nanocore | 9e3cd07082999473a19b2a31cd758eea0240534d0298055213d454f4bd1c4f5d

Analysis

max time kernel
139s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/03/2024, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
Size 1015KB
Sample240331-tswqsafc58
SHA256 9e3cd07082999473a19b2a31cd758eea0240534d0298055213d454f4bd1c4f5d
MD5 584db0c3327f634fbce91d93a9431fdd
SHA1 6350f78f6c57b3874137bf0f79ee13c0f83c4f0a
SHA512 e39db118db46cdcaf5294a3c4d10c791efdbb684dd82206238629f5dca3f63c234e2dbc03a6c01f1fc824d7158a5cc397a820c7a8f2a2dd8c7a5dc0efa40c946
SSDEEP 24576:rAOcZEhEFYoYP28DJWhX6gAqTq6ai0bagi7vJiIB:t0QPtG6oTq6d4a5hB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

strongodss.ddns.net:48562
185.19.85.175:48562

Mutex

ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2021-04-20T00:12:13.961451136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
48562
default_group
HOBBIT
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
strongodss.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
2856	wcntmm.pif
1928	RegSvcs.exe

Loads dropped DLL 6 IoCs

pid	Process
2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
2856	wcntmm.pif

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51753745\\wcntmm.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\51753745\\gdehwn.xhs"	wcntmm.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51753745\\Update.vbs"	wcntmm.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 1928	2856	wcntmm.pif	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
852	schtasks.exe
2148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1928	RegSvcs.exe
1928	RegSvcs.exe
1928	RegSvcs.exe
1928	RegSvcs.exe
1928	RegSvcs.exe
1928	RegSvcs.exe
1928	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1928	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	RegSvcs.exe
Token: SeDebugPrivilege	1928	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2856	2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	28
PID 2304 wrote to memory of 2856	2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	28
PID 2304 wrote to memory of 2856	2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	28
PID 2304 wrote to memory of 2856	2304	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	28
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 2856 wrote to memory of 1928	2856	wcntmm.pif	29
PID 1928 wrote to memory of 2148	1928	RegSvcs.exe	30
PID 1928 wrote to memory of 2148	1928	RegSvcs.exe	30
PID 1928 wrote to memory of 2148	1928	RegSvcs.exe	30
PID 1928 wrote to memory of 2148	1928	RegSvcs.exe	30
PID 1928 wrote to memory of 852	1928	RegSvcs.exe	32
PID 1928 wrote to memory of 852	1928	RegSvcs.exe	32
PID 1928 wrote to memory of 852	1928	RegSvcs.exe	32
PID 1928 wrote to memory of 852	1928	RegSvcs.exe	32

C:\Users\Admin\AppData\Local\Temp\584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\51753745\wcntmm.pif
  "C:\Users\Admin\AppData\Local\Temp\51753745\wcntmm.pif" gdehwn.xhs
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1C28.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2148
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1CE4.tmp"
      4⤵
      Creates scheduled task(s)
      PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gdehwn.xhs

Path C:\Users\Admin\AppData\Local\Temp\51753745\gdehwn.xhs
Size 107.8MB
SHA256 31e9cdc90dd57fa51810648ff37df10144ebad7ea80c38753f88cca4a34fafb2
MD5 dfc53d2c68add3f9f79b1356cec3d304
SHA1 a4731f6502c5d91bf355d4792a2cf08a793dd476
SHA512 3ff5cea2ca614a61cee31da439aba1de78272bcae5015ac4fa2aede053c0164eae618034d21126df8b6abb811cd9248a7dafa954da96154333c6cd16666f03c1
SSDEEP 196608:DG6SxfNued2uINdXp16XTY0hQcAnuLWdwmqSZHZW6WH6vxkMPEdQbEJ4M/LKnzRv:9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mnkfgrm.docx

