.dmp