nanocore | ebe1bb18a77cf0b34d3ad06919a9adfff2aa69cfafa5b96b670534b890e3e2a8

Analysis

max time kernel
87s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe
Size 1.0MB
Sample240404-ppwt6afc8y
SHA256 ebe1bb18a77cf0b34d3ad06919a9adfff2aa69cfafa5b96b670534b890e3e2a8
MD5 b866823e1f8f4a52376bd108c457dd78
SHA1 fe99849ec27630463080445337798eeba8000a02
SHA512 fd1732ca7dc310395581d835ea3df1e7ad664c75c9c7f68ba55c0b2e521383a0c8781b490f7cc05428d6e534b356a585bf11b57e57808cc37ea08dabf4a09e13
SSDEEP 24576:rAOcZEhU3Pv6cxzVQ5WP1TKyENXWPI1sDx52gWbh9dlfQ:tEicRPwZ1sDxIrtG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

ezeani.duckdns.org:8338
194.5.98.48:8338

Mutex

c213d282-998c-4a04-8f80-944681ca75f6

Attributes

activate_away_mode
true
backup_connection_host
194.5.98.48
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-07-25T02:31:51.856627236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8338
default_group
nano stub
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
c213d282-998c-4a04-8f80-944681ca75f6
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
ezeani.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4052	mmuiqlcvwo.pif
752	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows element = "C:\\Users\\Admin\\33920049\\MMUIQL~1.PIF C:\\Users\\Admin\\33920049\\fmkkelc.omp"	mmuiqlcvwo.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 752	4052	mmuiqlcvwo.pif	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4052	mmuiqlcvwo.pif
4052	mmuiqlcvwo.pif
752	RegSvcs.exe
752	RegSvcs.exe
752	RegSvcs.exe
752	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 4052	984	b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe	89
PID 984 wrote to memory of 4052	984	b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe	89
PID 984 wrote to memory of 4052	984	b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe	89
PID 4052 wrote to memory of 752	4052	mmuiqlcvwo.pif	95
PID 4052 wrote to memory of 752	4052	mmuiqlcvwo.pif	95
PID 4052 wrote to memory of 752	4052	mmuiqlcvwo.pif	95
PID 4052 wrote to memory of 752	4052	mmuiqlcvwo.pif	95
PID 4052 wrote to memory of 752	4052	mmuiqlcvwo.pif	95

C:\Users\Admin\AppData\Local\Temp\b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b866823e1f8f4a52376bd108c457dd78_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\33920049\mmuiqlcvwo.pif
  "C:\Users\Admin\33920049\mmuiqlcvwo.pif" fmkkelc.omp
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abjtjj.gcm

Path C:\Users\Admin\33920049\abjtjj.gcm
Size 407KB
SHA256 0fb93824d410f1e4ba2b233f405027d042edf2e729fa34a41be910b50ed99416
MD5 1e44c5e2d839f53ac114916dfa41912b
SHA1 9b67abc94e2959683b5d784c8b076d6171af7237
SHA512 14895d2f67585415d7d25807bba20f6aa8c142e8dd3483ed8e10f4280820cd0849ee828e3134beaf4a90fb8e41c9c524df01547330dfd3928470b3eeb95946a1
SSDEEP 6144:vq8GcfPnL6mYkonW8inBO9SEmDafe/kgtwIf:vecfPemYZWJs9NmDaW8gmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

fmkkelc.omp

Path C:\Users\Admin\33920049\fmkkelc.omp
Size 84.4MB
SHA256 a287ee67f0daad6f354fc0d74905f93e305d9982243e5d69075dc729ceaa4650
MD5 c0b48739b4ea38e1e040c1b52d2defd3
SHA1 2ceb52624cb385d4839bd83b36364fc461156afa
SHA512 b6d370f1358f139302aadaebab7ca0ec13559623fc975e9ec6ca14819cf222e83dfe5fd5b5789b26e03e076353c0fd41054b4468a5a0785e0ee8efb13f98f678
SSDEEP 49152:EcAALhfk8v8UOvPpDnYZVOCzhK2BE1Mnu8oQLpzEwE5AhbaSpqX+FST+CJtIJlzf:x
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmuiqlcvwo.pif

Path C:\Users\Admin\33920049\mmuiqlcvwo.pif
Size 759KB
SHA256 c9a2399cc1ce6f71db9da2f16e6c025bf6cb0f4345b427f21449cf927d627a40
MD5 8e699954f6b5d64683412cc560938507
SHA1 8ca6708b0f158eacce3ac28b23c23ed42c168c29
SHA512 13035106149c8d336189b4a6bdaf25e10ac0b027baea963b3ec66a815a572426b2e9485258447cf1362802a0f03a2aa257b276057590663161d9d55d5b737b02
SSDEEP 12288:aBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4akiP5DGDt2:0cneJVBvXAvwRJdwvZ5akiP5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

qhqulleu.mp3

Path C:\Users\Admin\33920049\qhqulleu.mp3
Size 56KB
SHA256 067820a70679bc812c16421e4f759533dd91d8124ed36966436601b1f2013c94
MD5 5dc5d3365bae36fc41072d92d22f69cb
SHA1 91ce48060dcccc9806afb9979a3a1759041036df
SHA512 ce2119181fcbda7c1b08068f918c7282defc8ad951e129458bb75f6cc9ec4ca105482b5f4aac4c16e425736fa45da790d10b4ed9346a93b23b4f4f713a912a85
SSDEEP 768:QtqpJPhBpMPi7KdPoRt5h5mcV7ppmMYONu+jYdsb8Gnw39rPsc3+Pb06FB9EgdTr:QKVmAvh5XJG9oBjoBcBGArFfXL9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/752-71-0x0000000000D00000-0x0000000001224000-memory.dmp

Download

memory/752-74-0x0000000000D00000-0x0000000000D3A000-memory.dmp

Download

memory/752-75-0x00000000741D0000-0x0000000074980000-memory.dmp

Download

memory/752-76-0x0000000005EA0000-0x0000000006444000-memory.dmp

Download

memory/752-77-0x0000000005990000-0x0000000005A22000-memory.dmp

Download

memory/752-78-0x0000000005A30000-0x0000000005ACC000-memory.dmp

Download