analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Payment invoice 112.exe

Full analysis: https://app.any.run/tasks/a98e65e0-0e8a-4bdb-9775-29eb1f567d50
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: December 02, 2019, 18:13:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nanocore
rat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8D6C29DB98E5801372D8CFB8BC99492E

SHA1:

717A0DFD323A044679C0563B52AD22ECF5516782

SHA256:

17CD3FA457D41E1D4686369871EBC99AB5ADE57B4C7D05CB14EE65AF59F9F224

SSDEEP:

12288:UEagEujPUPMiWLvopO4QU00tdZ+SbKQKJknrK2zwHJeU6b:UDNGPUPaOOz3ymuKQOfswpeU6b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 4016)
      • Firefox.exe (PID: 1976)
    • NANOCORE was detected

      • Firefox.exe (PID: 1976)
    • Connects to CnC server

      • Firefox.exe (PID: 1976)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Payment invoice 112.exe (PID: 2176)
      • Firefox.exe (PID: 1976)
    • Starts itself from another location

      • Payment invoice 112.exe (PID: 2176)
    • Executes scripts

      • Payment invoice 112.exe (PID: 2176)
    • Application launched itself

      • Firefox.exe (PID: 2888)
    • Creates files in the user directory

      • Firefox.exe (PID: 1976)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:03:20 19:06:19+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 704512
InitializedDataSize: 81920
UninitializedDataSize: -
EntryPoint: 0x1204
OSVersion: 4
ImageVersion: 70
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 70.0.0.1
ProductVersionNumber: 70.0.0.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: libera
CompanyName: Mozilla Corporation
FileDescription: Firefox
LegalCopyright: ©Firefox and Mozilla Developers; available under the MPL 2 license.
LegalTrademarks: Firefox is a Trademark of The Mozilla Foundation.
ProductName: Firefox
FileVersion: 70.00.0001
ProductVersion: 70.00.0001
InternalName: firefox
OriginalFileName: firefox.exe

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-Mar-2013 18:06:19
Detected languages:
  • English - United States
Comments: libera
CompanyName: Mozilla Corporation
FileDescription: Firefox
LegalCopyright: ©Firefox and Mozilla Developers; available under the MPL 2 license.
LegalTrademarks: Firefox is a Trademark of The Mozilla Foundation.
ProductName: Firefox
FileVersion: 70.00.0001
ProductVersion: 70.00.0001
InternalName: firefox
OriginalFilename: firefox.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000B8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 20-Mar-2013 18:06:19
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000AB240
0x000AC000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42055
.data
0x000AD000
0x0000115C
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x000AF000
0x0001102C
0x00012000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.26673

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.35071
976
Unicode (UTF 16LE)
English - United States
RT_VERSION
2
5.12398
5160
UNKNOWN
UNKNOWN
RT_ICON
3
5.10872
11560
UNKNOWN
UNKNOWN
RT_ICON
4
7.9823
50218
UNKNOWN
UNKNOWN
RT_ICON

Imports

MSVBVM60.DLL
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start payment invoice 112.exe wscript.exe firefox.exe no specs #NANOCORE firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
2176"C:\Users\admin\AppData\Local\Temp\Payment invoice 112.exe" C:\Users\admin\AppData\Local\Temp\Payment invoice 112.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
70.00.0001
4016"C:\Windows\System32\WScript.exe" "C:\Users\admin\Mozilla Firefox\Firefox.vbs" C:\Windows\System32\WScript.exe
Payment invoice 112.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2888"C:\Users\admin\Mozilla Firefox\Firefox.exe" C:\Users\admin\Mozilla Firefox\Firefox.exePayment invoice 112.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
70.00.0001
1976"C:\Users\admin\Mozilla Firefox\Firefox.exe" C:\Users\admin\Mozilla Firefox\Firefox.exe
Firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
70.00.0001
Total events
466
Read events
460
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2176Payment invoice 112.exeC:\Users\admin\Mozilla Firefox\Firefox.vbstext
MD5:F0D5A2973B7CAD29A4B1F4195D9CDBD7
SHA256:E2A7BC0B994EC150DE75BA5C70DA0AF7F41035250EC558BEC08EE25C2B95154E
2176Payment invoice 112.exeC:\Users\admin\Mozilla Firefox\Firefox.exeexecutable
MD5:8D6C29DB98E5801372D8CFB8BC99492E
SHA256:17CD3FA457D41E1D4686369871EBC99AB5ADE57B4C7D05CB14EE65AF59F9F224
1976Firefox.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:8D6C29DB98E5801372D8CFB8BC99492E
SHA256:17CD3FA457D41E1D4686369871EBC99AB5ADE57B4C7D05CB14EE65AF59F9F224
1976Firefox.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:D9EA9FA39F87A9C77AD8B42CD1A6368A
SHA256:7B67D13A89D58E7FA694CBA8BFAE4331E6843C1DBC07A9F83E948A825BEA8916
1976Firefox.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:963D5E2C9C0008DFF05518B47C367A7F
SHA256:5EACF2974C9BB2C2E24CDC651C4840DD6F4B76A98F0E85E90279F1DBB2E6F3C0
1976Firefox.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
1976Firefox.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1976
Firefox.exe
79.134.225.90:5355
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
1976
Firefox.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
1976
Firefox.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1976
Firefox.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1976
Firefox.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
1976
Firefox.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1976
Firefox.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1976
Firefox.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
1976
Firefox.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1976
Firefox.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
1976
Firefox.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
53 ETPRO signatures available at the full report
No debug info