nanocore | b60944be145708e5fbe0bf5f038a6dda5bb8bb2ef535520744b89b8f2e82b07c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe
Size

1.2MB
MD5

0fac3790b807090b1a3e15d09591ff9e
SHA1

005c209528c1f54e4b124ac2a9cc422cfd71bfee
SHA256

b60944be145708e5fbe0bf5f038a6dda5bb8bb2ef535520744b89b8f2e82b07c
SHA512

3338392464bc1be6fcc28d8b340b444b66e9209f959aa59ee0f4001cc869f60239b5ff9e4e674f70e8cb39a8e3a1dd8fdd797fa9af991eb49760f985ed141ca1
SSDEEP

24576:bAOcZXGN8TpRbQBUB1AEqI1/csX5pO0i0buNTwMxW:9SKUB2IhcC3O3mMxW

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

45.137.22.142:9867

Mutex

6ed8119f-db9f-4ea8-b413-e47ef22be831

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-07-13T04:26:28.076798036Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9867
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
6ed8119f-db9f-4ea8-b413-e47ef22be831
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
45.137.22.142
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

gakrk.pifRegSvcs.exe

pid process

1788 gakrk.pif
2916 RegSvcs.exe

pid	process
1788	gakrk.pif
2916	RegSvcs.exe

Loads dropped DLL 5 IoCs

Processes:

0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exegakrk.pif

pid	process
2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe
2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe
2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe
2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe
1788	gakrk.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

gakrk.pifRegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iuytgt = "C:\\Users\\Admin\\AppData\\Roaming\\49026461\\gakrk.pif C:\\Users\\Admin\\AppData\\Roaming\\49026461\\ACUEGV~1.NBW"	gakrk.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Service = "C:\\Program Files (x86)\\DDP Service\\ddpsv.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RegSvcs.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

gakrk.pif

description pid process target process

PID 1788 set thread context of 2916 1788 gakrk.pif RegSvcs.exe
Drops file in Program Files directory 2 IoCs

Processes:

RegSvcs.exe

description ioc process

File created C:\Program Files (x86)\DDP Service\ddpsv.exe RegSvcs.exe
File opened for modification C:\Program Files (x86)\DDP Service\ddpsv.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1228 schtasks.exe
1140 schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RegSvcs.exe

description	pid	process	target process
PID 1788 set thread context of 2916	1788	gakrk.pif	RegSvcs.exe

description	ioc	process
File created	C:\Program Files (x86)\DDP Service\ddpsv.exe	RegSvcs.exe
File opened for modification	C:\Program Files (x86)\DDP Service\ddpsv.exe	RegSvcs.exe

pid	process
1228	schtasks.exe
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegSvcs.exegakrk.pif

pid	process
2916	RegSvcs.exe
2916	RegSvcs.exe
2916	RegSvcs.exe
2916	RegSvcs.exe
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
2916	RegSvcs.exe
2916	RegSvcs.exe
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif
1788	gakrk.pif

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegSvcs.exe

pid process

2916 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2916 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2916	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exegakrk.pifRegSvcs.exe

description	pid	process	target process
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 2384 wrote to memory of 1788	2384	0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe	gakrk.pif
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 1788 wrote to memory of 2916	1788	gakrk.pif	RegSvcs.exe
PID 2916 wrote to memory of 1228	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1228	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1228	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1228	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1140	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1140	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1140	2916	RegSvcs.exe	schtasks.exe
PID 2916 wrote to memory of 1140	2916	RegSvcs.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fac3790b807090b1a3e15d09591ff9e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384

C:\Users\Admin\AppData\Roaming\49026461\gakrk.pif
"C:\Users\Admin\AppData\Roaming\49026461\gakrk.pif" acuegvfrj.nbw
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8823.tmp"
4⤵
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "DDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8F55.tmp"
4⤵
- Scheduled Task/Job: Scheduled Task
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8823.tmp
Filesize
1KB

MD5
95aceabc58acad5d73372b0966ee1b35

SHA1
2293b7ad4793cf574b1a5220e85f329b5601040a

SHA256
8d9642e1c3cd1e0b5d1763de2fb5e605ba593e5a918b93eec15acbc5dcc48fd4

SHA512
00760dfc9d8caf357f0cee5336e5448a4cca18e32cc63e1a69c16e34fe00ea29acd5b2cf278e86c6f9c3e66a1b176d27ed927361848212e6bf1fade7d3d06e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8F55.tmp
Filesize
1KB

MD5
93d357e6194c8eb8d0616a9f592cc4bf

SHA1
5cc3a3d95d82cb88f65cb6dc6c188595fa272808

SHA256
a18de0ef2102d2546c7afd07ad1d7a071a0e59aff0868cf3937a145f24feb713

SHA512
4df079387f6a76e0deb96ab4c11f6cffa62a8b42dc4970e885dab10351fade2d9e933663c141b76409657f85f1bf9dbb533d92dce52dc62598aafc4793743f7f

Download Submit
C:\Users\Admin\AppData\Roaming\49026461\jinoow.cbr
Filesize
406KB

MD5
176d166789c309f60e5fdec94933dbbb

SHA1
bacf8dc697113d24c69f5c41a1cadebe9812d13c

SHA256
bee0a50ab19bfdfb7dfbbe882277ed89d1b0f8d15eed22401ce4f09984c38dd0

SHA512
ad0b91dcef0a0675e5fcff78dbec61e5429f8997ef290d2baf9cd810be038ecfcb826960ffb310b74944e9095bfff209b5000291642413c55b1ff766af7be16e

Download Submit
C:\Users\Admin\AppData\Roaming\49026461\nnovphwdnx.cpl
Filesize
59KB

MD5
37c50f0cfcb6fdfb7c2987ac18c16be3

SHA1
36790425c0344aff8beb7bc20ac739b3f04ff0d7

SHA256
58c2c4705dd077a3ab098d3648b3f75d24f210e3c1cd51281be1bfbf918b11a9

SHA512
d4f69f40325a3456d2f6a87dcfac4eeb1e0193a935518b3fadea97de871063c18a6bb09d099b72c05efd938227e0150ea2282e395b5711a48f05dd8a49095aef

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Filesize
44KB

MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
\Users\Admin\AppData\Roaming\49026461\gakrk.pif
Filesize
758KB

MD5
c01edc143bd4f18131950630185dbcea

SHA1
3b5814d8f173beb121e1b6fbcde9aaf4f7ca023f

SHA256
f26ee6a15f942b7dd034bd2d81ac8913a3c8e3f1639edc623adfa8be233b7bed

SHA512
352fa642cdba0ba50a6face538a4a8b64c3c011e7022c46c153d4aca5321616fa941ba42742ca245597fa571ca5218da2ad6209458d72780b320b4b8b0b60c55

Download Submit
memory/2916-187-0x00000000003C0000-0x0000000000A86000-memory.dmp

Filesize
6.8MB

Download
memory/2916-185-0x00000000003C0000-0x0000000000A86000-memory.dmp

Filesize
6.8MB

Download
memory/2916-190-0x00000000003C0000-0x00000000003F8000-memory.dmp

Filesize
224KB

Download
memory/2916-188-0x00000000003C0000-0x0000000000A86000-memory.dmp

Filesize
6.8MB

Download
memory/2916-182-0x00000000003C0000-0x0000000000A86000-memory.dmp

Filesize
6.8MB

Download
memory/2916-184-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2916-198-0x0000000000E00000-0x0000000000E0A000-memory.dmp

Filesize
40KB

Download
memory/2916-199-0x0000000001030000-0x000000000104E000-memory.dmp

Filesize
120KB

Download
memory/2916-200-0x00000000025F0000-0x00000000025FA000-memory.dmp

Filesize
40KB

Download