analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Sample1.zip

Full analysis: https://app.any.run/tasks/f2685a3b-f4d4-4aed-a965-b1e85f94fd93
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: January 17, 2020, 19:15:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FF63FCA734D9196C0147C32CE6BCE832

SHA1:

5BB852EE3A1EB84CC493C9D22E151E617A887B01

SHA256:

0224A990AA2D6E6C8AB472A19E2AD74A17BCB580F63B0531206497360107E6D3

SSDEEP:

768:rdV2v52tpM7lVh7wG8AAWJzqla+pJd5eYWw48RN6DKnTrq3YF8S+KFLmMkcOEqnV:re0QlVhVVAe4a+Xd5etyNLTrqImSFqHP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ayy.exe (PID: 3048)
    • NANOCORE was detected

      • RegAsm.exe (PID: 1712)
    • Connects to CnC server

      • RegAsm.exe (PID: 1712)
  • SUSPICIOUS

    • Creates files in the user directory

      • RegAsm.exe (PID: 1712)
    • Connects to unusual port

      • RegAsm.exe (PID: 1712)
  • INFO

    • Manual execution by user

      • ayy.exe (PID: 3048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2020:01:17 19:13:22
ZipCRC: 0x5df891f1
ZipCompressedSize: 48163
ZipUncompressedSize: 122880
ZipFileName: bba9259b271c906fa90ed3987315b72b76657c0b425d461e7147710808dca860.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs ayy.exe no specs #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
1972"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sample1.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3048"C:\Users\admin\Desktop\ayy.exe" C:\Users\admin\Desktop\ayy.exeexplorer.exe
User:
admin
Company:
absoluti
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
1712"C:\Users\admin\Desktop\ayy.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
ayy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
594
Read events
534
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
5
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
1972WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_1972.3963
MD5:
SHA256:
1972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1972.4132\ayy.exe
MD5:
SHA256:
1972WinRAR.exeC:\Users\admin\AppData\Local\Temp\Sample1.zipcompressed
MD5:33B44A64BCEB890792B05A08DE25C4C1
SHA256:41048810CB8AAA76335768D73B0FB1294F2752C1F5526843038A0205208B6ACC
1712RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@google[1].txttext
MD5:BBF69E3A267094D44D8DF0866C28F94F
SHA256:61A94D14D4E2ECE3D95D28F0207B1B678FDCBD420988EE72530F479B045F5059
3048ayy.exeC:\Users\admin\AppData\Local\Temp\~DFE282AEC6E3CB2EDB.TMPbinary
MD5:597316E1CAE8CF7B985C61191923DF2F
SHA256:346E656C68ED708E03862992F83EFDFE5104988943CA6ADE18CC4AC043B5F089
1712RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:822E7FE00E2173CB5212587A1FDF24EE
SHA256:CAE40891D4DB69BB9C9E328BBC7B98C9DF3E55BC245F8F31BCD5BB57932D078F
1712RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:6117C28EA3C4F7A985BD506887081B48
SHA256:9F02C7CFA1457032B495716642DABF171FD903F103C388A10741B901D030C55C
1712RegAsm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\Pastelachy_encrypted_EC0C04F[1].binbinary
MD5:A06F159E18A3EE085B9C156AC820F310
SHA256:A947A2F06791FA472ECA6FAD518DBE44E996BCD8E3B9A678A730253ED38FED02
1712RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:4D784935677AE26ACDC3FB84FA1E6CF8
SHA256:C77E2D82DB9066E4DBFDE3AE0461A4259505F435EC0DB2CE3BD005BE0E2DE67C
1712RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
13
DNS requests
7
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1712
RegAsm.exe
8.8.8.8:53
Google Inc.
US
whitelisted
1712
RegAsm.exe
216.58.206.1:443
doc-10-c4-docs.googleusercontent.com
Google Inc.
US
whitelisted
1712
RegAsm.exe
216.58.210.14:443
drive.google.com
Google Inc.
US
whitelisted
1712
RegAsm.exe
185.244.30.8:5626
sherimix.duckdns.org
malicious

DNS requests

Domain
IP
Reputation
drive.google.com
  • 216.58.210.14
shared
doc-10-c4-docs.googleusercontent.com
  • 216.58.206.1
whitelisted
sherimix.duckdns.org
  • 185.244.30.8
malicious
departdec.duckdns.org
  • 185.244.30.8
unknown

Threats

PID
Process
Class
Message
1712
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1712
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
74 ETPRO signatures available at the full report
No debug info