nanocore | 771334bd01a06601b750820a20126a9626070981e6e28eb534df4d7c4b055daf

General

Target

a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
Size

924KB
MD5

a041b29365f66b16f667638f556d4ef2
SHA1

f5432b8ff90d9572cdde9513bcaa4d36f9405b0e
SHA256

771334bd01a06601b750820a20126a9626070981e6e28eb534df4d7c4b055daf
SHA512

3b79a83ff24b92681c23b848ff6d8e8394fa2f15848c376df6a39ce1b500e0d9303f18244e89cc6706b8abe952b460edf85dd970ed145f8914da57c18970ade0
SSDEEP

24576:YkXh6RxJAwuqu8y53pqUj5urWBw9+B6gbgIBNbOduHoHsGV4/xbvB7LHIPbgFZC8:tVqkud9L9AD3qoj

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

91.192.100.31:8456

Mutex

909139fe-151a-4f93-9a99-ef8fd273e96d

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-07-17T08:14:00.597274136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8456
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
909139fe-151a-4f93-9a99-ef8fd273e96d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
91.192.100.31
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegAsm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe

description pid process target process

PID 2256 set thread context of 1984 2256 a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe RegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegAsm.exe

description	pid	process	target process
PID 2256 set thread context of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exeRegAsm.exe

pid	process
2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
1984	RegAsm.exe
1984	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

1984 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2256 a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
Token: SeDebugPrivilege 1984 RegAsm.exe

pid	process
1984	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
Token: SeDebugPrivilege	1984	RegAsm.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe

description	pid	process	target process
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2644	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 3000	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 2424	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe
PID 2256 wrote to memory of 1984	2256	a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a041b29365f66b16f667638f556d4ef2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:2644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:3000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-18-0x0000000073F20000-0x00000000744CB000-memory.dmp

Filesize
5.7MB

Download
memory/1984-16-0x0000000073F20000-0x00000000744CB000-memory.dmp

Filesize
5.7MB

Download
memory/1984-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1984-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1984-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2256-0-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/2256-1-0x0000000000840000-0x0000000000912000-memory.dmp

Filesize
840KB

Download
memory/2256-4-0x0000000000480000-0x00000000004B8000-memory.dmp

Filesize
224KB

Download
memory/2256-3-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/2256-2-0x0000000000440000-0x0000000000484000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing