nanocore | e526eb649ee6c8fe974afbd1fcd3ed6a8e27d6fb27b3ba96185d8ab0d8327b42

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe
Size

202KB
MD5

6d5aa4c20470b9cb865a8e2feacda571
SHA1

287f44407fc1495b9a41262d82c6d8ef9e08e4f7
SHA256

e526eb649ee6c8fe974afbd1fcd3ed6a8e27d6fb27b3ba96185d8ab0d8327b42
SHA512

9680d1ae30b8b08aa76470d818bcc44a0aff0ceaf8ee910cecba1242542a8fd049b3d59146a82033991a501dccfd318f4f50c326f0a775548280913d9b7087ee
SSDEEP

6144:wLV6Bta6dtJmakIM5fH6gBY3GP5yY3qBj:wLV6Btpmkiu3GxyY3U

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Subsystem = "C:\\Program Files (x86)\\DPI Subsystem\\dpiss.exe"	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

Processes:

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\DPI Subsystem\dpiss.exe	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe
File created	C:\Program Files (x86)\DPI Subsystem\dpiss.exe	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

pid	process
4288	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe
4288	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe
4288	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

pid process

4288 6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4288 6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4288	6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d5aa4c20470b9cb865a8e2feacda571_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4288-0-0x0000000074C42000-0x0000000074C43000-memory.dmp

Filesize
4KB

Download
memory/4288-1-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4288-2-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4288-5-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4288-6-0x0000000074C42000-0x0000000074C43000-memory.dmp

Filesize
4KB

Download
memory/4288-7-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download
memory/4288-8-0x0000000074C40000-0x00000000751F1000-memory.dmp

Filesize
5.7MB

Download