nanocore | 70e210bc41592e3ab3220975fc77ed7596eb70a58339245dff9414e1e2a80a0d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
Size 336KB
Sample240509-fa2bnaea58
SHA256 70e210bc41592e3ab3220975fc77ed7596eb70a58339245dff9414e1e2a80a0d
MD5 28560dcceb5bc2dfa2a49be58b030f9e
SHA1 6298e666550aada690aa5f19c7f253651155ed15
SHA512 702141ccd07603e7ad4c06d096e8f51bfdb2f37b21f7f4316c41c9d0d935e9b2203e31b31a623ade5ca921a6bd8ab1b4c5a9ff1eab5bf3e4b5f207b181013b53
SSDEEP 6144:TYbDJEl0NMB1SKTanUj1Nfnt3DGydOGM9Zu4BtGGGGGGGGHGGGGGGGGGGGGGGGGl:uElgMn7YUpxtyydOGYZu4s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

185.109.170.248:54984
127.0.0.1:54984

Mutex

4c1202eb-d78e-4f4a-9d98-e1561a978212

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-06-06T20:06:06.424766136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
steam
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4c1202eb-d78e-4f4a-9d98-e1561a978212
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.109.170.248
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	svhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svhost.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
2560	svhost.exe
2560	svhost.exe
2560	svhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
Token: SeDebugPrivilege	2560	svhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 3252	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	95
PID 968 wrote to memory of 3252	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	95
PID 968 wrote to memory of 3252	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	95
PID 3252 wrote to memory of 4868	3252	cmd.exe	97
PID 3252 wrote to memory of 4868	3252	cmd.exe	97
PID 3252 wrote to memory of 4868	3252	cmd.exe	97
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98
PID 968 wrote to memory of 2560	968	28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28560dcceb5bc2dfa2a49be58b030f9e_JaffaCakes118.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
    3⤵
    PID:4868
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

name.exe

Path C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe
Size 336KB
SHA256 70e210bc41592e3ab3220975fc77ed7596eb70a58339245dff9414e1e2a80a0d
MD5 28560dcceb5bc2dfa2a49be58b030f9e
SHA1 6298e666550aada690aa5f19c7f253651155ed15
SHA512 702141ccd07603e7ad4c06d096e8f51bfdb2f37b21f7f4316c41c9d0d935e9b2203e31b31a623ade5ca921a6bd8ab1b4c5a9ff1eab5bf3e4b5f207b181013b53
SSDEEP 6144:TYbDJEl0NMB1SKTanUj1Nfnt3DGydOGM9Zu4BtGGGGGGGGHGGGGGGGGGGGGGGGGl:uElgMn7YUpxtyydOGYZu4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
Size 89KB
SHA256 331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3
MD5 84c42d0f2c1ae761bef884638bc1eacd
SHA1 4353881e7f4e9c7610f4e0489183b55bb58bb574
SHA512 43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87
SSDEEP 1536:H96ZJwk1oO+huJs4HN0Auo7G+DKSOanlgVO3GGLJ:IMFCHV1G+DKSOanlEud
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-16-0x0000000074B12000-0x0000000074B13000-memory.dmp

Download

memory/968-2-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/968-1-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/968-0-0x0000000074B12000-0x0000000074B13000-memory.dmp

Download

memory/968-21-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/968-24-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/2560-13-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2560-17-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/2560-18-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/2560-19-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/2560-22-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/2560-25-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/2560-26-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download