nanocore | 9e3cd07082999473a19b2a31cd758eea0240534d0298055213d454f4bd1c4f5d

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
Size 1015KB
Sample240331-tswqsafc58
SHA256 9e3cd07082999473a19b2a31cd758eea0240534d0298055213d454f4bd1c4f5d
MD5 584db0c3327f634fbce91d93a9431fdd
SHA1 6350f78f6c57b3874137bf0f79ee13c0f83c4f0a
SHA512 e39db118db46cdcaf5294a3c4d10c791efdbb684dd82206238629f5dca3f63c234e2dbc03a6c01f1fc824d7158a5cc397a820c7a8f2a2dd8c7a5dc0efa40c946
SSDEEP 24576:rAOcZEhEFYoYP28DJWhX6gAqTq6ai0bagi7vJiIB:t0QPtG6oTq6d4a5hB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

strongodss.ddns.net:48562
185.19.85.175:48562

Mutex

ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2021-04-20T00:12:13.961451136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
48562
default_group
HOBBIT
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
strongodss.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
224	wcntmm.pif
624	RegSvcs.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51753745\\wcntmm.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\51753745\\gdehwn.xhs"	wcntmm.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51753745\\Update.vbs"	wcntmm.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAT Subsystem = "C:\\Program Files (x86)\\NAT Subsystem\\natss.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 224 set thread context of 624	224	wcntmm.pif	87

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NAT Subsystem\natss.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\NAT Subsystem\natss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1636	schtasks.exe
2256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
624	RegSvcs.exe
624	RegSvcs.exe
624	RegSvcs.exe
624	RegSvcs.exe
624	RegSvcs.exe
624	RegSvcs.exe
624	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	RegSvcs.exe
Token: SeDebugPrivilege	624	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 224	436	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	85
PID 436 wrote to memory of 224	436	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	85
PID 436 wrote to memory of 224	436	584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe	85
PID 224 wrote to memory of 624	224	wcntmm.pif	87
PID 224 wrote to memory of 624	224	wcntmm.pif	87
PID 224 wrote to memory of 624	224	wcntmm.pif	87
PID 224 wrote to memory of 624	224	wcntmm.pif	87
PID 224 wrote to memory of 624	224	wcntmm.pif	87
PID 624 wrote to memory of 1636	624	RegSvcs.exe	88
PID 624 wrote to memory of 1636	624	RegSvcs.exe	88
PID 624 wrote to memory of 1636	624	RegSvcs.exe	88
PID 624 wrote to memory of 2256	624	RegSvcs.exe	90
PID 624 wrote to memory of 2256	624	RegSvcs.exe	90
PID 624 wrote to memory of 2256	624	RegSvcs.exe	90

C:\Users\Admin\AppData\Local\Temp\584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\584db0c3327f634fbce91d93a9431fdd_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\51753745\wcntmm.pif
  "C:\Users\Admin\AppData\Local\Temp\51753745\wcntmm.pif" gdehwn.xhs
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "NAT Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5515.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1636
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "NAT Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5555.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gdehwn.xhs

Path C:\Users\Admin\AppData\Local\Temp\51753745\gdehwn.xhs
Size 107.8MB
SHA256 31e9cdc90dd57fa51810648ff37df10144ebad7ea80c38753f88cca4a34fafb2
MD5 dfc53d2c68add3f9f79b1356cec3d304
SHA1 a4731f6502c5d91bf355d4792a2cf08a793dd476
SHA512 3ff5cea2ca614a61cee31da439aba1de78272bcae5015ac4fa2aede053c0164eae618034d21126df8b6abb811cd9248a7dafa954da96154333c6cd16666f03c1
SSDEEP 196608:DG6SxfNued2uINdXp16XTY0hQcAnuLWdwmqSZHZW6WH6vxkMPEdQbEJ4M/LKnzRv:9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mnkfgrm.docx

Path C:\Users\Admin\AppData\Local\Temp\51753745\mnkfgrm.docx
Size 56KB
SHA256 3f8269b861e0d393d4c970ae061fbcd5eeb2e0418d7263b686f032a92708dc9f
MD5 2707956b676a612b935db5c80f04b32e
SHA1 1d64409e5c50b694c27c58c96b282c10ddf90b31
SHA512 38d601fcdb3915219561db8c96530cea200996684be764a064581a0ffcf8884799b32737c662afd72ed2bf7819e84f9abe2a6a9125aa7c218f061ce00ed886de
SSDEEP 1536:ARjdve3e8wfhkSO5DSYjsTmz/ZvcQRDYwOwKl9Iw9:ARj5eOXhkSaDSkYmbd5RDYXwGIw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

qofdwuln.sbr

Path C:\Users\Admin\AppData\Local\Temp\51753745\qofdwuln.sbr
Size 420KB
SHA256 9e01601448cae4e59147feca1ed661536f0e259144b1005547ad40dc5ce4b744
MD5 239c6d94f510c83b299c2e0d4ea22c09
SHA1 2adf68a59c1d650eee456d33cd59de1a4c8b0423
SHA512 33252e7f14351905a796ea35bc92a33055166935e055dc71dfc22df1140f7c5017c1bb1c64c6580f857ffdcbb88799cea5fdf1b12af414d8d0d2717fcd05d2fb
SSDEEP 12288:Qa31zJf2X6OinFZT1OYVDMY8Amhhx8ZJop:Qa31FXOiFZEYVV8Lhhx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcntmm.pif

Path C:\Users\Admin\AppData\Local\Temp\51753745\wcntmm.pif
Size 758KB
SHA256 2707941219650cd1e3fb43683cb51c760cb2314459cf802e948dea08fd028980
MD5 2d5ba27cab1ceb20deb71d4cedd49f1b
SHA1 1d38d9571ffecd778033254a14ace5e6020dfaad
SHA512 97baa3d705decabbd2ff2f85654a12ddded6d32f6f183a2af8784207878e753bc25ac8aff47cf2a55c11a8ee40b0e83c0b6fbde9392ce288c0c451172517b188
SSDEEP 12288:BBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aUiW5DGDt2:zcneJVBvXAvwRJdwvZ5aUiW5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5515.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5515.tmp
Size 1KB
SHA256 8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4
MD5 95aceabc58acad5d73372b0966ee1b35
SHA1 2293b7ad4793cf574b1a5220e85f329b5601040a
SHA512 00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74
MD5 SHA1 SHA512

Submit Download

tmp5555.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5555.tmp
Size 1KB
SHA256 52cdb418384a912c5b7071c92d7761f0d12250f07dbbb31876eb2e8d65acbae7
MD5 c58d37cb49c18f1d7cece3c78ac2f407
SHA1 769ed0ea9d5269e1cec7234eaac77da129cc0463
SHA512 2efcb3eaf050d56ad3d483112303a1543f9fc457119fbca7d81b45d5619c0f1ba706ce96644d4e2055c1b5ada7af13f071495287a775ce234d9125633bf02775
MD5 SHA1 SHA512

Submit Download

memory/624-85-0x0000000005DC0000-0x0000000005E5C000-memory.dmp

Download

memory/624-78-0x0000000001180000-0x0000000001666000-memory.dmp

Download

memory/624-84-0x0000000005D20000-0x0000000005DB2000-memory.dmp

Download

memory/624-82-0x00000000724F0000-0x0000000072CA0000-memory.dmp

Download

memory/624-86-0x0000000006020000-0x0000000006030000-memory.dmp

Download

memory/624-87-0x0000000005CE0000-0x0000000005CEA000-memory.dmp

Download

memory/624-81-0x0000000001180000-0x00000000011BA000-memory.dmp

Download

memory/624-83-0x0000000006230000-0x00000000067D4000-memory.dmp

Download

memory/624-96-0x0000000006DA0000-0x0000000006DAC000-memory.dmp

Download

memory/624-95-0x0000000006010000-0x000000000601A000-memory.dmp

Download

memory/624-97-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

Download

memory/624-98-0x0000000006DE0000-0x0000000006DEA000-memory.dmp

Download

memory/624-99-0x00000000724F0000-0x0000000072CA0000-memory.dmp

Download

memory/624-100-0x0000000006020000-0x0000000006030000-memory.dmp

Download