When I started my graduate program in Computer & Information Science, "malware analysis" sounded intimidating — reverse engineers with years of experience, arcane assembly code, and tools I'd never heard of.
Then I actually sat down and did it.
This post walks through how I analyzed NanoLocker ransomware (lansrv.exe) — a real, actively-detected malware sample — using publicly available tools. If you're a beginner trying to understand how malware analysis works in practice, this is for you.
⚠️ Disclaimer: This analysis was conducted in a controlled, isolated environment for educational purposes only. Never execute malware on a production machine.
What Is NanoLocker?
NanoLocker is a file-encrypting ransomware trojan from the nanolocker/rents/dynamer family. Despite being compiled in 2016, it was still being submitted to VirusTotal as recently as February 2026. That alone tells you something important: good evasion code has a long shelf life.
The sample I analyzed:
File Name : lansrv.exe (also NanoLocker.exe)
SHA-256 : 462e30eb9cf267315e5f39e4fec4cfff78b34a5f6ebf61bad06cdfd9cbe0a06a
File Size : 196.50 KB
Detected : 59/71 AV engines (83.1%) on VirusTotal
The name lansrv.exe is intentional — it's designed to look like a LAN server service process. This is masquerading (MITRE T1036), and it's one of the first things to notice.
Step 1: Static Analysis — What's Inside the File?
Static analysis means examining the file without running it. I focused on three areas:
PE Section Entropy
Every Windows executable has sections. I checked entropy (randomness) values:
| Section | Entropy | What It Means |
|---|---|---|
.text |
6.38 | Normal — main code |
.rdata |
4.79 | Normal — read-only data |
.data |
6.40 | Normal — variables |
.rsrc |
4.82 | 178 KB — embedded payload |
The .rsrc section at 178KB was the red flag. That's not normal for a 196KB executable. This section stores the embedded ransomware resources that get dropped on execution.
Imported DLLs
What DLLs a file imports tells you a lot about its capabilities:
| DLL | Why Malicious? |
|---|---|
crypt32.dll |
Encryption — generating ransom keys |
ws2_32.dll |
Networking — C2 communication |
advapi32.dll |
Registry — persistence setup |
iphlpapi.dll |
Network adapter enumeration — sandbox detection |
Seeing crypt32.dll + ws2_32.dll together in ransomware is a classic pattern: encrypt files locally, send the key to attacker's server.
Strings Extraction
From 334 total strings, some stood out immediately:
%LOCALAPPDATA%\lansrv.exe → Persistence path
%LOCALAPPDATA%\lansrv.ini → Encrypted config (87KB)
52.91.55.122 → Hardcoded C2 server
C:\ransomware3.exe → Self-reference (the dropper)
CoCreateInstance → COM persistence evasion
Hardcoded C2 IPs in strings are a gift for defenders — block 52.91.55.122 at the firewall and you've cut off one communication channel.
Step 2: Dynamic Analysis — What Does It Actually Do?
Dynamic analysis means watching the malware execute in a sandbox. I used VirusTotal's dynamic analysis, Joe Sandbox, and Hybrid Analysis.
What Happened When It Ran
1. Environment Check First
Before doing anything malicious, NanoLocker checks:
- CPU name (is this a VM?)
- CPU clock timing (is execution being accelerated in a sandbox?)
- Executes long sleep periods to outlast sandbox timeouts
This is why many samples show "clean" in quick sandbox scans — they just... wait.
2. Persistence Setup
Copies itself → %USERPROFILE%\AppData\Local\lansrv.exe
Config file → %LOCALAPPDATA%\lansrv.ini (87KB encrypted)
Registry → Boot/Logon Autostart (T1547)
Every reboot, it comes back.
3. Process Injection
NanoLocker injects into wuapihost.exe — a legitimate Windows Update process. This hides its activity inside a trusted process, making it harder to detect in task manager.
4. File Discovery & Encryption
Using shell32.dll, it enumerates user directories looking for documents, images, and personal files. It encrypts them and sends the decryption key to 52.91.55.122.
5. Network Communication
Six IPs contacted during execution:
| IP | Port | Purpose |
|---|---|---|
52.91.55.122 |
ICMP | Primary C2 — key exfiltration |
192.229.211.108 |
80 | Unencrypted payload download |
20.99.184.37/246 |
443 | Encrypted C2 |
23.216.147.64/76 |
443 | Encrypted C2 |
Step 3: MITRE ATT&CK Mapping
Mapping behavior to MITRE ATT&CK transforms your analysis from "here's what it does" to "here's how it fits into known attacker patterns." This is what SOC teams and threat intel analysts actually use.
| Tactic | ID | Behavior |
|---|---|---|
| Execution | T1204 | User runs the file directly |
| Persistence | T1547 | Boot/Logon Autostart |
| Priv. Escalation | T1055 | Process injection |
| Defense Evasion | T1027 | Obfuscated config strings |
| Defense Evasion | T1036 | Masquerades as LAN service |
| Discovery | T1082 | CPU/environment fingerprinting |
| C2 | T1071 | HTTPS over port 443 |
| Impact | T1486 | Data Encrypted for Impact |
What I Learned
A few things genuinely surprised me:
1. 10-year-old malware is still relevant. NanoLocker uses evasion techniques that are still effective in 2026 — sleep-based sandbox evasion, process injection into trusted processes, COM+ manipulation. Understanding "old" malware teaches you fundamentals that still apply.
2. The name is part of the attack. lansrv.exe is designed to look like infrastructure software. If you saw it in Task Manager, would you think twice? Social engineering isn't just phishing emails — it's also how malware names itself.
3. Hardcoded IOCs are gold for defenders. The moment I saw 52.91.55.122 in the strings, that IP becomes a firewall rule. Simple static analysis produces actionable defensive intelligence.
4. MITRE ATT&CK bridges analysis and defense. Before this, ATT&CK felt abstract. After mapping NanoLocker's behaviors, I understand why it exists — it gives analysts and defenders a shared language.
Tools I Used
- VirusTotal — Multi-AV scanning + behavioral analysis
- Hybrid Analysis — Sandbox execution
- PE analysis tools — Section/entropy inspection
- MITRE ATT&CK Navigator — Framework mapping
Full Technical Report + IOCs
If you want the full analysis with all IOCs, PE section details, and complete ATT&CK mapping, I've documented everything on GitHub:
🔗 https://github.com/MalwareAnalysisLabs/malware-analysis-writeups
The repository includes the full PDF report, IOC lists in markdown format, and ATT&CK mapping table — ready to use for reference or learning.
What's Next
This was my first structured malware analysis. Next, I want to:
- Run samples through Ghidra for actual disassembly
- Try deobfuscating that
C:!@I~wF:encoded config string - Compare NanoLocker's encryption implementation to other ransomware families
If you're also learning malware analysis, what tools or resources have helped you most? Drop a comment — I'm always looking for what to learn next.
Top comments (0)