Malware Analysis Report

2024-10-23 19:38

Sample ID 240813-fda9mszdkq
Target 18d51054a11a6a436044fe91168fe600N.exe
SHA256 adc307aba3a4eb1b0ddc7658189944de7a3072dd5375c2db9ef7ed89394df328
Tags
nanocore discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

adc307aba3a4eb1b0ddc7658189944de7a3072dd5375c2db9ef7ed89394df328

Threat Level: Known bad

The file 18d51054a11a6a436044fe91168fe600N.exe was found to be: Known bad.

Malicious Activity Summary

nanocore discovery evasion keylogger persistence spyware stealer trojan

NanoCore

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-13 04:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-13 04:44

Reported

2024-08-13 04:46

Platform

win7-20240704-en

Max time kernel

118s

Max time network

27s

Command Line

"C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2816 set thread context of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 1448 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2816 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Processes

C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe

"C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sysupdate24.ddns.net udp

Files

memory/1448-0-0x00000000747D1000-0x00000000747D2000-memory.dmp

memory/1448-1-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/1448-2-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/1448-3-0x00000000747D0000-0x0000000074D7B000-memory.dmp

\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 e46e57b08c77dc52fc1b7053555bbbf1
SHA1 eb6fdc2723c106fb0e109ccb6ba44e379a7888c7
SHA256 e5d5001a484f5f18b4fe65bb3d80fd6cea18648a4f53266deaa5adf6e3f15de5
SHA512 fa4d6ec1b56b74d9306d4d41bfa8664091ee3cb03760f0e24e540f83ab52111fc05a8282846469d7b89918cc52cc420fa23945dbeaa8ca14e73883cd9885f7ac

memory/2816-13-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/1448-12-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/2816-14-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/2816-15-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/2604-17-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2604-35-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2604-33-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2604-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2604-27-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2604-24-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2604-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2604-19-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2816-37-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/2816-38-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-13 04:44

Reported

2024-08-13 04:46

Platform

win10v2004-20240802-en

Max time kernel

98s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe

"C:\Users\Admin\AppData\Local\Temp\18d51054a11a6a436044fe91168fe600N.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/2812-0-0x0000000075332000-0x0000000075333000-memory.dmp

memory/2812-1-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/2812-2-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/2812-3-0x0000000075330000-0x00000000758E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 379c5358547403b71a149391df0f050d
SHA1 923eed40910b82286e6cbd5ab4f9553b41d585ef
SHA256 a976bdc54626a7d0af3c7429c4e2210326714ed12d5cc9fe259eb5dce88193bf
SHA512 06abd358bbf233aa008d4f67de4e1772257971dc45b04bc8aefd2fb259b24029737594c9c7dab428234acd70c816658bcb81c45a1408afb4dfa1c37c6194265c

memory/2812-17-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3100-18-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3100-19-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3100-20-0x0000000075330000-0x00000000758E1000-memory.dmp

memory/3100-22-0x0000000075330000-0x00000000758E1000-memory.dmp