nanocore | e9e0f7468a14cadd1a46ab016750820dc31be1c397f1f0b8fbee9aa0b6689ed4 | Triage

Sharing

General

Target

5e2273cbdca381865b11ae2b3385b095_JaffaCakes118
Size

1.9MB
Sample

241019-xje88athlk
MD5

5e2273cbdca381865b11ae2b3385b095
SHA1

a188b1ba45f165f71ed9db93694786cd1c2d57e3
SHA256

e9e0f7468a14cadd1a46ab016750820dc31be1c397f1f0b8fbee9aa0b6689ed4
SHA512

c151bc42e3cdf67206207a6f4f4dc964a5fae74c8d6b05a34d4f9b4be453ad80153e5eb25c4072dc0e0d36521ff2cf03e017999fb14af22eaff3907e0decfefc
SSDEEP

24576:hyvg4dVmis+ApQsxMAe9KC/ONZTkbo1cwHFX7owhZTctoqODY2+vck:8Vin+WzxMAe9K4ONxkcH2QZTIODa

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  5e2273cbdca381865b11ae2b3385b095_JaffaCakes118
- Size
  
  1.9MB
- MD5
  
  5e2273cbdca381865b11ae2b3385b095
- SHA1
  
  a188b1ba45f165f71ed9db93694786cd1c2d57e3
- SHA256
  
  e9e0f7468a14cadd1a46ab016750820dc31be1c397f1f0b8fbee9aa0b6689ed4
- SHA512
  
  c151bc42e3cdf67206207a6f4f4dc964a5fae74c8d6b05a34d4f9b4be453ad80153e5eb25c4072dc0e0d36521ff2cf03e017999fb14af22eaff3907e0decfefc
- SSDEEP
  
  24576:hyvg4dVmis+ApQsxMAe9KC/ONZTkbo1cwHFX7owhZTctoqODY2+vck:8Vin+WzxMAe9K4ONxkcH2QZTIODa
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan