nanocore | b4e2d864ec03943310548bfbc963a0848bd08e088429c5ce05759face5d380d2

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe
Size 997KB
Sample240402-3nv35ahc52
SHA256 b4e2d864ec03943310548bfbc963a0848bd08e088429c5ce05759face5d380d2
MD5 9a4a8643db95a8c0fe52af8675a5d1b1
SHA1 c6beb75cbc168f9224ace74c0dcfb29df6197e82
SHA512 05d404c9422c2da367135f616a8b61b6adc68dc3f8f0b3a070f2071ec01de8c2aeafe5a63aea6e306fdfd299c43ef792efcfd9b555dcda9b3ff9e44872a8b4c0
SSDEEP 24576:rAOcZEh5lwWkAZ5HrNUWTq6ai0bagi7vzJV:tWWbL1Tq6d4a5vT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

strongodss.ddns.net:48562
185.19.85.175:48562

Mutex

ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6

Attributes

activate_away_mode
false
backup_connection_host
185.19.85.175
backup_dns_server
buffer_size
65538
build_time
2021-04-20T00:12:13.961451136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
48562
default_group
HOBBIT
enable_debug_mode
true
gc_threshold
1.0485772e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.0485772e+07
mutex
ba2baad0-dd3f-4844-a1e3-4d042f9ae8b6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
strongodss.ddns.net
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8009

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4864	cjlaro.pif

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\77066510\\cjlaro.pif C:\\Users\\Admin\\77066510\\txoxpdjc.qnr"	cjlaro.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AutoUpdate = "C:\\Users\\Admin\\77066510\\Update.vbs"	cjlaro.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Subsystem = "C:\\Program Files (x86)\\SMTP Subsystem\\smtpss.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 1792	4864	cjlaro.pif	106

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SMTP Subsystem\smtpss.exe	RegSvcs.exe
File created	C:\Program Files (x86)\SMTP Subsystem\smtpss.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3524	schtasks.exe
780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1792	RegSvcs.exe
1792	RegSvcs.exe
1792	RegSvcs.exe
1792	RegSvcs.exe
1792	RegSvcs.exe
1792	RegSvcs.exe
1792	RegSvcs.exe
1792	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1792	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	RegSvcs.exe
Token: SeDebugPrivilege	1792	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4864	cjlaro.pif

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4864	2152	9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe	100
PID 2152 wrote to memory of 4864	2152	9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe	100
PID 2152 wrote to memory of 4864	2152	9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe	100
PID 4864 wrote to memory of 1792	4864	cjlaro.pif	106
PID 4864 wrote to memory of 1792	4864	cjlaro.pif	106
PID 4864 wrote to memory of 1792	4864	cjlaro.pif	106
PID 4864 wrote to memory of 1792	4864	cjlaro.pif	106
PID 4864 wrote to memory of 1792	4864	cjlaro.pif	106
PID 1792 wrote to memory of 3524	1792	RegSvcs.exe	107
PID 1792 wrote to memory of 3524	1792	RegSvcs.exe	107
PID 1792 wrote to memory of 3524	1792	RegSvcs.exe	107
PID 1792 wrote to memory of 780	1792	RegSvcs.exe	109
PID 1792 wrote to memory of 780	1792	RegSvcs.exe	109
PID 1792 wrote to memory of 780	1792	RegSvcs.exe	109

C:\Users\Admin\AppData\Local\Temp\9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9a4a8643db95a8c0fe52af8675a5d1b1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\77066510\cjlaro.pif
  "C:\Users\Admin\77066510\cjlaro.pif" txoxpdjc.qnr
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6627.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3524
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "SMTP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp68B9.tmp"
      4⤵
      Creates scheduled task(s)
      PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cjlaro.pif

Path C:\Users\Admin\77066510\cjlaro.pif
Size 758KB
SHA256 415850f2706681a6d80708fca8ac18dcf97e58b8f3fdc7bc4b558ab15fc0a03f
MD5 279dae7236f5f2488a4bacde6027f730
SHA1 29a012e5259739f24480cedfd6d5f2d860cfcdb3
SHA512 b81276fc4d915a9721dae15aa064781a1dba665ff4864ccbdf624e8049c1b3c12a2b374f11cffcf6e4a5217766836edbc5f2376ffa8765f9070cbd87d7ae2fe8
SSDEEP 12288:qBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aKie5DGDt2:kcneJVBvXAvwRJdwvZ5aKie5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrennftnds.cpl

