nanocore | 981bf80cedb5679292cda058da7440dc3dc3547dd2eddbb2563be6cfde3096a9

General

Target

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
Size

513KB
MD5

3d2758a270a4fe2d63b36a6bf08cb528
SHA1

c8622e804deefb10bdca0de5a0002482e280da9d
SHA256

981bf80cedb5679292cda058da7440dc3dc3547dd2eddbb2563be6cfde3096a9
SHA512

5f97b089089ef1fdca77827addb869074d418a7fa5a464a501b312b4ffa9a18f7efa7b9740b3e7ca07495e066012dccfc18e18ab8b526b208853006ecd732ef1
SSDEEP

6144:/JcN3LE4z4O2kQTAOhBNDtd7ay5pPFiHM7oBtBZHx:/Jc9LHGRAOhBp7ay/oBZ

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

dbesth1.ddns.net:3454

185.209.85.68:3454

Mutex

34f3a11c-3f07-44df-b634-694c0e42e1aa

Attributes

activate_away_mode
true
backup_connection_host
185.209.85.68
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-03-23T11:27:01.916576136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
3454
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
34f3a11c-3f07-44df-b634-694c0e42e1aa
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
dbesth1.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
4991
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	pid	process	target process
PID 2992 set thread context of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1664 schtasks.exe

pid	process
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

pid	process
2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
1984	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
1984	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
1984	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

pid process

1984 3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

pid	process
1984	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
Token: SeDebugPrivilege	1984	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

description	pid	process	target process
PID 2992 wrote to memory of 1664	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2992 wrote to memory of 1664	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2992 wrote to memory of 1664	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	schtasks.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
PID 2992 wrote to memory of 1984	2992	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe	3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "YQVKBHP\YQVKBHP" /XML "C:\Users\Admin\AppData\Roaming\YQVKBHP\aZZZZZ.xml"
2⤵
- Creates scheduled task(s)
PID:1664

C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\3d2758a270a4fe2d63b36a6bf08cb528_JaffaCakes118.exe.log
Filesize
223B

MD5
1cc4c5b51e50ec74a6880b50ecbee28b

SHA1
1ba7bb0e86c3d23fb0dc8bf16798d37afb4c4aba

SHA256
0556734df26e82e363d47748a3ceedd5c23ea4b9ded6e68bd5c373c1c9f8777b

SHA512
5d5532602b381125b24a9bd78781ed722ce0c862214ef17e7d224d269e6e7045c919ab19896dd8d9ae8920726092efe0ffb776a77a9a9539c4a70188d5a4c706

Download Submit
C:\Users\Admin\AppData\Roaming\YQVKBHP\aZZZZZ.xml
Filesize
1KB

MD5
c1d6a1f5e7b36c0d94f7cbf85fd7d05f

SHA1
30876a19c135f8874fa94a408559e795bb9fb3b6

SHA256
bdce1f2a78df1a16c36edcfdf7a89a3eef478e30a36dbe18aeaad1d1fa9e3cdf

SHA512
f4edf5186ad85cac1f44178a4e3aacf572ef948b21a8f0ce9470c24a8077d4fd78cd36e7274665d3eb5bbe28e05373fa64c7f3ff474e6c0747c9712494ea37ef

Download Submit
memory/1984-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-13-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1984-15-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1984-14-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1984-17-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1984-18-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1984-19-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/2992-2-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/2992-0-0x0000000074A02000-0x0000000074A03000-memory.dmp

Filesize
4KB

Download
memory/2992-1-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/2992-12-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads