nanocore | 187cbb78da4f5243104761c4915f9383ef0ace87c8afb0199e9cb8c99f46ffd1

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
Size

1.1MB
MD5

d551d69690bafce20d6785ca09a212de
SHA1

3bc295ab9dc3b2489110bd257b6a670fc0658bc8
SHA256

187cbb78da4f5243104761c4915f9383ef0ace87c8afb0199e9cb8c99f46ffd1
SHA512

a4084248936bc316ad6f5f49926bf1ef274c65c703677fa049bb8ad497deb84cadb5b93c98b16c3fdc1c91cd148a40c72353d109b13217c2ccf8ad375b743c4e
SSDEEP

24576:bNA3R5drXad7+o0xab9qHt/2kybJdUc1jZFQYcHO6l1l:G5C7/0xK9U/2kybJX1jZ63Tl

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

happiwrk.duckdns.org:54984

Mutex

5164f7d3-5334-47c4-9d99-912c6c0e78b2

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-11-26T00:18:31.690294336Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
EKE20
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
5164f7d3-5334-47c4-9d99-912c6c0e78b2
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
happiwrk.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 2 IoCs

pid	Process
2132	nqodgtlmm.exe
2572	RegSvcs.exe

Loads dropped DLL 5 IoCs

pid	Process
2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
2132	nqodgtlmm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\E8948G~1\\NQODGT~1.EXE C:\\Users\\Admin\\E8948G~1\\NXUJKR~1.XHC"	nqodgtlmm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 2572	2132	nqodgtlmm.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nqodgtlmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2572	RegSvcs.exe
2572	RegSvcs.exe
2572	RegSvcs.exe
2572	RegSvcs.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2572	RegSvcs.exe
2572	RegSvcs.exe
2572	RegSvcs.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe
2132	nqodgtlmm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2132	2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2132	2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2132	2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2132	2876	d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2132 wrote to memory of 2572	2132	nqodgtlmm.exe	31
PID 2572 wrote to memory of 2784	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 2784	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 2784	2572	RegSvcs.exe	32
PID 2572 wrote to memory of 2784	2572	RegSvcs.exe	32

C:\Users\Admin\AppData\Local\Temp\d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d551d69690bafce20d6785ca09a212de_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\e8948g1482\nqodgtlmm.exe
  "C:\Users\Admin\e8948g1482\nqodgtlmm.exe" nxujkrdul.xhc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "LAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8112.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8112.tmp

Filesize
1KB

MD5
95aceabc58acad5d73372b0966ee1b35

SHA1
2293b7ad4793cf574b1a5220e85f329b5601040a

SHA256
8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4

SHA512
00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74

Download Submit
C:\Users\Admin\E8948G~1\oovw.exe

Filesize
457KB

MD5
277ebfb902d352d45193101f2f0ddc87

SHA1
aaa3ac82b89d4e472133a6cea2c3a9511ef42f39

SHA256
60bdd5e27062608c2178f23d902e83f4aaebabdc8e2e2bda595fb0fa2d8de1fe

SHA512
6329aa3da7ad7e308485d69bfbb9d6585120b3ffb5568f3d230cc632895c32bdfff5301cbd3f12bfc6562080ed80e967ae98fd6a5bb75a87aeae8bc5d760e93e

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Filesize
44KB

MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
\Users\Admin\e8948g1482\nqodgtlmm.exe

Filesize
646KB

MD5
a3e8113ff31e86152d4a384dab4ea102

SHA1
28cabe6b57d14f6dd47a880c51bc9726d017989f

SHA256
d06ea150b0a83b9cf2ef63fdafc9e79a23bfa004c9f42d526499329e0ab1c977

SHA512
f34d79e3984e819c2e86e9b75c27985f7f4d8696bd3bf18447b697e127db3f76c707369336925ae941f95053d4e83d1684356d479be2295114d654bb24efb290

Download Submit
memory/2572-133-0x0000000000900000-0x0000000001900000-memory.dmp

Filesize
16.0MB

Download
memory/2572-139-0x0000000000900000-0x0000000001900000-memory.dmp

Filesize
16.0MB

Download
memory/2572-136-0x0000000000900000-0x0000000001900000-memory.dmp

Filesize
16.0MB

Download
memory/2572-141-0x0000000000900000-0x0000000000938000-memory.dmp

Filesize
224KB

Download
memory/2572-138-0x0000000000900000-0x0000000001900000-memory.dmp

Filesize
16.0MB

Download
memory/2572-135-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-146-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2572-147-0x000000000E6B0000-0x000000000E6CE000-memory.dmp

Filesize
120KB

Download
memory/2572-148-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download