Malware Analysis Report

2025-04-13 20:47

Sample ID 250125-w4s55svpdt
Target 05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe
SHA256 05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38d
Tags
nanocore defense_evasion discovery keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38d

Threat Level: Known bad

The file 05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe was found to be: Known bad.

Malicious Activity Summary

nanocore defense_evasion discovery keylogger persistence spyware stealer trojan

Nanocore family

NanoCore

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-25 18:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-25 18:28

Reported

2025-01-25 18:30

Platform

win7-20240903-en

Max time kernel

119s

Max time network

26s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2864 set thread context of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2128 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 2864 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Processes

C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe

"C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sysupdate24.ddns.net udp

Files

memory/2128-0-0x00000000746C1000-0x00000000746C2000-memory.dmp

memory/2128-1-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2128-2-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2128-3-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2128-4-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2128-5-0x00000000746C0000-0x0000000074C6B000-memory.dmp

\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 c049bbcf6ee3e2a2d36713099c7584c5
SHA1 7e13b774b6a0e22a83daa37e30c9509971d935d9
SHA256 09630fab1348bdc149182c433bfd78409e9c8d6abe389873d0a665aa16b1758a
SHA512 7ca133475fa7250ef71633b07b94dd80eb413ce6450f452ce89b2f739d18688466f15231852f88715500bbf1894e74f7ae821947617912d0ab26604ff67b1739

memory/2864-15-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2128-14-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2864-16-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2864-17-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2864-18-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2864-19-0x00000000746C0000-0x0000000074C6B000-memory.dmp

memory/2628-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2628-21-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2628-31-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2628-37-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2628-39-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2628-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2628-28-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2628-25-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2864-41-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-25 18:28

Reported

2025-01-25 18:30

Platform

win10v2004-20241007-en

Max time kernel

116s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3000 set thread context of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3496 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3496 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3496 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
PID 3000 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Processes

C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe

"C:\Users\Admin\AppData\Local\Temp\05e4da2036e45d49b716262f7e55d1e15b1a26bbd6a6f29181be3ce206a8d38dN.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 5.114.82.104.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 sysupdate24.ddns.net udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 167.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/3496-0-0x0000000074FB2000-0x0000000074FB3000-memory.dmp

memory/3496-1-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3496-2-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3496-3-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3496-4-0x0000000074FB2000-0x0000000074FB3000-memory.dmp

memory/3496-5-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3496-6-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3496-7-0x0000000074FB0000-0x0000000075561000-memory.dmp

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

MD5 d359ea4cd20ebcecb9e46a3ad443b574
SHA1 c9cec4f2b41122e3b50f65462ce96bd312cc8ae2
SHA256 1b5b5d48f31611b8a8f86c66d54c0d46e41da3c475ef9f6abafd61fe388d4e42
SHA512 b432b0be2135b7f060ec1f08dbc09b299d36a1f94084b689edb7894e89f1305b6e59a39df60182d0d52eeb1a0152146faa1d471d35a979e3a22f0909b49d1c84

memory/3000-21-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3000-23-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3496-22-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3000-24-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3000-25-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3000-26-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3000-27-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/4544-28-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4544-29-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4544-30-0x0000000000400000-0x0000000000438000-memory.dmp

memory/4544-33-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/4544-34-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/4544-36-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/4544-37-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/3000-39-0x0000000074FB0000-0x0000000075561000-memory.dmp

memory/4544-40-0x0000000074FB0000-0x0000000075561000-memory.dmp