nanocore | b0deda9f8354364d78134de41f845a194f29dc6e24f6e68c6d959e2e518f3791

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Size

1.1MB
MD5

1b3c5144369e21c102063fc18adae793
SHA1

1390f21e61d7c52d967f5895ebf6e67ef4dbcff9
SHA256

b0deda9f8354364d78134de41f845a194f29dc6e24f6e68c6d959e2e518f3791
SHA512

ac76a7ccfaaf69fbfac7d4b564abeb19c9f3610488d085ef01309609f15ed643476c4b9193c7f095c935290d1293af0debae80cca98fbff576a2fc81ef1dcd7c
SSDEEP

24576:4a/ei0ZhOFpzx3UBgD3hqe/OqzsnvG3+XrJLHMZ2qWItqPTz:Yi0sFN1zMuCJLHn

Score

10^/10

nanocore evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

queda2122.ddns.net:110

queda212.ddns.net:110

Mutex

a59769ae-d88b-48a6-9aeb-eba13186dd16

Attributes

activate_away_mode
true
backup_connection_host
queda212.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-05-01T17:12:48.076145036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
110
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
a59769ae-d88b-48a6-9aeb-eba13186dd16
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
queda2122.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Drops startup file 2 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silverlight.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Silverlight.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

Processes:

svchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exesvchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid process

2040 svchost.exe
2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
2984 svchost.exe
2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Loads dropped DLL 2 IoCs

Processes:

svchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid process

2040 svchost.exe
2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description pid process target process

PID 2748 set thread context of 2560 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid	process
2040	svchost.exe
2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
2984	svchost.exe
2560	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid	process
2040	svchost.exe
2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description	pid	process	target process
PID 2748 set thread context of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

Drops file in Program Files directory 14 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description ioc process

File created C:\Windows\svchost.exe 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid process

2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid process

2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2748 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Token: SeDebugPrivilege 2560 1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\svchost.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid	process
2560	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
2560	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

pid	process
2560	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Token: SeDebugPrivilege	2560	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

1b3c5144369e21c102063fc18adae793_JaffaCakes118.exesvchost.exe1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

description	pid	process	target process
PID 1868 wrote to memory of 2040	1868	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	svchost.exe
PID 1868 wrote to memory of 2040	1868	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	svchost.exe
PID 1868 wrote to memory of 2040	1868	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	svchost.exe
PID 1868 wrote to memory of 2040	1868	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	svchost.exe
PID 2040 wrote to memory of 2748	2040	svchost.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2040 wrote to memory of 2748	2040	svchost.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2040 wrote to memory of 2748	2040	svchost.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2040 wrote to memory of 2748	2040	svchost.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
PID 2748 wrote to memory of 2560	2748	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe	1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1b3c5144369e21c102063fc18adae793_JaffaCakes118.exe
Filesize
1.1MB

MD5
7c1ff03d7f14a5eabd43873bb4971b5f

SHA1
aca8440bef0d1b53d7b7396f7cb6b44891d4e9ef

SHA256
d84feff4c109ae89c3712afd4454ec8a2e9171930cee71d665fd7bbe705b095e

SHA512
e6d79aafc34567dc6057db11194bc6fcf9012e2eeb0373f695507339f05ca20ae8f5bf4460976d7f38731546110cfdd9798c883238f3ecaba37b07a63f7552fd

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
memory/1868-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2040-16-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2560-30-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2560-46-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2560-38-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2560-37-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2560-36-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2560-33-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2560-35-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2748-20-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-26-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-24-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-22-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-21-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-40-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/2748-17-0x0000000074F51000-0x0000000074F52000-memory.dmp

Filesize
4KB

Download
memory/2984-25-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2984-51-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download