nanocore | 44d014d02ff46e6732e5463240209b232aff16de47fa661980c7c44d6d5cdb7c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
Size

1.0MB
MD5

a35fb224f8e7072b721b3a399ed6c1c0
SHA1

a17aa0bb8821c68823fb5d10306e97087533430c
SHA256

44d014d02ff46e6732e5463240209b232aff16de47fa661980c7c44d6d5cdb7c
SHA512

35b7b5ce2578dd4dfd67fc4ce059d72248a6c35e27065307e4530310e843983add91d59d4060f119b1f06f38ae21c6811b906255a5c558ba976d89165c1f5d05
SSDEEP

12288:baeA7wKKw7GTc3OLTc8Xvp2eLnkCIiX8K:bae8MTxLkmX8

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
Executes dropped EXE 3 IoCs

Processes:

skrs_.exeskrs_.exeskrs_.exe

pid process

3212 skrs_.exe
4260 skrs_.exe
3572 skrs_.exe
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 23.249.162.143
Destination IP 23.249.162.143
Destination IP 23.249.162.143

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe

pid	process
3212	skrs_.exe
4260	skrs_.exe
3572	skrs_.exe

description	ioc
Destination IP	23.249.162.143
Destination IP	23.249.162.143
Destination IP	23.249.162.143

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

skrs_.exeskrs_.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsv.exe"	skrs_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\INSTs_ = "wscript \"C:\\Users\\Admin\\Katr8s_\\skrs_.vbs\""	skrs_.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

skrs_.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA skrs_.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

skrs_.exe

description pid process target process

PID 4260 set thread context of 3572 4260 skrs_.exe skrs_.exe
Drops file in Program Files directory 2 IoCs

Processes:

skrs_.exe

description ioc process

File created C:\Program Files (x86)\DHCP Service\dhcpsv.exe skrs_.exe
File opened for modification C:\Program Files (x86)\DHCP Service\dhcpsv.exe skrs_.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	skrs_.exe

description	pid	process	target process
PID 4260 set thread context of 3572	4260	skrs_.exe	skrs_.exe

description	ioc	process
File created	C:\Program Files (x86)\DHCP Service\dhcpsv.exe	skrs_.exe
File opened for modification	C:\Program Files (x86)\DHCP Service\dhcpsv.exe	skrs_.exe

Drops file in Windows directory 4 IoCs

Processes:

a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exeskrs_.exeskrs_.exea35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	skrs_.exe
File opened for modification	C:\Windows\win.ini	skrs_.exe
File opened for modification	C:\Windows\win.ini	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

skrs_.exe

pid process

3572 skrs_.exe
3572 skrs_.exe
3572 skrs_.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

skrs_.exe

pid process

3572 skrs_.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

skrs_.exe

description pid process

Token: SeDebugPrivilege 3572 skrs_.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exea35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exeskrs_.exeskrs_.exe

pid process

3140 a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
5016 a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
3212 skrs_.exe
4260 skrs_.exe

pid	process
3572	skrs_.exe
3572	skrs_.exe
3572	skrs_.exe

pid	process
3572	skrs_.exe

description	pid	process
Token: SeDebugPrivilege	3572	skrs_.exe

pid	process
3140	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
5016	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
3212	skrs_.exe
4260	skrs_.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exea35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exeskrs_.exeskrs_.exe

description	pid	process	target process
PID 3140 wrote to memory of 5016	3140	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
PID 3140 wrote to memory of 5016	3140	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
PID 3140 wrote to memory of 5016	3140	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
PID 5016 wrote to memory of 3212	5016	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe	skrs_.exe
PID 5016 wrote to memory of 3212	5016	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe	skrs_.exe
PID 5016 wrote to memory of 3212	5016	a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe	skrs_.exe
PID 3212 wrote to memory of 4260	3212	skrs_.exe	skrs_.exe
PID 3212 wrote to memory of 4260	3212	skrs_.exe	skrs_.exe
PID 3212 wrote to memory of 4260	3212	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe
PID 4260 wrote to memory of 3572	4260	skrs_.exe	skrs_.exe

C:\Users\Admin\AppData\Local\Temp\a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140

C:\Users\Admin\AppData\Local\Temp\a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a35fb224f8e7072b721b3a399ed6c1c0_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\Katr8s_\skrs_.exe
"C:\Users\Admin\Katr8s_\skrs_.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212

C:\Users\Admin\Katr8s_\skrs_.exe
"C:\Users\Admin\Katr8s_\skrs_.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260

C:\Users\Admin\Katr8s_\skrs_.exe
"C:\Users\Admin\Katr8s_\skrs_.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3572

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Katr8s_\skrs_.exe
Filesize
1.0MB

MD5
a35fb224f8e7072b721b3a399ed6c1c0

SHA1
a17aa0bb8821c68823fb5d10306e97087533430c

SHA256
44d014d02ff46e6732e5463240209b232aff16de47fa661980c7c44d6d5cdb7c

SHA512
35b7b5ce2578dd4dfd67fc4ce059d72248a6c35e27065307e4530310e843983add91d59d4060f119b1f06f38ae21c6811b906255a5c558ba976d89165c1f5d05

Download Submit
C:\Windows\win.ini
Filesize
123B

MD5
6bf517432f65eb7f0d18d574bf14124c

SHA1
5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

SHA256
6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

SHA512
7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

Download Submit
memory/3140-3-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/3140-4-0x0000000077141000-0x0000000077261000-memory.dmp

Filesize
1.1MB

Download
memory/3572-31-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3572-33-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/5016-11-0x00000000029C0000-0x00000000029C8000-memory.dmp

Filesize
32KB

Download