nanocore | 332ed43c195f4a2f045a5269e2180ede202be688519160561c83d0584d353069

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
j88vip.host.exe
Size 203KB
Sample260605-srmwtabx2j
SHA256 332ed43c195f4a2f045a5269e2180ede202be688519160561c83d0584d353069
MD5 f39d6c7e6565a098d510f5e4afa546b7
SHA1 02002842034e9273affdd12ad0d95bd8827bea96
SHA512 def0c48fdb3e4dbaa7d4072144b1fc20c0364319ae2023f98010069d8343e1c6390096780fa2cb2f45ee2fd6b3f6505618f3cd1bf3d52ddb093d77d0dfcbc56a
SSDEEP 3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIM+Cw9JwT41pn0vDajY0bHLm42:ULV6Bta6dtJmakIM5YVnoD8HiV9L
TLSH
T18514CF163BB94A2FE2DE8679212202528778C2E399C3F3DF18E455B75F163E44A0B1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

j88vip.host:443

Mutex

3afdea7f-bcc3-4d6b-95aa-6b25c91628a3

Attributes

activate_away_mode
false
backup_connection_host
j88vip.host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2026-03-17T17:00:05.380637636Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
3985
connection_port
443
default_group
j88vip.host
enable_debug_mode
false
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
3afdea7f-bcc3-4d6b-95aa-6b25c91628a3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
j88vip.host
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
3236	ddpsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsvc.exe"	j88vip.host.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	j88vip.host.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DDP Service\ddpsvc.exe	j88vip.host.exe
File opened for modification	C:\Program Files (x86)\DDP Service\ddpsvc.exe	j88vip.host.exe
File opened for modification	C:\Program Files (x86)\DDP Service\client.log	ddpsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j88vip.host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j88vip.host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddpsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3068	schtasks.exe
5180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe
1916	j88vip.host.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	j88vip.host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	j88vip.host.exe
Token: SeDebugPrivilege	1916	j88vip.host.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3068	1916	j88vip.host.exe	80
PID 1916 wrote to memory of 5180	1916	j88vip.host.exe	82

C:\Users\Admin\AppData\Local\Temp\j88vip.host.exe
"C:\Users\Admin\AppData\Local\Temp\j88vip.host.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF58B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3068
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF5DA.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5180

C:\Users\Admin\AppData\Local\Temp\j88vip.host.exe
"C:\Users\Admin\AppData\Local\Temp\j88vip.host.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:960

C:\Program Files (x86)\DDP Service\ddpsvc.exe
"C:\Program Files (x86)\DDP Service\ddpsvc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddpsvc.exe

Path C:\Program Files (x86)\DDP Service\ddpsvc.exe
Size 203KB
SHA256 332ed43c195f4a2f045a5269e2180ede202be688519160561c83d0584d353069
MD5 f39d6c7e6565a098d510f5e4afa546b7
SHA1 02002842034e9273affdd12ad0d95bd8827bea96
SHA512 def0c48fdb3e4dbaa7d4072144b1fc20c0364319ae2023f98010069d8343e1c6390096780fa2cb2f45ee2fd6b3f6505618f3cd1bf3d52ddb093d77d0dfcbc56a
SSDEEP 3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIM+Cw9JwT41pn0vDajY0bHLm42:ULV6Bta6dtJmakIM5YVnoD8HiV9L
TLSH
T18514CF163BB94A2FE2DE8679212202528778C2E399C3F3DF18E455B75F163E44A0B1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpF58B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF58B.tmp
Size 1KB
SHA256 0e42a70fff74e7a28edbc1dd2fe560b2b46911a5fdc3a1b3134494104fa87138
MD5 58ca98b7ddc78f0a990a9fe608ef2733
SHA1 0a8ef5d89ce6fdf0407f37fa96e20a8d077d7d54
SHA512 8fd32a265e7b3db84d5e665efbfb32ef7d6cd38088a6e361ea0b4ae76bd0e1e4adfbe7bf7f188f4b605a998d593f5724796dc105202a17fb36da5c8ca2ac14c4
TLSH
T16621C064ACC0F71F66715629A39197C2DF2A57A301564138FCCC4A7F3FB6186304316B
MD5 SHA1 SHA512 TLSH

Submit Download

tmpF5DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF5DA.tmp
Size 1KB
SHA256 0b0a294877234b2406c573060ff13262da0414485c0954ef8961a9429d9f7fb1
MD5 2a91b19749346c8f783945a00a5050d7
SHA1 66c61f7802ac5b83aae26f6042575717209bae3e
SHA512 c5b044a2bda0ad0d38fb57ffb54611381f05ef6ef2f14481d00c278ecefda2d963ef41b2ef6e2bb16718fb8e5aa859bf2b9f870bf3ba8959c5a6b5b03aa53622
TLSH
T18A21E064ACC0F75B66714625A39157C2EF2A87A302164038FCCC4E7F2FB6186304316B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-12-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/960-13-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/960-18-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/1916-9-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/1916-1-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/1916-0-0x0000000074BF1000-0x0000000074BF2000-memory.dmp

Download

memory/1916-20-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/1916-21-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/3236-14-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/3236-15-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download

memory/3236-19-0x0000000074BF0000-0x00000000751A1000-memory.dmp

Download