File name:

7.rar

Full analysis: https://app.any.run/tasks/d15f8a04-c431-44e7-afd7-76717e1eea74
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: July 18, 2019, 06:55:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

8ADB50CA74A006C63513C297422E839F

SHA1:

9B339FD38C87F42A4AD1A65F87E65555B28969C5

SHA256:

2242C6316AF5B3D5D58EB9D3631216EA5712CDCC39145835D6E2507403393BCE

SSDEEP:

196608:ttoPbFFS/LtWSnmYTR2uvFVXIvKtzRDy9:t43Sz3TR2uvFVXI+Dy9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NanoCore was detected

      • nitrogen.exe (PID: 3532)

    • Changes the autorun value in the registry

      • nitrogen.exe (PID: 3532)

    • Application was dropped or rewritten from another process

      • nitro_gen.exe (PID: 1332)
      • nitro_gen.exe (PID: 3580)
      • nitrogen.exe (PID: 3456)
      • nitrogen.exe (PID: 3532)

    • Loads dropped or rewritten executable

      • nitro_gen.exe (PID: 3580)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • nitrogen.exe (PID: 3456)
      • nitrogen.exe (PID: 3532)
      • nitro_gen.exe (PID: 1332)

    • Creates files in the user directory

      • nitrogen.exe (PID: 3532)

    • Loads Python modules

      • nitro_gen.exe (PID: 3580)

    • Application launched itself

      • nitro_gen.exe (PID: 1332)

    • Starts CMD.EXE for commands execution

      • nitro_gen.exe (PID: 3580)

  • INFO

    • Manual execution by user

      • nitrogen.exe (PID: 3456)

    • Dropped object may contain Bitcoin addresses

      • nitro_gen.exe (PID: 1332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs nitrogen.exe #NANOCORE nitrogen.exe nitro_gen.exe nitro_gen.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1332"C:\Users\admin\AppData\Local\Temp\nitro_gen.exe" C:\Users\admin\AppData\Local\Temp\nitro_gen.exe
nitrogen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nitro_gen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\apphelp.dll
3352"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\7.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3456"C:\Users\admin\Desktop\nitrogen.exe" C:\Users\admin\Desktop\nitrogen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\nitrogen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3532"C:\Users\admin\AppData\Local\Temp\nitrogen.exe" C:\Users\admin\AppData\Local\Temp\nitrogen.exe
nitrogen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nitrogen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3580"C:\Users\admin\AppData\Local\Temp\nitro_gen.exe" C:\Users\admin\AppData\Local\Temp\nitro_gen.exe—nitro_gen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nitro_gen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\users\admin\appdata\local\temp\_mei13322\python37.dll
3924C:\Windows\system32\cmd.exe /c title Nitro Gen by lonanll#9108 discord: https://discord.gg/4TbQxcDC:\Windows\system32\cmd.exe—nitro_gen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
797
Read events
784
Write events
13
Delete events
0

Modification events

(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3352) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\7.rar
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3352) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3456) nitrogen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3456) nitrogen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
19
Suspicious files
1
Text files
912
Unknown types
2

Dropped files

PID
Process
Filename
Type
3352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3352.46052\nitrogen.exe —
MD5:—
SHA256:—
3456nitrogen.exeC:\Users\admin\AppData\Local\Temp\nitro_gen.exeexecutable
MD5:—
SHA256:—
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\mira.exe.manifestxml
MD5:—
SHA256:—
3456nitrogen.exeC:\Users\admin\AppData\Local\Temp\nitrogen.exeexecutable
MD5:—
SHA256:—
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\_socket.pydexecutable
MD5:51A38A6BF4C7E3D71B21A88B7A1DD555
SHA256:B7829EC5C6DE17B30037E1B50F43E26B40FCD9ACDABCE0011D623F5C0CEBD70E
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\_tkinter.pydexecutable
MD5:CA14F8ECEC66E86D206656CCDB7E9E50
SHA256:2AD4C0A6E125862880C5359FEE1F64DEAAB706498F92107C0F8F03654D8EC54C
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\_ctypes.pydexecutable
MD5:06C45D47AF92A68EA6DA0CC861992034
SHA256:B016E7CE9744A0E8FEA473F1982E5D2FC355A98682054F470F4189D5FC00B8BF
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\_lzma.pydexecutable
MD5:D72665EA18965F103200CCC7AD072F85
SHA256:AB20E63D14259A7DECA85A068796476C0EFCC236A11D53B1816FC6F8956424A8
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\VCRUNTIME140.dllexecutable
MD5:AE96651CFBD18991D186A029CBECB30C
SHA256:1B372F064EACB455A0351863706E6326CA31B08E779A70DE5DE986B5BE8069A1
1332nitro_gen.exeC:\Users\admin\AppData\Local\Temp\_MEI13322\_bz2.pydexecutable
MD5:055CFC5297933C338D8C04FD4E2462A2
SHA256:BEFC81440BBC001BD7647ACA42962EE0B45B08435EE9F7140BF570AF636B7DD5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3532
nitrogen.exe
104.197.31.75:8245
snowcore.ddns.net
Google Inc.
US
unknown
3532
nitrogen.exe
8.8.8.8:53
—
Google Inc.
US
malicious

DNS requests

Domain
IP
Reputation
snowcore.ddns.net
  • 104.197.31.75
malicious

Threats

No threats detected
No debug info