nanocore | a5b286098fc58daf89e3f657c9af4472c9d991c62f48350202171878474ca5dd | Triage

Sharing

General

Target

fb3333ee36d0cda5a9fb458d990faae4_JaffaCakes118
Size

1.1MB
Sample

240928-a6r5za1akc
MD5

fb3333ee36d0cda5a9fb458d990faae4
SHA1

9aa198dafb84de1c3583f79341a470ff8ff12894
SHA256

a5b286098fc58daf89e3f657c9af4472c9d991c62f48350202171878474ca5dd
SHA512

f4b346ba08fc737eb58e13a9fa2e93731b82a10ca65b3403feeb7ec3f3342430da67a2b68458784dd617a4057a9dd6479713a143df8fde4658a31691469344b5
SSDEEP

24576:fb9Eyxn6HqtZKxK8TVG3E6kM9mY+l28pU/h96dR+Q2ituuTS6ifx68j:j9Png2ATTI3Eokl2T9kR+vEFTS6etj

Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.140.53.161:2404

Mutex

42616936-d942-4900-bde0-8c61d205ad87

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-01-16T21:35:27.028614736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2404
default_group
COVID
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
42616936-d942-4900-bde0-8c61d205ad87
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.140.53.161
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  COVID-19 Vaccine Sample.exe
- Size
  
  1.6MB
- MD5
  
  91870ccc3bfca2f49ced895e28ae1844
- SHA1
  
  5ba817e16623c79605ed923033f1ff74633c075f
- SHA256
  
  a88612acfb81cf09772f6bc9d0dccca8c8d5569ea73148e1e6d1fe0381fe5aec
- SHA512
  
  e88c7d313a017fb51ac933818845594bdd29dfd9ab1a7d3d7c04742104ae74217e190231c25711bbfb63fa3df32a858e01c4cc435e4d35e0657bdcef15797aa4
- SSDEEP
  
  24576:LCdxte/80jYLT3U1jfsWaij0xEVEFxxOWHwRMODKjidxuVxdquBW0PkDpCX2rkTQ:Cw80cTsjkWaidWHOKjDx5BvP2k2rV
Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocorediscoverykeyloggerpersistencespywarestealertrojan

behavioral2

nanocorediscoverykeyloggerpersistencespywarestealertrojan