nanocore | cf7b5bff87c89be9605b7747a603195f997874b8874c8867626bbaeb444d38a9

General

Target

48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
Size

1.0MB
MD5

48fbb875dd0cbb3ae7f145c0f987cc4d
SHA1

c44a58bb0112eb5e6b21e35501462dbb8feafee7
SHA256

cf7b5bff87c89be9605b7747a603195f997874b8874c8867626bbaeb444d38a9
SHA512

0ca5589eb91f5a9f3f14387fa6d0f2186e8d61a194bdd1b9d894c226773d9ae1da8c72a7c5f1715f3909580e7d273dea9a4c2c50e3998492140b98c68ffae463
SSDEEP

24576:ru6Jx3O0c+JY5UZ+XC0kGso/Wai65neExWY:FI0c++OCvkGsUWai+eZY

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

nowyouseeme.ddns.net:4180

nowme.gleeze.com:4180

Mutex

2449e2e0-293a-4268-9590-ad05403a16aa

Attributes

activate_away_mode
true
backup_connection_host
nowme.gleeze.com
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-03-16T22:49:54.051470136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4180
default_group
port nano
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2449e2e0-293a-4268-9590-ad05403a16aa
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
nowyouseeme.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegAsm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegAsm.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\oobeldr\recdisc.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

description pid process target process

PID 1452 set thread context of 2840 1452 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1452 set thread context of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

RegAsm.exe48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

pid	process
2840	RegAsm.exe
2840	RegAsm.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

2840 RegAsm.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

pid process

1452 48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2840 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2840	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

pid	process
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

pid	process
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe

description	pid	process	target process
PID 1452 wrote to memory of 1760	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	cmd.exe
PID 1452 wrote to memory of 1760	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	cmd.exe
PID 1452 wrote to memory of 1760	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	cmd.exe
PID 1452 wrote to memory of 1760	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	cmd.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe
PID 1452 wrote to memory of 2840	1452	48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\48fbb875dd0cbb3ae7f145c0f987cc4d_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\oobeldr\recdisc.exe"
2⤵
PID:1760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\oobeldr\recdisc.exe
Filesize
1.0MB

MD5
e6b968bbc1f3a302759059767dc948bd

SHA1
e1add8da602e0caffc85e259cb2dd49d2fb5c035

SHA256
71c4d4770dd88a0d804e66d483df24b7aa28d686cf05b3df0b33baa050c25d64

SHA512
06572e3da44c000dd0bc5ebea45aae415f2a1826fe8b23720e0e7b100d3520df227ae8542d58feea097fd700b7279cf618cfb60c7196aa031574297509df21e9

Download Submit
memory/1452-8-0x0000000000820000-0x0000000000823000-memory.dmp

Filesize
12KB

Download
memory/1452-12-0x0000000000820000-0x0000000000823000-memory.dmp

Filesize
12KB

Download
memory/2840-3-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2840-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2840-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2840-9-0x0000000074332000-0x0000000074334000-memory.dmp

Filesize
8KB

Download
memory/2840-11-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2840-13-0x0000000074332000-0x0000000074334000-memory.dmp

Filesize
8KB

Download
memory/2840-14-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads