nanocore | a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf

General

Target

1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
Size

740KB
MD5

1f104b823c9ac140f99dee39536db4e0
SHA1

1551da1ade3252b446d7a7d80295697138859c50
SHA256

a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf
SHA512

f124db7fce940fd31ab99d4dfb9adafa1d24da985c976136e96637267146cb310d39b79382e447fff07f142b40dbb2c5c731d180e739ea8e6b0e507e618a8e30
SSDEEP

12288:P2ghLvPhXpe3Plf/X+tGrn33gUdCjIXjT6rrqX8lb7LMsHPEibTxzGmlFQJBk:BXhZgPlfrrAU4jprrjH3HJFz9+e

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

infopdf.sfx.exeinfo pdf.exe

pid process

2456 infopdf.sfx.exe
2948 info pdf.exe
Loads dropped DLL 5 IoCs

Processes:

cmd.exeinfopdf.sfx.exe

pid process

2864 cmd.exe
2456 infopdf.sfx.exe
2456 infopdf.sfx.exe
2456 infopdf.sfx.exe
2456 infopdf.sfx.exe

pid	process
2456	infopdf.sfx.exe
2948	info pdf.exe

pid	process
2864	cmd.exe
2456	infopdf.sfx.exe
2456	infopdf.sfx.exe
2456	infopdf.sfx.exe
2456	infopdf.sfx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

info pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	info pdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

info pdf.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA info pdf.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service
T1102

Processes:

flow ioc

2 6.tcp.ngrok.io
4 6.tcp.ngrok.io
8 6.tcp.ngrok.io
13 6.tcp.ngrok.io
15 6.tcp.ngrok.io
17 6.tcp.ngrok.io
22 6.tcp.ngrok.io
24 6.tcp.ngrok.io

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	info pdf.exe

flow	ioc
2	6.tcp.ngrok.io
4	6.tcp.ngrok.io
8	6.tcp.ngrok.io
13	6.tcp.ngrok.io
15	6.tcp.ngrok.io
17	6.tcp.ngrok.io
22	6.tcp.ngrok.io
24	6.tcp.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

info pdf.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	info pdf.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	info pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1968 schtasks.exe
1928 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

info pdf.exe

pid process

2948 info pdf.exe
2948 info pdf.exe
2948 info pdf.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

info pdf.exe

pid process

2948 info pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

info pdf.exe

description pid process

Token: SeDebugPrivilege 2948 info pdf.exe

pid	process
1968	schtasks.exe
1928	schtasks.exe

pid	process
2948	info pdf.exe
2948	info pdf.exe
2948	info pdf.exe

pid	process
2948	info pdf.exe

description	pid	process
Token: SeDebugPrivilege	2948	info pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.execmd.exeinfopdf.sfx.exeinfo pdf.exe

description	pid	process	target process
PID 1960 wrote to memory of 2864	1960	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2864	1960	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2864	1960	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2864	1960	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 2864 wrote to memory of 2456	2864	cmd.exe	infopdf.sfx.exe
PID 2864 wrote to memory of 2456	2864	cmd.exe	infopdf.sfx.exe
PID 2864 wrote to memory of 2456	2864	cmd.exe	infopdf.sfx.exe
PID 2864 wrote to memory of 2456	2864	cmd.exe	infopdf.sfx.exe
PID 2456 wrote to memory of 2948	2456	infopdf.sfx.exe	info pdf.exe
PID 2456 wrote to memory of 2948	2456	infopdf.sfx.exe	info pdf.exe
PID 2456 wrote to memory of 2948	2456	infopdf.sfx.exe	info pdf.exe
PID 2456 wrote to memory of 2948	2456	infopdf.sfx.exe	info pdf.exe
PID 2948 wrote to memory of 1968	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1968	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1968	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1968	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1928	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1928	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1928	2948	info pdf.exe	schtasks.exe
PID 2948 wrote to memory of 1928	2948	info pdf.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864

C:\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exe
infopdf.sfx.exe -pbara -dC:\Users\Admin\AppData\Roaming
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456

C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp406.tmp"
5⤵
- Creates scheduled task(s)
PID:1968

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp511.tmp"
5⤵
- Creates scheduled task(s)
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.bat
Filesize
36B

MD5
934627ff4a68a982fa6804cb94c3dfa3

SHA1
de095d8190f945384e1a801f2c800d40d4fd3612

SHA256
38133ed3a3fba9525559006d0338baa897f7889a6149371d1daae30e3ce6dd06

SHA512
e5277ca8c0a082207612101450f73a5d60bbf48256faa975645394aa3eda96147a0f4ec6822f0992bd26029eeb58ea1eb29c5805bfcc9715829562e9a024e12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe
Filesize
431KB

MD5
d43d29275fb37b0f267e09235f8a6796

SHA1
816ef7e3993c2c9a88829fa34eda6d3495044b86

SHA256
729c2c1508855eee3acee4055dc7ea2f4a17d97b6eb0ca903fd24720dfd7f2b0

SHA512
27bafd46aafdce0db91700bc8995e55958693a17f9938f3f94e7c6230a472723faaee6a10d07ad2e50237abd3a7211d4ad171b8492adfbca07dafcee4bdb0c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp406.tmp
Filesize
1KB

MD5
2d19ad7392f7f5d0c9cfd97dfc77f73a

SHA1
e4f9fe47a8ccbedd509e608dfcec29216da1288f

SHA256
8cbdcb135a0503b74a0774d5dc660f927f39681491f0dd0ce3762a0005e2e7aa

SHA512
672511f97c7ba0e7dfc106c343dcbadfdb838f9987ba876e6b5ac936ef33fe91186b5d5ab0bce3c9c0e0178b59b12711bcf9977c65099df891c25efb547ef1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp511.tmp
Filesize
1KB

MD5
93fc3117767507c9889abd12dc667d22

SHA1
1096e4cfa0c35756e3c3fb866c1e4c1e59115df9

SHA256
684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a

SHA512
e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exe
Filesize
580KB

MD5
e91a7d804e54dc53e026f56e3e45961c

SHA1
a045896bbe4797cd80890c17b23cd29bbdc9beab

SHA256
350a690a878fc026118975c88170de5aa73f42d2b514ce749f68e95bbbb01858

SHA512
c07c8ce06dc322d7c6f7d401f7906dcfdf0e7af7fce99c7c455d6668be97501a45d9a4b4443e2abb361fb7b206b2411eb45f8cd81909e388a2a0bcf68f12ccf0

Download Submit
memory/2948-41-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2948-40-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2948-38-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2948-39-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2948-50-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2948-49-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2948-51-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2948-52-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads