nanocore | 4b47ecff546748d8c35339a6608780733736e26ac76deb68971c83841b28710c

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe
Size

2.2MB
MD5

eac33a8ca4b4f6d5f62ad4213cdc8079
SHA1

05a036b00742b23305192f1c3f2044c27c971abc
SHA256

4b47ecff546748d8c35339a6608780733736e26ac76deb68971c83841b28710c
SHA512

0aac29c17ea04f320de30f938f07c563c66cc6d0cde516707215b60ae389c2467fb6d626980115ff5de8044d497790ca8cb2b13cd072036bb97c8f217ef40f76
SSDEEP

49152:Q2GV7D5sm5sy+Ol498fjbK0Amc4JHiMIWH5ddm6d2R16qMNVNLL6:Q2M7D5sm55+OS98fiz4HhH5dI6AcrNLG

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

194.5.97.48:4488

Mutex

0ccdecad-0899-45d4-aa28-34c7e592b23b

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-02-22T00:54:08.580070336Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4488
default_group
PRODUCTS
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
0ccdecad-0899-45d4-aa28-34c7e592b23b
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
194.5.97.48
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Operaa.vbs	notepad.exe

Executes dropped EXE 3 IoCs

pid	Process
2260	test.exe
2832	test.exe
2712	test.exe

Loads dropped DLL 4 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe
2260	test.exe
2260	test.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Host = "C:\\Program Files (x86)\\SCSI Host\\scsihost.exe"	test.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	test.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 2832	2260	test.exe	35

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x00000000008B3000-memory.dmp	upx
behavioral1/files/0x0008000000012102-2.dat	upx
behavioral1/memory/2260-7-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2664-6-0x0000000002420000-0x000000000251E000-memory.dmp	upx
behavioral1/memory/2260-11-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2260-8-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2972-12-0x0000000000400000-0x00000000008B3000-memory.dmp	upx
behavioral1/memory/2712-34-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2712-35-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/2972-33-0x0000000000400000-0x00000000008B3000-memory.dmp	upx
behavioral1/memory/2832-29-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2832-23-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2832-20-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2832-19-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2832-16-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/2260-27-0x00000000031A0000-0x000000000329E000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SCSI Host\scsihost.exe	test.exe
File opened for modification	C:\Program Files (x86)\SCSI Host\scsihost.exe	test.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2832	test.exe
2832	test.exe
2832	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe
2712	test.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	test.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2260	test.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	test.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2664	2972	eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2664	2972	eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2664	2972	eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2664	2972	eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe	31
PID 2664 wrote to memory of 2260	2664	cmd.exe	32
PID 2664 wrote to memory of 2260	2664	cmd.exe	32
PID 2664 wrote to memory of 2260	2664	cmd.exe	32
PID 2664 wrote to memory of 2260	2664	cmd.exe	32
PID 2260 wrote to memory of 2724	2260	test.exe	34
PID 2260 wrote to memory of 2724	2260	test.exe	34
PID 2260 wrote to memory of 2724	2260	test.exe	34
PID 2260 wrote to memory of 2724	2260	test.exe	34
PID 2260 wrote to memory of 2724	2260	test.exe	34
PID 2260 wrote to memory of 2724	2260	test.exe	34
PID 2260 wrote to memory of 2832	2260	test.exe	35
PID 2260 wrote to memory of 2832	2260	test.exe	35
PID 2260 wrote to memory of 2832	2260	test.exe	35
PID 2260 wrote to memory of 2832	2260	test.exe	35
PID 2260 wrote to memory of 2712	2260	test.exe	36
PID 2260 wrote to memory of 2712	2260	test.exe	36
PID 2260 wrote to memory of 2712	2260	test.exe	36
PID 2260 wrote to memory of 2712	2260	test.exe	36
PID 2832 wrote to memory of 2720	2832	test.exe	37
PID 2832 wrote to memory of 2720	2832	test.exe	37
PID 2832 wrote to memory of 2720	2832	test.exe	37
PID 2832 wrote to memory of 2720	2832	test.exe	37
PID 2832 wrote to memory of 2604	2832	test.exe	39
PID 2832 wrote to memory of 2604	2832	test.exe	39
PID 2832 wrote to memory of 2604	2832	test.exe	39
PID 2832 wrote to memory of 2604	2832	test.exe	39

C:\Users\Admin\AppData\Local\Temp\eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac33a8ca4b4f6d5f62ad4213cdc8079_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c test.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\test.exe
    test.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\test.exe
      test.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "SCSI Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD440.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2720
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "SCSI Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD48F.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\test.exe
      "C:\Users\Admin\AppData\Local\Temp\test.exe" 2 2832 259445153
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD440.tmp

Filesize
1KB

MD5
daa959fa3888b5436fb93b6796bc803b

SHA1
43b8b749c623daede8374165806b8354655fa06c

SHA256
da87a4088b0f1dce79ca8128c8275cb6eaf527e571c68a6fb3a0b56576d38344

SHA512
aba76a0d311ad0466c64aac0d8f6ed483d2006dc0f14ac78af6af33b9db920a3735fa9478bb6fc5535f4b5eb9621479ec6f8172e05089c27872016ae08f896f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD48F.tmp

Filesize
1KB

MD5
9a559f229be0944bc3dc813cde333f50

SHA1
0e97c97eea032b499ff060e799581e32beeceb09

SHA256
a63d853679aa655cced3b62a10855c56f9efd9b50770738b408d728008f73330

SHA512
4cbb2f77283500e86ecf79fd2cbd31d10c3af2fcf6c9a557ee0b1edead229dc07d63a5030b60df57458d52ef8c2a42ec199d2d4cdca387400d047df25b593c68

Download Submit
\Users\Admin\AppData\Local\Temp\test.exe

Filesize
556KB

MD5
4f8c873b5d7a91daf870117f1fa7899c

SHA1
fd3157965bd41c96134aa384d3d2a473cd34a928

SHA256
04ca7678a00fe66ce4eeffdbcf8a48974468a874287f013af736541851403eef

SHA512
5bde62b364000257904d9bd2200557df573a78fdd6ff8b26b5ea9a63b6aa43d43a38fe6469fdef849706ebdfdcb0f45518f44ced64cce9c4c87539e85e48d25b

Download Submit
memory/2260-27-0x00000000031A0000-0x000000000329E000-memory.dmp

Filesize
1016KB

Download
memory/2260-7-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2260-11-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2260-10-0x0000000000476000-0x000000000047C000-memory.dmp

Filesize
24KB

Download
memory/2260-8-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2664-6-0x0000000002420000-0x000000000251E000-memory.dmp

Filesize
1016KB

Download
memory/2664-9-0x0000000002420000-0x000000000251E000-memory.dmp

Filesize
1016KB

Download
memory/2712-35-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2712-34-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2724-30-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2724-13-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2832-23-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2832-29-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2832-24-0x0000000000350000-0x0000000000388000-memory.dmp

Filesize
224KB

Download
memory/2832-20-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2832-19-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2832-47-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2832-16-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2832-25-0x0000000000350000-0x0000000000388000-memory.dmp

Filesize
224KB

Download
memory/2832-55-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2972-33-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/2972-0-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download
memory/2972-12-0x0000000000400000-0x00000000008B3000-memory.dmp

Filesize
4.7MB

Download