Path C:\Users\Admin\77066510\hrennftnds.cpl
Size 63KB
SHA256 b68324e9d8a2669f261b06af1f96da4cd8360cef79f76e2af45ea7e423f96c2d
MD5 51b278bb20ba6b5c39b96e40b19a591f
SHA1 ccf1834f98327a25b1404ef9d679b9d8a29d5330
SHA512 0c7b27f4227069385d57cc4983a40ddf55a782dce47a7bff2a484c1ae92c0c66fcc7804b7ab25ca175939a6f4816b6e769d69229052f01d94e8ee7d8eefc4d91
SSDEEP 1536:ZeWsPd1VFU1Jj5pTkp8x0AMrqTok8Jb4C4m/le3ma+VBxo1yotcuG:ZH61VyJbxt2Hnbf03mvTxVyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mbchmfnast.lfh

Path C:\Users\Admin\77066510\mbchmfnast.lfh
Size 420KB
SHA256 bf5e0a807796017b22886d1c734d579dc22cdd47a2a26560960908bb05baa6b8
MD5 fe4f919f7fd004d0d1c5c89bcf638d11
SHA1 11af89c8ed4069e553fa20f204d1c8c78c60505f
SHA512 87cb95067da0e57dea4e853e3bb23ad7df79489a570c0182271461ff7512ba889497a756f6b1df33561bec569ad6d7aa171bb8e2fd7940a21470960c84265b49
SSDEEP 6144:XtApp0ELYvuadbIZLjE5rfqN6CtwJYlF2b7SOXssuseskMe8:XtApBcvuCbIxaWN6CFIhcXsre8
MD5 SHA1 SHA512 SSDEEP

Submit Download

txoxpdjc.qnr

Path C:\Users\Admin\77066510\txoxpdjc.qnr
Size 92.0MB
SHA256 9f205b1613138a4ceb7942223c7654d575062ecb54d3cf54cdf1bb3e56bc2a6e
MD5 a6b5973b2ab8621e18de5325194d4217
SHA1 ae4f38f9d99fe7caa0dfd1a8c20f9a8645c1ad19
SHA512 938cd33cdc47f8bf9e588c9c2d4d9df17c3866d69cd44527f08003cc1f50a96bddde7ad268d4ff3b5cddebaeac44c9a888433172d5747b3ab419283d57414be6
SSDEEP 98304:mnLDOE6//KHPJqqs2C7sIJ1+UdhsPQ36hX7jWcW3b3Mr0O1dElqhA1GJNkAL84Oh:3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp6627.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6627.tmp
Size 1KB
SHA256 3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c
MD5 8cad1b41587ced0f1e74396794f31d58
SHA1 11054bf74fcf5e8e412768035e4dae43aa7b710f
SHA512 99c2ef89029de51a866df932841684b7fc912df21e10e2dd0d09e400203bbdc6cba6319a31780b7bf8b286d2cea8ea3fc7d084348bf2f002ab4f5a34218ccbef
MD5 SHA1 SHA512

Submit Download

tmp68B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp68B9.tmp
Size 1KB
SHA256 3d568a47a8944a47f4aed6982755ac7ff7dda469cc1c81c213ecaa5d89de1f83
MD5 0339b45ef206f4becc88be0d65e24b9e
SHA1 6503a1851f4ccd8c80a31f96bd7ae40d962c9fad
SHA512 c98f4513db34d50510dd986e0d812545c442bd5bef26932032b165759627fab4e00c95fe907ab3416a8a1042bfa77aa516c479f1ff7d1ec2f21ae66df8f72551
MD5 SHA1 SHA512

Submit Download

memory/1792-67-0x0000000005FE0000-0x0000000005FF0000-memory.dmp

Download

memory/1792-61-0x0000000000F40000-0x0000000001526000-memory.dmp

Download

memory/1792-65-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Download

memory/1792-66-0x0000000005E20000-0x0000000005EBC000-memory.dmp

Download

memory/1792-63-0x0000000000F40000-0x0000000000F7A000-memory.dmp

Download

memory/1792-68-0x0000000005D80000-0x0000000005D8A000-memory.dmp

Download

memory/1792-62-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Download

memory/1792-64-0x0000000006330000-0x00000000068D4000-memory.dmp

Download

memory/1792-76-0x0000000005E00000-0x0000000005E0A000-memory.dmp

Download

memory/1792-77-0x0000000005E10000-0x0000000005E1C000-memory.dmp

Download

memory/1792-78-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Download

memory/1792-79-0x0000000006DE0000-0x0000000006DEA000-memory.dmp

Download

memory/1792-80-0x0000000005FE0000-0x0000000005FF0000-memory.dmp

Download

memory/1792-81-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Download

memory/1792-82-0x0000000005FE0000-0x0000000005FF0000-memory.dmp

Download

memory/1792-83-0x0000000005FE0000-0x0000000005FF0000-memory.dmp

Download