Malware Analysis Report

2024-10-23 19:38

Sample ID 240812-bfa97ssdmf
Target adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
SHA256 adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5
Tags
nanocore discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5

Threat Level: Known bad

The file adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5 was found to be: Known bad.

Malicious Activity Summary

nanocore discovery evasion keylogger persistence spyware stealer trojan

NanoCore

Nanocore family

Checks whether UAC is enabled

Adds Run key to start application

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-12 01:04

Signatures

Nanocore family

nanocore

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-12 01:04

Reported

2024-08-12 01:07

Platform

win7-20240704-en

Max time kernel

144s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\ARP Host\arphost.exe C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A
File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe

"C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAF62.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp"

Network

Country Destination Domain Proto
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp

Files

memory/2384-0-0x0000000074B51000-0x0000000074B52000-memory.dmp

memory/2384-1-0x0000000074B50000-0x00000000750FB000-memory.dmp

memory/2384-2-0x0000000074B50000-0x00000000750FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpAF62.tmp

MD5 6fc47cb8fdf5fef86008857843213de7
SHA1 5d445584d5fb94a7882b1aac3fe83ac73d5a559d
SHA256 86cec4e3fd86ad39364336d9e210911e5a84011acd68d25e7c93cbba02a2e285
SHA512 d88269a6f995fcce4a8a5949cf0e53f27187eedff5234b4d9178232d88bfe3f86e376320726aea130914a5235f37ce931ffd82803ce8969dac62d396d75bd56e

C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp

MD5 447ab194ab36cb1d20078d80e502b1b2
SHA1 a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0
SHA256 8d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5
SHA512 49ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327

memory/2384-10-0x0000000074B50000-0x00000000750FB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-12 01:04

Reported

2024-08-12 01:07

Platform

win10v2004-20240802-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNS Manager = "C:\\Program Files (x86)\\DNS Manager\\dnsmgr.exe" C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\DNS Manager\dnsmgr.exe C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A
File created C:\Program Files (x86)\DNS Manager\dnsmgr.exe C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe

"C:\Users\Admin\AppData\Local\Temp\adb4e3ed6f26e81b77bfb28cf4ab4707b7047f4a432e582aa6875e686fbe48d5.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DNS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB8C1.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "DNS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB91F.tmp"

Network

Country Destination Domain Proto
N/A 10.0.0.21:49356 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
N/A 10.0.0.21:49356 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
N/A 10.0.0.21:49356 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp
N/A 10.0.0.21:49356 tcp

Files

memory/3608-0-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

memory/3608-1-0x0000000074EA0000-0x0000000075451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB8C1.tmp

MD5 6fc47cb8fdf5fef86008857843213de7
SHA1 5d445584d5fb94a7882b1aac3fe83ac73d5a559d
SHA256 86cec4e3fd86ad39364336d9e210911e5a84011acd68d25e7c93cbba02a2e285
SHA512 d88269a6f995fcce4a8a5949cf0e53f27187eedff5234b4d9178232d88bfe3f86e376320726aea130914a5235f37ce931ffd82803ce8969dac62d396d75bd56e

C:\Users\Admin\AppData\Local\Temp\tmpB91F.tmp

MD5 bf0287a4e4ec6b543e5f2c020d4f88b2
SHA1 da151b3e3f382ec107053e487b08035616db2694
SHA256 ef704c92466ea7f43c33880380c3fbc8bee8d8ce7a041abefb23fd610baff13c
SHA512 94c9b8f53120a0024031996a91ee54de0a791e49e45a9e2c6e56c51a363b3b3cac206f19b84861a21054bcd3ee8031ab684596502a126fea47352474a4ecd8be

memory/3608-9-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/3608-10-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/3608-11-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

memory/3608-12-0x0000000074EA0000-0x0000000075451000-memory.dmp

memory/3608-13-0x0000000074EA0000-0x0000000075451000-memory.dmp