nanocore | 875f4d76e04760152792fddf09287455f38338fec927995d4227c0ff779ce2e4

General

Target

50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
Size

463KB
MD5

50333dad192d9888ce17fa31bd466256
SHA1

0e13f68a360abd1e3e2f8e3601ed0bf1641196f0
SHA256

875f4d76e04760152792fddf09287455f38338fec927995d4227c0ff779ce2e4
SHA512

c3e9529180fb4327305de547e154fd720a9574ce3dbb97a09f07613255aa3b37b4f5aa97da3ca4e424d9dcbf320c783816b0c2453e5852cc1397fffef12a13e3
SSDEEP

6144:cbiYCMinOZCVn3PzN2bZB8gpqECIm0ROn49SY851EkTH6z26nGgvkfA77juvpMh2:AWMQtJ32qEZRzSYWvzlPfA7Xu

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

spoolsv.exespoolsv.exe

pid process

2328 spoolsv.exe
2512 spoolsv.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exespoolsv.exe

pid process

2216 cmd.exe
2328 spoolsv.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

spoolsv.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe

pid	process
2328	spoolsv.exe
2512	spoolsv.exe

pid	process
2216	cmd.exe
2328	spoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

50333dad192d9888ce17fa31bd466256JaffaCakes118.exespoolsv.exe

description	pid	process	target process
PID 940 set thread context of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 2328 set thread context of 2512	2328	spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2076 PING.EXE

pid	process
2076	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

50333dad192d9888ce17fa31bd466256JaffaCakes118.exe50333dad192d9888ce17fa31bd466256JaffaCakes118.exespoolsv.exespoolsv.exe

pid	process
940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
2328	spoolsv.exe
2512	spoolsv.exe
2512	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

spoolsv.exe

pid process

2512 spoolsv.exe

pid	process
2512	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

50333dad192d9888ce17fa31bd466256JaffaCakes118.exe50333dad192d9888ce17fa31bd466256JaffaCakes118.exespoolsv.exespoolsv.exe

description	pid	process
Token: SeDebugPrivilege	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
Token: SeDebugPrivilege	2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
Token: SeDebugPrivilege	2328	spoolsv.exe
Token: SeDebugPrivilege	2512	spoolsv.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

50333dad192d9888ce17fa31bd466256JaffaCakes118.exe50333dad192d9888ce17fa31bd466256JaffaCakes118.execmd.exespoolsv.exe

description	pid	process	target process
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 940 wrote to memory of 2772	940	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
PID 2772 wrote to memory of 2216	2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	cmd.exe
PID 2772 wrote to memory of 2216	2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	cmd.exe
PID 2772 wrote to memory of 2216	2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	cmd.exe
PID 2772 wrote to memory of 2216	2772	50333dad192d9888ce17fa31bd466256JaffaCakes118.exe	cmd.exe
PID 2216 wrote to memory of 2076	2216	cmd.exe	PING.EXE
PID 2216 wrote to memory of 2076	2216	cmd.exe	PING.EXE
PID 2216 wrote to memory of 2076	2216	cmd.exe	PING.EXE
PID 2216 wrote to memory of 2076	2216	cmd.exe	PING.EXE
PID 2216 wrote to memory of 2328	2216	cmd.exe	spoolsv.exe
PID 2216 wrote to memory of 2328	2216	cmd.exe	spoolsv.exe
PID 2216 wrote to memory of 2328	2216	cmd.exe	spoolsv.exe
PID 2216 wrote to memory of 2328	2216	cmd.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe
PID 2328 wrote to memory of 2512	2328	spoolsv.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50333dad192d9888ce17fa31bd466256JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\50333dad192d9888ce17fa31bd466256JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50333dad192d9888ce17fa31bd466256JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 8000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\50333dad192d9888ce17fa31bd466256JaffaCakes118.exe"&start C:\Users\Admin\AppData\Roaming\Adobe\Vault\spoolsv.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 8000
4⤵
- Runs ping.exe
PID:2076

C:\Users\Admin\AppData\Roaming\Adobe\Vault\spoolsv.exe
C:\Users\Admin\AppData\Roaming\Adobe\Vault\spoolsv.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328

C:\Users\Admin\AppData\Roaming\Adobe\Vault\spoolsv.exe
"C:\Users\Admin\AppData\Roaming\Adobe\Vault\spoolsv.exe"
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Vault\spoolsv.exe
Filesize
463KB

MD5
50333dad192d9888ce17fa31bd466256

SHA1
0e13f68a360abd1e3e2f8e3601ed0bf1641196f0

SHA256
875f4d76e04760152792fddf09287455f38338fec927995d4227c0ff779ce2e4

SHA512
c3e9529180fb4327305de547e154fd720a9574ce3dbb97a09f07613255aa3b37b4f5aa97da3ca4e424d9dcbf320c783816b0c2453e5852cc1397fffef12a13e3

Download Submit
memory/940-1-0x0000000074280000-0x000000007482B000-memory.dmp

Filesize
5.7MB

Download
memory/940-2-0x0000000074280000-0x000000007482B000-memory.dmp

Filesize
5.7MB

Download
memory/940-43-0x0000000074280000-0x000000007482B000-memory.dmp

Filesize
5.7MB

Download
memory/940-0-0x0000000074281000-0x0000000074282000-memory.dmp

Filesize
4KB

Download
memory/2512-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2512-41-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2512-42-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2772-6-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-12-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-7-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-21-0x0000000074280000-0x000000007482B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-22-0x0000000074280000-0x000000007482B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-24-0x0000000074280000-0x000000007482B000-memory.dmp

Filesize
5.7MB

Download
memory/2772-13-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-17-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-20-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-4-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download
memory/2772-9-0x0000000000080000-0x00000000000C6000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads