nanocore | 141fb77e52e888c7b37e5e3a8d8f07a7858a71430da0daa4563088adae1064db

General

Target

f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe
Size

792KB
MD5

f50a221ffb7eb3641ebf3f3be8630f63
SHA1

3cddb6a3baea846b7a02de2796fab42a0c14f05f
SHA256

141fb77e52e888c7b37e5e3a8d8f07a7858a71430da0daa4563088adae1064db
SHA512

df37e56c9937806b675e48d28c6555454e7bf25b587c8db56b51a1af593a45bdc7aca39dcbd5bd02428f4c9fc3712a46a92c178a32457a7c27cde7fb325c0baa
SSDEEP

24576:gNR2zaQBt37/CZ0w1PeWnzqhqCC6+PEhd:FUsrC6aEL

Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

Prince.jumpingcrab.com:1223

185.125.205.90:1223

Mutex

931b30f5-34a9-4550-be3d-24ac3ab0a06d

Attributes

activate_away_mode
true
backup_connection_host
185.125.205.90
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-08-10T02:52:49.622793536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1223
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
931b30f5-34a9-4550-be3d-24ac3ab0a06d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
Prince.jumpingcrab.com
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3032	RegAsm.exe
3032	RegAsm.exe
3032	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	RegAsm.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe
2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe
2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29
PID 2320 wrote to memory of 3032	2320	f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\Microsoft.NeT\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NeT\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3032-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3032-15-0x0000000073D32000-0x0000000073D34000-memory.dmp

Filesize
8KB

Download
memory/3032-17-0x0000000073D30000-0x00000000742DB000-memory.dmp

Filesize
5.7MB

Download
memory/3032-18-0x0000000073D32000-0x0000000073D34000-memory.dmp

Filesize
8KB

Download
memory/3032-19-0x0000000073D30000-0x00000000742DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing