nanocore | 824821e1c3ec150289f73e5b86cf7c74e2eda961379a5cdb44e5263fb11fcdff

General

Target

33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe
Size

782KB
MD5

33fca0a153bd0201302cc6de94acaee5
SHA1

2d37ec74bf416ccdd5ce0c7d4afdbbd62642e188
SHA256

824821e1c3ec150289f73e5b86cf7c74e2eda961379a5cdb44e5263fb11fcdff
SHA512

0ca4b62a8436720c6e73856fc81d6b3748bca80b549594773fef27d563ac7ff9b106bc78477ac58380887c5809fb43c4dc044df2940b42b720d3006ea4e6d63e
SSDEEP

12288:PZoGfI9Pr0azt+xKaMjKlTzNkeAC3M5pZN7gfRix6r:Po9PPz04QlTzN

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.202.175.61:2231

blessnetw123.publicvm.com:2231

Mutex

41194ca9-df3e-4ee6-a73c-8b59a32a4e7c

Attributes

activate_away_mode
true
backup_connection_host
blessnetw123.publicvm.com
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-08-05T15:06:22.523121636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2231
default_group
ME$IK
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
41194ca9-df3e-4ee6-a73c-8b59a32a4e7c
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.202.175.61
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

installutil.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	installutil.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

installutil.exe

description pid process target process

PID 1136 set thread context of 2572 1136 installutil.exe installutil.exe

description	pid	process	target process
PID 1136 set thread context of 2572	1136	installutil.exe	installutil.exe

Drops file in Program Files directory 2 IoCs

Processes:

installutil.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	installutil.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	installutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2452 schtasks.exe
2624 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

installutil.exeinstallutil.exe

pid process

1136 installutil.exe
2572 installutil.exe
2572 installutil.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

installutil.exe

pid process

2572 installutil.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

installutil.exeinstallutil.exe

description pid process

Token: SeDebugPrivilege 1136 installutil.exe
Token: SeDebugPrivilege 2572 installutil.exe

pid	process
2452	schtasks.exe
2624	schtasks.exe

pid	process
1136	installutil.exe
2572	installutil.exe
2572	installutil.exe

pid	process
2572	installutil.exe

description	pid	process
Token: SeDebugPrivilege	1136	installutil.exe
Token: SeDebugPrivilege	2572	installutil.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exeinstallutil.exeinstallutil.exe

description	pid	process	target process
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 2416 wrote to memory of 1136	2416	33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 1136 wrote to memory of 2572	1136	installutil.exe	installutil.exe
PID 2572 wrote to memory of 2452	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2452	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2452	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2452	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2624	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2624	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2624	2572	installutil.exe	schtasks.exe
PID 2572 wrote to memory of 2624	2572	installutil.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\33fca0a153bd0201302cc6de94acaee5_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"
3⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7F7C.tmp"
4⤵
- Creates scheduled task(s)
PID:2452

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8067.tmp"
4⤵
- Creates scheduled task(s)
PID:2624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7F7C.tmp
Filesize
1KB

MD5
776580d2028b74ed89bb21146482bdff

SHA1
d1a45290dedde63d8539a2fc8af866b430238bc7

SHA256
fbad359469fc6aefb5695d01974f4edf50528f51f80d57b9eb0d8f2f81033cc0

SHA512
de084f473db26ce159b639b02e7ffa263ae5b6c4c1da9f6932676dae4a6c65f082b1bcac673c45c2e2b84caa06d1860ea6f0545b81fd7b3e4f8fe5e802a160d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8067.tmp
Filesize
1KB

MD5
93fc3117767507c9889abd12dc667d22

SHA1
1096e4cfa0c35756e3c3fb866c1e4c1e59115df9

SHA256
684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a

SHA512
e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

Download Submit
memory/1136-22-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-5-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-4-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-6-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/1136-7-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-1-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-2-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-3-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-0-0x00000000747D1000-0x00000000747D2000-memory.dmp

Filesize
4KB

Download
memory/2572-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-23-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2572-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-24-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2572-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2572-32-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads