analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

c2cac3865dd7f7465c0d82534148c240.zip

Full analysis: https://app.any.run/tasks/9c1adece-9ba2-4886-9a59-a4d68463cd3e
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 15:02:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nanocore
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9CA98E4619F2105BA52BE65E0FB8A098

SHA1:

E816ACB7FF797B9CCE84E4DDA3DE4385CD7E2648

SHA256:

09BD11F9863DB23F24A4D3723756C4DF1410D3744C572ECC431547EF10E26EB5

SSDEEP:

12288:aZSrSXyiqJR93DBQVyuq+0jTYx2nNRsjuDgRXrPmuYdltfSUrYNmPP:agrSibf3DBUqdLNDgRreXllB53

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • Img-US10018922189-0001901001.exe (PID: 3476)

    • NanoCore was detected

      • RegAsm.exe (PID: 3500)

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3500)

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 3500)
      • Img-US10018922189-0001901001.exe (PID: 3476)

    • Connects to CnC server

      • RegAsm.exe (PID: 3500)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1548)
      • Img-US10018922189-0001901001.exe (PID: 3476)
      • RegAsm.exe (PID: 3500)

    • Creates files in the user directory

      • Img-US10018922189-0001901001.exe (PID: 3476)
      • RegAsm.exe (PID: 3500)

  • INFO

    • Application launched itself

      • RdrCEF.exe (PID: 2724)
      • AcroRd32.exe (PID: 3288)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2948)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2019:04:25 10:01:17
ZipCRC: 0x3c061484
ZipCompressedSize: 772955
ZipUncompressedSize: 2097152
ZipFileName: c2cac3865dd7f7465c0d82534148c240
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs winword.exe no specs winrar.exe img-us10018922189-0001901001.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2604"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\c2cac3865dd7f7465c0d82534148c240.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3288"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\c2cac3865dd7f7465c0d82534148c240.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
1500"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\c2cac3865dd7f7465c0d82534148c240.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
2724"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
3221225547
Version:
15.23.20053.211670
296"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2724.0.1136169286\1807125604" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
2948"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\c2cac3865dd7f7465c0d82534148c240.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
1548"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\c2cac3865dd7f7465c0d82534148c240.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3476"C:\Users\admin\AppData\Local\Temp\Rar$EXa1548.16241\Img-US10018922189-0001901001.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1548.16241\Img-US10018922189-0001901001.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3500"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Img-US10018922189-0001901001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
1 529
Read events
1 371
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
4
Text files
3
Unknown types
8

Dropped files

PID
Process
Filename
Type
2604WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2604.7298\c2cac3865dd7f7465c0d82534148c240 —
MD5:—
SHA256:—
1500AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
1500AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.1500 —
MD5:—
SHA256:—
1500AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.1500 —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR58B.tmp.cvr —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0000.doc —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.doc —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2D146890-9765-4BB2-B9E0-78850079CF6C}.tmp —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9A3A6EA9-6402-4EF7-A185-91FB393DEB14}.tmp —
MD5:—
SHA256:—
1500AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagessqlite
MD5:213FB73326D24A80BF86030CB2814E51
SHA256:D28739F54BC371790EC2C7801CEFA181FBD28CB10EB13F38F102CC1EFE132D80
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3500
RegAsm.exe
185.247.228.161:8050
moran101.duckdns.org
—
—
malicious

DNS requests

Domain
IP
Reputation
moran101.duckdns.org
  • 185.247.228.161
malicious

Threats

PID
Process
Class
Message
3500
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3500
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
3500
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3500
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3500
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3500
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3500
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
3500
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3500
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3500
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
49 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c2cac3865dd7f7465c0d82534148c240.zip