Malware Analysis Report

2024-10-19 07:05

Sample ID 240807-emlw3atgke
Target 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe
SHA256 ceac954cc8a5912ee568c933fdf0c862abfa80a0638a6f1541ac3c4b691f8e92
Tags
discovery persistence nanocore evasion keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ceac954cc8a5912ee568c933fdf0c862abfa80a0638a6f1541ac3c4b691f8e92

Threat Level: Known bad

The file 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe was found to be: Known bad.

Malicious Activity Summary

discovery persistence nanocore evasion keylogger spyware stealer trojan

NanoCore

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-07 04:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-07 04:03

Reported

2024-08-07 04:05

Platform

win7-20240704-en

Max time kernel

38s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2120 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe

"C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

N/A

Files

memory/2120-0-0x0000000074ED1000-0x0000000074ED2000-memory.dmp

memory/2120-1-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2120-2-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2120-3-0x0000000074ED0000-0x000000007547B000-memory.dmp

\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 c209ad5dad2822f3f41d367ffbab4e0d
SHA1 878d9d369573ee1138822c39fe506a74ea516bdc
SHA256 84637f5204cbce8453fe51488103858b29be31628658272f74c3e2b24955d3c2
SHA512 6ed75185c32633333a198dcf61bd42bf1420e09c9af7f02f0651f0c448662845db6145cc0a2a7c1b5790518dcbdcbb5680a7b3e98f9ee16bb83729e7710dac68

memory/2120-12-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2740-13-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2740-14-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2740-15-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2740-16-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2740-18-0x0000000074ED0000-0x000000007547B000-memory.dmp

memory/2740-19-0x0000000074ED0000-0x000000007547B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-07 04:03

Reported

2024-08-07 04:05

Platform

win10v2004-20240802-en

Max time kernel

119s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 716 set thread context of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2952 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2952 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2952 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 716 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe

"C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 sysupdate24.ddns.net udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/2952-0-0x00000000754E2000-0x00000000754E3000-memory.dmp

memory/2952-1-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/2952-2-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/2952-3-0x00000000754E0000-0x0000000075A91000-memory.dmp

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 6aed1cd6a9b200867eb07e224370ca2b
SHA1 d630b236e3ad79e3ba2824d2cec73a780bcb0e93
SHA256 8bf34445c733c8dcfc65b38a13dc72daee33dd4675a5f2efe4dad78c5b0f48e2
SHA512 3a9ece8549c52a013341d1cc61d21a0410cc2012abf88e72cf4991de8eef3a77bcaaa79cf59265b0edce86a8031d71ef290e56717e884364eb0f28ea9daa2625

memory/716-19-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/2952-18-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/716-17-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/716-20-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/716-21-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/3600-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3600-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3600-22-0x0000000000400000-0x0000000000438000-memory.dmp

memory/3600-27-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/3600-29-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/3600-28-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/3600-31-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/716-32-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/716-34-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/3600-35-0x00000000754E0000-0x0000000075A91000-memory.dmp

memory/3600-36-0x00000000754E0000-0x0000000075A91000-memory.dmp