Path C:\Users\Admin\AppData\Local\Temp\51753745\mnkfgrm.docx
Size 56KB
SHA256 3f8269b861e0d393d4c970ae061fbcd5eeb2e0418d7263b686f032a92708dc9f
MD5 2707956b676a612b935db5c80f04b32e
SHA1 1d64409e5c50b694c27c58c96b282c10ddf90b31
SHA512 38d601fcdb3915219561db8c96530cea200996684be764a064581a0ffcf8884799b32737c662afd72ed2bf7819e84f9abe2a6a9125aa7c218f061ce00ed886de
SSDEEP 1536:ARjdve3e8wfhkSO5DSYjsTmz/ZvcQRDYwOwKl9Iw9:ARj5eOXhkSaDSkYmbd5RDYXwGIw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

qofdwuln.sbr

Path C:\Users\Admin\AppData\Local\Temp\51753745\qofdwuln.sbr
Size 420KB
SHA256 9e01601448cae4e59147feca1ed661536f0e259144b1005547ad40dc5ce4b744
MD5 239c6d94f510c83b299c2e0d4ea22c09
SHA1 2adf68a59c1d650eee456d33cd59de1a4c8b0423
SHA512 33252e7f14351905a796ea35bc92a33055166935e055dc71dfc22df1140f7c5017c1bb1c64c6580f857ffdcbb88799cea5fdf1b12af414d8d0d2717fcd05d2fb
SSDEEP 12288:Qa31zJf2X6OinFZT1OYVDMY8Amhhx8ZJop:Qa31FXOiFZEYVV8Lhhx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcntmm.pif

Path C:\Users\Admin\AppData\Local\Temp\51753745\wcntmm.pif
Size 758KB
SHA256 2707941219650cd1e3fb43683cb51c760cb2314459cf802e948dea08fd028980
MD5 2d5ba27cab1ceb20deb71d4cedd49f1b
SHA1 1d38d9571ffecd778033254a14ace5e6020dfaad
SHA512 97baa3d705decabbd2ff2f85654a12ddded6d32f6f183a2af8784207878e753bc25ac8aff47cf2a55c11a8ee40b0e83c0b6fbde9392ce288c0c451172517b188
SSDEEP 12288:BBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aUiW5DGDt2:zcneJVBvXAvwRJdwvZ5aUiW5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1C28.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1C28.tmp
Size 1KB
SHA256 8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
MD5 95aceabc58acad5d73372b0966ee1b35
SHA1 2293b7ad4793cf574b1a5220e85f329b5601040a
SHA512 00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
MD5 SHA1 SHA512

Submit Download

tmp1CE4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1CE4.tmp
Size 1KB
SHA256 684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a
MD5 93fc3117767507c9889abd12dc667d22
SHA1 1096e4cfa0c35756e3c3fb866c1e4c1e59115df9
SHA512 e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc
MD5 SHA1 SHA512

Submit Download

RegSvcs.exe

Path \Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1928-103-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Download

memory/1928-92-0x00000000001F0000-0x000000000082D000-memory.dmp

Download

memory/1928-100-0x00000000001F0000-0x000000000082D000-memory.dmp

Download

memory/1928-95-0x00000000001F0000-0x000000000082D000-memory.dmp

Download

memory/1928-102-0x00000000001F0000-0x000000000022A000-memory.dmp

Download

memory/1928-104-0x00000000053F0000-0x0000000005430000-memory.dmp

Download

memory/1928-94-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1928-98-0x00000000001F0000-0x000000000082D000-memory.dmp

Download

memory/1928-112-0x0000000001030000-0x000000000103A000-memory.dmp

Download

memory/1928-114-0x0000000001050000-0x000000000106E000-memory.dmp

Download

memory/1928-113-0x0000000001040000-0x000000000104C000-memory.dmp

Download

memory/1928-115-0x00000000010C0000-0x00000000010CA000-memory.dmp

Download

memory/1928-116-0x00000000735F0000-0x0000000073CDE000-memory.dmp

Download

memory/1928-117-0x00000000053F0000-0x0000000005430000-memory.dmp

Download