nanocore | a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf

General

Target

1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
Size

740KB
MD5

1f104b823c9ac140f99dee39536db4e0
SHA1

1551da1ade3252b446d7a7d80295697138859c50
SHA256

a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf
SHA512

f124db7fce940fd31ab99d4dfb9adafa1d24da985c976136e96637267146cb310d39b79382e447fff07f142b40dbb2c5c731d180e739ea8e6b0e507e618a8e30
SSDEEP

12288:P2ghLvPhXpe3Plf/X+tGrn33gUdCjIXjT6rrqX8lb7LMsHPEibTxzGmlFQJBk:BXhZgPlfrrAU4jprrjH3HJFz9+e

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exeinfopdf.sfx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	infopdf.sfx.exe

Executes dropped EXE 2 IoCs

Processes:

infopdf.sfx.exeinfo pdf.exe

pid process

2808 infopdf.sfx.exe
1312 info pdf.exe

pid	process
2808	infopdf.sfx.exe
1312	info pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

info pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Host = "C:\\Program Files (x86)\\UPNP Host\\upnphost.exe"	info pdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

info pdf.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA info pdf.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service
T1102

Processes:

flow ioc

22 6.tcp.ngrok.io
37 6.tcp.ngrok.io
45 6.tcp.ngrok.io
52 6.tcp.ngrok.io
54 6.tcp.ngrok.io
59 6.tcp.ngrok.io
14 6.tcp.ngrok.io

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	info pdf.exe

flow	ioc
22	6.tcp.ngrok.io
37	6.tcp.ngrok.io
45	6.tcp.ngrok.io
52	6.tcp.ngrok.io
54	6.tcp.ngrok.io
59	6.tcp.ngrok.io
14	6.tcp.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

info pdf.exe

description	ioc	process
File created	C:\Program Files (x86)\UPNP Host\upnphost.exe	info pdf.exe
File opened for modification	C:\Program Files (x86)\UPNP Host\upnphost.exe	info pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1960 schtasks.exe
2512 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

info pdf.exe

pid process

1312 info pdf.exe
1312 info pdf.exe
1312 info pdf.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

info pdf.exe

pid process

1312 info pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

info pdf.exe

description pid process

Token: SeDebugPrivilege 1312 info pdf.exe

pid	process
1960	schtasks.exe
2512	schtasks.exe

pid	process
1312	info pdf.exe
1312	info pdf.exe
1312	info pdf.exe

pid	process
1312	info pdf.exe

description	pid	process
Token: SeDebugPrivilege	1312	info pdf.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.execmd.exeinfopdf.sfx.exeinfo pdf.exe

description	pid	process	target process
PID 972 wrote to memory of 4632	972	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 972 wrote to memory of 4632	972	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 972 wrote to memory of 4632	972	1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe	cmd.exe
PID 4632 wrote to memory of 2808	4632	cmd.exe	infopdf.sfx.exe
PID 4632 wrote to memory of 2808	4632	cmd.exe	infopdf.sfx.exe
PID 4632 wrote to memory of 2808	4632	cmd.exe	infopdf.sfx.exe
PID 2808 wrote to memory of 1312	2808	infopdf.sfx.exe	info pdf.exe
PID 2808 wrote to memory of 1312	2808	infopdf.sfx.exe	info pdf.exe
PID 2808 wrote to memory of 1312	2808	infopdf.sfx.exe	info pdf.exe
PID 1312 wrote to memory of 1960	1312	info pdf.exe	schtasks.exe
PID 1312 wrote to memory of 1960	1312	info pdf.exe	schtasks.exe
PID 1312 wrote to memory of 1960	1312	info pdf.exe	schtasks.exe
PID 1312 wrote to memory of 2512	1312	info pdf.exe	schtasks.exe
PID 1312 wrote to memory of 2512	1312	info pdf.exe	schtasks.exe
PID 1312 wrote to memory of 2512	1312	info pdf.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4632

C:\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exe
infopdf.sfx.exe -pbara -dC:\Users\Admin\AppData\Roaming
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808

C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UPNP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp79E3.tmp"
5⤵
- Creates scheduled task(s)
PID:1960

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "UPNP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7ADE.tmp"
5⤵
- Creates scheduled task(s)
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.bat
Filesize
36B

MD5
934627ff4a68a982fa6804cb94c3dfa3

SHA1
de095d8190f945384e1a801f2c800d40d4fd3612

SHA256
38133ed3a3fba9525559006d0338baa897f7889a6149371d1daae30e3ce6dd06

SHA512
e5277ca8c0a082207612101450f73a5d60bbf48256faa975645394aa3eda96147a0f4ec6822f0992bd26029eeb58ea1eb29c5805bfcc9715829562e9a024e12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exe
Filesize
580KB

MD5
e91a7d804e54dc53e026f56e3e45961c

SHA1
a045896bbe4797cd80890c17b23cd29bbdc9beab

SHA256
350a690a878fc026118975c88170de5aa73f42d2b514ce749f68e95bbbb01858

SHA512
c07c8ce06dc322d7c6f7d401f7906dcfdf0e7af7fce99c7c455d6668be97501a45d9a4b4443e2abb361fb7b206b2411eb45f8cd81909e388a2a0bcf68f12ccf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe
Filesize
431KB

MD5
d43d29275fb37b0f267e09235f8a6796

SHA1
816ef7e3993c2c9a88829fa34eda6d3495044b86

SHA256
729c2c1508855eee3acee4055dc7ea2f4a17d97b6eb0ca903fd24720dfd7f2b0

SHA512
27bafd46aafdce0db91700bc8995e55958693a17f9938f3f94e7c6230a472723faaee6a10d07ad2e50237abd3a7211d4ad171b8492adfbca07dafcee4bdb0c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp79E3.tmp
Filesize
1KB

MD5
2d19ad7392f7f5d0c9cfd97dfc77f73a

SHA1
e4f9fe47a8ccbedd509e608dfcec29216da1288f

SHA256
8cbdcb135a0503b74a0774d5dc660f927f39681491f0dd0ce3762a0005e2e7aa

SHA512
672511f97c7ba0e7dfc106c343dcbadfdb838f9987ba876e6b5ac936ef33fe91186b5d5ab0bce3c9c0e0178b59b12711bcf9977c65099df891c25efb547ef1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7ADE.tmp
Filesize
1KB

MD5
88bf0bc1e20b64333f39f1cf2085a729

SHA1
6d8eeef3d8f118ded3f2f1dc55ffaa71ee5d7ad8

SHA256
393c769644b1c640753a6bab46cd6c8cbaf984d116d6f7dd1a071d5f2afa42f9

SHA512
74dfacf7443b7b08da09d40bca1b2a99e7dc44d9d5289f86e1b718f3268b1b11e85c04eb8dd0a5e95788726f09678051a27902d509f015a5ff6609c7d8ec9aba

Download Submit
memory/1312-19-0x0000000072970000-0x0000000072F21000-memory.dmp

Filesize
5.7MB

Download
memory/1312-21-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/1312-20-0x0000000072970000-0x0000000072F21000-memory.dmp

Filesize
5.7MB

Download
memory/1312-29-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/1312-30-0x0000000072970000-0x0000000072F21000-memory.dmp

Filesize
5.7MB

Download
memory/1312-31-0x0000000072970000-0x0000000072F21000-memory.dmp

Filesize
5.7MB

Download
memory/1312-32-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/1312-33-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads