Malware Analysis Report

2025-04-13 20:47

Sample ID 250126-1jlmsavnas
Target 887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe
SHA256 887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2
Tags
nanocore defense_evasion discovery keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2

Threat Level: Known bad

The file 887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe was found to be: Known bad.

Malicious Activity Summary

nanocore defense_evasion discovery keylogger persistence spyware stealer trojan

NanoCore

Nanocore family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-26 21:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-26 21:40

Reported

2025-01-26 21:42

Platform

win7-20240729-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe" C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2724 set thread context of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2328 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
PID 2328 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
PID 2328 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
PID 2328 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 2724 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe

"C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe"

C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

"C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

Network

Country Destination Domain Proto
FR 178.32.224.116:46218 tcp
FR 178.32.224.116:46218 tcp
FR 178.32.224.116:46218 tcp
FR 178.32.224.116:46218 tcp
FR 178.32.224.116:46218 tcp
FR 178.32.224.116:46218 tcp

Files

memory/2328-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

memory/2328-1-0x0000000000910000-0x000000000097E000-memory.dmp

memory/2328-2-0x0000000074A00000-0x00000000750EE000-memory.dmp

memory/2328-3-0x0000000000C70000-0x0000000000CAC000-memory.dmp

\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

MD5 ec4f2f080f53fadd86918928a62dba6f
SHA1 189c4bcab1b8cac0f95c3c9fb87b37851a511ff3
SHA256 b27ae37e3ddea7b3adff48e3a03cfd462b0f0c108ec09146a3d77e82fd98e0ce
SHA512 bac5e6d4b5c83e4422d5b19ce6977c7831b871c70a4eb5fae34d6774331db21b5708da2e1a7a4f59aac75c91379f9c47ff553c5e30225350c592148127b45cca

memory/2724-12-0x0000000074A00000-0x00000000750EE000-memory.dmp

memory/2724-13-0x00000000010D0000-0x000000000113E000-memory.dmp

memory/2724-14-0x0000000074A00000-0x00000000750EE000-memory.dmp

memory/2328-15-0x0000000074A00000-0x00000000750EE000-memory.dmp

memory/2756-17-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-18-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-33-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-31-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2756-26-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-23-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-20-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2756-35-0x0000000000AE0000-0x0000000000AEA000-memory.dmp

memory/2756-36-0x0000000000B40000-0x0000000000B5E000-memory.dmp

memory/2756-37-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

memory/2724-38-0x0000000074A00000-0x00000000750EE000-memory.dmp

memory/2724-39-0x0000000074A00000-0x00000000750EE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-26 21:40

Reported

2025-01-26 21:42

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe" C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe

"C:\Users\Admin\AppData\Local\Temp\887661660a313d65f34fa79f249bfaedd01442f59575d29f275ebf9bb9e88db2N.exe"

C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

"C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 7.98.51.23.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/3040-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

memory/3040-1-0x0000000000BB0000-0x0000000000C1E000-memory.dmp

memory/3040-2-0x0000000005B80000-0x0000000006124000-memory.dmp

memory/3040-3-0x0000000005670000-0x0000000005702000-memory.dmp

memory/3040-4-0x0000000005620000-0x000000000562A000-memory.dmp

memory/3040-5-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/3040-6-0x0000000005AF0000-0x0000000005B2C000-memory.dmp

C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

MD5 0ddb5e36e9921bd5613a1ad3f4e5449f
SHA1 8e3ec533d115bf1859422f3504f02f929bcf0c22
SHA256 8e0317feb8405d1cb04080632798908b2bc0816edc5587128d017a0a34262564
SHA512 0b28db50e82d51c22d7a98dd039f759d7e4a025730838860933fb75c7a6fa7893b8c4c1a870f66e440accdd345bfbb479549dec4ef5e94a144b14d87396154d0

memory/2924-21-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/3040-20-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/2924-22-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/2924-23-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/2924-25-0x0000000074D20000-0x00000000754D0000-memory.dmp