nanocore | 1b95840eff39cd8534bfe8236aac04e5295ad623287cbb9ed8871b4a3c03ddc0

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe
Size 744KB
Sample240419-nps8laae77
SHA256 1b95840eff39cd8534bfe8236aac04e5295ad623287cbb9ed8871b4a3c03ddc0
MD5 fa3577dd09234de5571fcbc86bf1c90e
SHA1 3beeb716a723b24aec518e77f3742f18e1b06da9
SHA512 9df8858da25e725bf53939d11e16ede3a13d7da0e78845838b90bfe324135020c779febc7068372eb4c7b09934b5c60229415f5af0145e5eed51e3c6409f482f
SSDEEP 12288:Gl21a9BEhO3NTlK4nF+BK6ppT1U+RVupXxZ8fwh7iBCeWSLvIrHIjit0NpI2RUMB:ZvKRyJTxoHIjo9Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	temp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	temp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2564	temp.exe
2564	temp.exe
2564	temp.exe
2564	temp.exe
2564	temp.exe
2564	temp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	temp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	temp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 2564	3732	fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe	88
PID 3732 wrote to memory of 2564	3732	fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe	88
PID 3732 wrote to memory of 2564	3732	fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe	88
PID 2564 wrote to memory of 3532	2564	temp.exe	89
PID 2564 wrote to memory of 3532	2564	temp.exe	89
PID 2564 wrote to memory of 3532	2564	temp.exe	89

C:\Users\Admin\AppData\Local\Temp\fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa3577dd09234de5571fcbc86bf1c90e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\temp.exe
  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "SAAS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD5FD.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

temp.exe

Path C:\Users\Admin\AppData\Local\Temp\temp.exe
Size 203KB
SHA256 fc8c162b05f4cece99378e150d765a5219ada0107f88fb8cb37a3b6b222a036e
MD5 352b0fe5916f680eb4c8a5b4b1bc0157
SHA1 863232335852787e23b672fc495e1da051628837
SHA512 88508a62c113d8af45973dc94bff3508d08ece7a2778fe4750e1ffafcac9e098fb81ac5d03999e011f662f986d7db46a4001135e98611ef0d3cdb995410f96f9
SSDEEP 6144:cLV6Bta6dtJmakIM5TpGCGyL14cglRndbycCb:cLV6BtpmkCGCdLWcglRndObb
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpD5FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD5FD.tmp
Size 1KB
SHA256 52ca6ab83773ce4883061bec75381bb701d6205a8e252ea319ee2c911aed1b08
MD5 90bf28fde67c74fbc2cd0e5f92d4cc06
SHA1 9bd9eb29b09c4460d2f793238117ad2b464c5f10
SHA512 17630a9e8eae70bf051cfdf1b24e88a257d3026ad76e448766662f1ac17a781a3ad7d571349e4fbda028dd04e763d024c18f5af7286a3ea61fe28e87d23674df
MD5 SHA1 SHA512

Submit Download

memory/2564-14-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/2564-15-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/2564-16-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/2564-21-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/2564-22-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/2564-23-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/2564-24-0x0000000001800000-0x0000000001810000-memory.dmp

Download

memory/3732-4-0x00007FFAB5A90000-0x00007FFAB6431000-memory.dmp

Download

memory/3732-2-0x0000000001880000-0x0000000001890000-memory.dmp

Download

memory/3732-13-0x00007FFAB5A90000-0x00007FFAB6431000-memory.dmp

Download

memory/3732-0-0x000000001C010000-0x000000001C0B6000-memory.dmp

Download

memory/3732-1-0x00007FFAB5A90000-0x00007FFAB6431000-memory.dmp

Download