nanocore | 6b4ce1649c121bab266d5d796745aba15265825f22a9f5993dd235d5593fe00d | Triage

Sharing

General

Target

cfeeb9ac1723268e546a4420f526ee07_JaffaCakes118
Size

1.3MB
Sample

240906-tma7wswdqb
MD5

cfeeb9ac1723268e546a4420f526ee07
SHA1

d09bc6b8ef47412e8a7dfe5a4108e4fda6e3dcb8
SHA256

6b4ce1649c121bab266d5d796745aba15265825f22a9f5993dd235d5593fe00d
SHA512

3ad64a71037a0171b0d02d63647165fa39c7c8e6c1e7c1344bd2ed5e16d062099e1e2dade958e51c15f0510460fdfbf014fe438d430132c17450849359418e99
SSDEEP

24576:3u6Jx3O0c+JY5UZ+XC0kGso/WaTaSGmWkMl+77kFWY:RI0c++OCvkGsUWaT17FY

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

46.183.222.66:2580

Mutex

1c961eb9-fc89-4ae9-bc50-1e96626aedd3

Attributes

activate_away_mode
true
backup_connection_host
46.183.222.66
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-08-31T00:13:27.469819636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2580
default_group
NOV 12
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
1c961eb9-fc89-4ae9-bc50-1e96626aedd3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
46.183.222.66
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  cfeeb9ac1723268e546a4420f526ee07_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  cfeeb9ac1723268e546a4420f526ee07
- SHA1
  
  d09bc6b8ef47412e8a7dfe5a4108e4fda6e3dcb8
- SHA256
  
  6b4ce1649c121bab266d5d796745aba15265825f22a9f5993dd235d5593fe00d
- SHA512
  
  3ad64a71037a0171b0d02d63647165fa39c7c8e6c1e7c1344bd2ed5e16d062099e1e2dade958e51c15f0510460fdfbf014fe438d430132c17450849359418e99
- SSDEEP
  
  24576:3u6Jx3O0c+JY5UZ+XC0kGso/WaTaSGmWkMl+77kFWY:RI0c++OCvkGsUWaT17FY
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan