nanocore | 5389ee161d9b71caa3c663af220b8514fe61eb7d07442475deb648455e0d0c6f

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
Size

482KB
MD5

b98590b676fde76327a1d35fa71e3b81
SHA1

952034dbaf71770ca627ae5035f67edafff76039
SHA256

5389ee161d9b71caa3c663af220b8514fe61eb7d07442475deb648455e0d0c6f
SHA512

dc44273d193a253a312a389132cda4563d313c2b66f10931af5b923793cb44a2f5710920c2f03fd65aa8a2f38a7009ce6b32e7d9ba6b316345d04f0b6f08cee6
SSDEEP

6144:YDwOHsMY7n/VaQseb9pKML7Z6brCLHeXU5lbh9foYWQKD+kI9N:xOiDdaxFMsbOLMUT9V5E+b

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

mailsiro.casacam.net:9034

joutd.mywire.org:9034

Mutex

9bb4cb95-db21-4186-b788-e6f8e08d65cd

Attributes

activate_away_mode
false
backup_connection_host
joutd.mywire.org
backup_dns_server
buffer_size
65535
build_time
2020-01-20T23:01:37.754502236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
9034
default_group
corona2
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
9bb4cb95-db21-4186-b788-e6f8e08d65cd
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
mailsiro.casacam.net
primary_dns_server
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

InstallUtil.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe" InstallUtil.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe

description pid process target process

PID 2412 set thread context of 2652 2412 b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe InstallUtil.exe
Drops file in Program Files directory 2 IoCs

Processes:

InstallUtil.exe

description ioc process

File opened for modification C:\Program Files (x86)\ARP Host\arphost.exe InstallUtil.exe
File created C:\Program Files (x86)\ARP Host\arphost.exe InstallUtil.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

296 schtasks.exe
2824 schtasks.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Host = "C:\\Program Files (x86)\\ARP Host\\arphost.exe"	InstallUtil.exe

description	pid	process	target process
PID 2412 set thread context of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\ARP Host\arphost.exe	InstallUtil.exe
File created	C:\Program Files (x86)\ARP Host\arphost.exe	InstallUtil.exe

pid	process
296	schtasks.exe
2824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exeInstallUtil.exe

pid	process
2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
2652	InstallUtil.exe
2652	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

InstallUtil.exe

pid process

2652 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 2412 b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
Token: SeDebugPrivilege 2652 InstallUtil.exe
Token: SeDebugPrivilege 2652 InstallUtil.exe

pid	process
2652	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
Token: SeDebugPrivilege	2652	InstallUtil.exe
Token: SeDebugPrivilege	2652	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exeInstallUtil.exe

description	pid	process	target process
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2412 wrote to memory of 2652	2412	b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe	InstallUtil.exe
PID 2652 wrote to memory of 296	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 296	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 296	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 296	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 2824	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 2824	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 2824	2652	InstallUtil.exe	schtasks.exe
PID 2652 wrote to memory of 2824	2652	InstallUtil.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b98590b676fde76327a1d35fa71e3b81_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5BB.tmp"
3⤵
- Creates scheduled task(s)
PID:296

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "ARP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp677.tmp"
3⤵
- Creates scheduled task(s)
PID:2824

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5BB.tmp
Filesize
1KB

MD5
576bbaf398045c3843d452ec83208236

SHA1
8ed5b2500ae7a40cbfa6e9018a1d1f1e70cb1374

SHA256
33c0c2d72fa383e5988ce640febc5ac6a2bd71d4ae660b99e52234952e17467b

SHA512
e7cc0ea0b351c6a8618e14f03c00e88ef83e2f169e0b4d66513f580f0a9352fbfe429e57186362b69407150d566bbdadca2f7b574fc748cc140b3249be67f96a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp677.tmp
Filesize
1KB

MD5
447ab194ab36cb1d20078d80e502b1b2

SHA1
a947b3b2c91d7c50bb8d39bd4fc91a0d0cc5b1c0

SHA256
8d5304b20b7d7dea223ce2738e5668054250d57bf6bed86b305b69924bd472f5

SHA512
49ddc557f7f6635627eea9bf0fa12a14b7b13edb235ed560ee0044a7f87fe27b686ff878d347d0273d92eb0b318b8c2bca85c0fbf42d586ed7d7da39eac6a327

Download Submit
memory/2412-17-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2412-1-0x00000000002D0000-0x000000000034E000-memory.dmp

Filesize
504KB

Download
memory/2412-2-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2412-3-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2412-4-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Filesize
4KB

Download
memory/2412-5-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2412-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Filesize
4KB

Download
memory/2652-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-19-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2652-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-18-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2652-9-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2652-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2652-27-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2652-28-0x0000000000450000-0x000000000046E000-memory.dmp

Filesize
120KB

Download
memory/2652-29-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2652-30-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/2652-31-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download