nanocore | d601e0e786396579498c7f143d9a3dd18c1b094acb54208781e5a0a93630e810

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe
Size 700KB
Sample240928-pmxcxaycld
SHA256 d601e0e786396579498c7f143d9a3dd18c1b094acb54208781e5a0a93630e810
MD5 fc4be56565a028b5951a712d02ffc543
SHA1 20c1df245e681f90ab151e88aa5897aa3df51218
SHA512 30aa17280be5ab75d8bbafe5e4588b3e2d30b053f63fd68f35cc4790c8e69c4a154556023ad9c74881c9773d727c66305f7bd39c5cd82fef91ac101c8a75a0f9
SSDEEP 6144:OlUUm/cPUQ5BjRr9pu0g0U8EeJgDv7EC3Zhvm2dJXJLX8kGekn1YdEzp8GS:6UB/CB9r9kWJGvDpN/dTQ1C+PS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore discovery keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 1280	4652	installutil.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4652	installutil.exe
4652	installutil.exe
1280	installutil.exe
1280	installutil.exe
1280	installutil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	installutil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	installutil.exe
Token: SeDebugPrivilege	1280	installutil.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4652	4908	fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe	82
PID 4908 wrote to memory of 4652	4908	fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe	82
PID 4908 wrote to memory of 4652	4908	fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe	82
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 4652 wrote to memory of 1280	4652	installutil.exe	92
PID 1280 wrote to memory of 1888	1280	installutil.exe	93
PID 1280 wrote to memory of 1888	1280	installutil.exe	93
PID 1280 wrote to memory of 1888	1280	installutil.exe	93

C:\Users\Admin\AppData\Local\Temp\fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\fc4be56565a028b5951a712d02ffc543_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DNS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF637.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installutil.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\installutil.exe.log
Size 810B
SHA256 3e869a0a1c7bf2a7a88aa3d88c1f2ee467e9a7cbb04e736c06f6ff8707ceb5a1
MD5 f3b51c9f33e1fffd6ec3e1553576a7ea
SHA1 9f1770bc263331601f060491c574a44c5c530c63
SHA512 eb00b0648d5d872f972e2d92c9d92cedd4fb0097a9cf86a3d8ed6a857283dcc74c1bd0b24dc4a6c54f844374b5378f218f913185e8ad0cc22c32d6729c35d504
MD5 SHA1 SHA512

Submit Download

tmpF637.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF637.tmp
Size 1KB
SHA256 fbad359469fc6aefb5695d01974f4edf50528f51f80d57b9eb0d8f2f81033cc0
MD5 776580d2028b74ed89bb21146482bdff
SHA1 d1a45290dedde63d8539a2fc8af866b430238bc7
SHA512 de084f473db26ce159b639b02e7ffa263ae5b6c4c1da9f6932676dae4a6c65f082b1bcac673c45c2e2b84caa06d1860ea6f0545b81fd7b3e4f8fe5e802a160d3
MD5 SHA1 SHA512

Submit Download

memory/1280-20-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/1280-15-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/1280-14-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/1280-13-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4652-5-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4652-8-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4652-9-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4652-6-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4652-12-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4652-7-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4908-0-0x0000000074B92000-0x0000000074B93000-memory.dmp

Download

memory/4908-4-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4908-2-0x0000000074B90000-0x0000000075141000-memory.dmp

Download

memory/4908-1-0x0000000074B90000-0x0000000075141000-memory.dmp

Download