nanocore | 981bf80cedb5679292cda058da7440dc3dc3547dd2eddbb2563be6cfde3096a9

General

Target

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
Size

513KB
MD5

3d2758a270a4fe2d63b36a6bf08cb528
SHA1

c8622e804deefb10bdca0de5a0002482e280da9d
SHA256

981bf80cedb5679292cda058da7440dc3dc3547dd2eddbb2563be6cfde3096a9
SHA512

5f97b089089ef1fdca77827addb869074d418a7fa5a464a501b312b4ffa9a18f7efa7b9740b3e7ca07495e066012dccfc18e18ab8b526b208853006ecd732ef1
SSDEEP

6144:/JcN3LE4z4O2kQTAOhBNDtd7ay5pPFiHM7oBtBZHx:/Jc9LHGRAOhBp7ay/oBZ

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

dbesth1.ddns.net:3454

185.209.85.68:3454

Mutex

34f3a11c-3f07-44df-b634-694c0e42e1aa

Attributes

activate_away_mode
true
backup_connection_host
185.209.85.68
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-03-23T11:27:01.916576136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
3454
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
34f3a11c-3f07-44df-b634-694c0e42e1aa
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
dbesth1.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
4991
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	pid	process	target process
PID 2820 set thread context of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2580 schtasks.exe

pid	process
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

pid	process
2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
2672	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
2672	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

pid process

2672 3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

pid	process
2672	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
Token: SeDebugPrivilege	2672	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	pid	process	target process
PID 2820 wrote to memory of 2580	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 2580	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 2580	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 2580	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2820 wrote to memory of 2672	2820	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "YQVKBHP\YQVKBHP" /XML "C:\Users\Admin\AppData\Roaming\YQVKBHP\aQQQQQ.xml"
2⤵
- Creates scheduled task(s)
PID:2580

C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2672

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\YQVKBHP\aQQQQQ.xml
Filesize
1KB

MD5
7eb71103477fa7fba3cf1b53ddff5d87

SHA1
f8f3ca9e4ea4adc8e38744ab216671c8bb04b875

SHA256
ed311785f342ba80e51c8e8c94e1b9bdf9e5dc02477550d04f74c49cc2ea4ab2

SHA512
f25da48a89a1b67ace7cf5056f5701062d2ac7f1ed8e1cbfe89f4786970cfbbc0c5ec06d260a7ac7084dd3d2fae9caed33ea385d52c4e6529efa2bcd6bb63482

Download Submit
memory/2672-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-27-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-25-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2820-24-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2820-2-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download
memory/2820-0-0x0000000074991000-0x0000000074992000-memory.dmp

Filesize
4KB

Download
memory/2820-1-0x0000000074990000-0x0000000074F3B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads