analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Img-US10018922189-0001901001.img

Full analysis: https://app.any.run/tasks/de1f114d-6a49-493f-a259-23e220c8ed31
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: April 24, 2019, 21:25:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/x-iso9660-image
File info: UDF filesystem data (version 1.5) 'IMG_US10018922189_0001901001'
MD5:

C2CAC3865DD7F7465C0D82534148C240

SHA1:

09A7D81E13B2C3D0836645112755F1FF72988ACF

SHA256:

2D8FB4FB3D92F7F3FE6D599939AFE8EFCDF2CE5C045118D35FF016F27A1B16A4

SSDEEP:

24576:cAHnh+eWsN3skA4RV1Hom2KXMmHa6OhuiRqeBzfeKHk8lk5:7h+ZkldoPK8Ya6kZQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Img-US10018922189-0001901001.exe (PID: 120)
      • RegAsm.exe (PID: 2480)
      • Img-US10018922189-0001901001.exe (PID: 752)
      • Img-US10018922189-0001901001.exe (PID: 3116)
      • RegAsm.exe (PID: 2392)
      • RegAsm.exe (PID: 1012)
      • Img-US10018922189-0001901001.exe (PID: 2304)
      • RegAsm.exe (PID: 2076)

    • Writes to a start menu file

      • Img-US10018922189-0001901001.exe (PID: 120)
      • Img-US10018922189-0001901001.exe (PID: 752)
      • Img-US10018922189-0001901001.exe (PID: 3116)
      • Img-US10018922189-0001901001.exe (PID: 2304)

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 2480)

    • NanoCore was detected

      • RegAsm.exe (PID: 2480)

    • Connects to CnC server

      • RegAsm.exe (PID: 2480)

  • SUSPICIOUS

    • Creates files in the user directory

      • Img-US10018922189-0001901001.exe (PID: 120)
      • RegAsm.exe (PID: 2480)

    • Executable content was dropped or overwritten

      • Img-US10018922189-0001901001.exe (PID: 120)
      • WinRAR.exe (PID: 2916)
      • RegAsm.exe (PID: 2480)
      • Img-US10018922189-0001901001.exe (PID: 752)
      • WinRAR.exe (PID: 2508)
      • Img-US10018922189-0001901001.exe (PID: 3116)
      • Img-US10018922189-0001901001.exe (PID: 2304)

    • Application launched itself

      • WinRAR.exe (PID: 2916)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

Composite

VolumeSize: 2004 kB

ISO

VolumeModifyDate: 2019:04:24 13:08:53.00+01:00
VolumeCreateDate: 2019:04:24 13:08:53.00+01:00
Software: IMGBURN V2.5.8.0 - THE ULTIMATE IMAGE BURNER!
VolumeSetName: UNDEFINED
RootDirectoryCreateDate: 2019:04:24 13:08:53+01:00
VolumeBlockSize: 2048
VolumeBlockCount: 1002
VolumeName: IMG_US10018922189_0001901001
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
12
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start rundll32.exe no specs winrar.exe img-us10018922189-0001901001.exe #NANOCORE regasm.exe explorer.exe no specs img-us10018922189-0001901001.exe regasm.exe no specs winrar.exe img-us10018922189-0001901001.exe regasm.exe no specs img-us10018922189-0001901001.exe regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Img-US10018922189-0001901001.img.isoC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2916"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Img-US10018922189-0001901001.img.iso"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
120"C:\Users\admin\AppData\Local\Temp\Rar$EXa2916.18901\Img-US10018922189-0001901001.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2916.18901\Img-US10018922189-0001901001.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2480"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Img-US10018922189-0001901001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2988"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
752"C:\Users\admin\AppData\Local\Temp\Rar$EXa2916.21863\Img-US10018922189-0001901001.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2916.21863\Img-US10018922189-0001901001.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2392"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—Img-US10018922189-0001901001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2508"C:\Program Files\WinRAR\WinRAR.exe" -elevate2916C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3116"C:\Img-US10018922189-0001901001.exe" C:\Img-US10018922189-0001901001.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2076"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—Img-US10018922189-0001901001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
1 090
Read events
972
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
3
Text files
9
Unknown types
1

Dropped files

PID
Process
Filename
Type
2480RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bak —
MD5:—
SHA256:—
120Img-US10018922189-0001901001.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ghsdgfsdghfsfsd.urltext
MD5:67F5ED79A61E5159F7C31508B8F37248
SHA256:2AD9196DFC48AD398C3B30CB78E422FC09A4BFECD254A8121555F12CF7D920F2
2480RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:7C0048CC78EFAB86EE55E188B208B77D
SHA256:3A213AACB030246DD68A1892149B1D9071775F91ECDD3C7CC94C8EFD438D6D2F
120Img-US10018922189-0001901001.exeC:\Users\admin\AppData\Roaming\hgfggdsghfgdshffd\dfgdjfhdjhfdhdjf.exeexecutable
MD5:DA8904390FC62BD0CCB309C5AC6F7E96
SHA256:C03F8067D57F550849EDEEE73CFDD44724DBC7212C56F958C155C518979EC7CA
2480RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:3DD734AB503AE5AB3EEE240BB832CD54
SHA256:CDB259F600E374D0018B8C9ECC6242AEB6E131E81A52E588A91383F2DDC40261
2480RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:67FF8ECEB1F4594C2D5FD426C83DB640
SHA256:0960D8F1D6EE3469EC4172D65123895161659497F8C5D67902D7600075EF7ECE
752Img-US10018922189-0001901001.exeC:\Users\admin\AppData\Roaming\hgfggdsghfgdshffd\dfgdjfhdjhfdhdjf.exeexecutable
MD5:964DE43B6286B89961AC0084AE2C2CE1
SHA256:780B11BCF13A0539C6E850747E1EAAF0EE7E05A003DE0D2490A65834BCE1B69F
2508WinRAR.exeC:\Img-US10018922189-0001901001.exeexecutable
MD5:5AF71C7A450D261227029DB76DD991AC
SHA256:49C2FE6BA8646341B6ECD869DAF6FD8DFA0B522D20996F2321006D8A74D30AB6
3116Img-US10018922189-0001901001.exeC:\Users\admin\AppData\Roaming\hgfggdsghfgdshffd\ghsdgfsdghfsfsd.vbstext
MD5:E72D7451DEB9349F1C95160108E8185B
SHA256:1913E3F7571CDD5948696F865B7F1B392ED651D22CBFD215582A8E55BBC0173B
2916WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2916.21863\Img-US10018922189-0001901001.exeexecutable
MD5:5AF71C7A450D261227029DB76DD991AC
SHA256:49C2FE6BA8646341B6ECD869DAF6FD8DFA0B522D20996F2321006D8A74D30AB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2480
RegAsm.exe
185.247.228.161:8050
moran101.duckdns.org
—
—
malicious

DNS requests

Domain
IP
Reputation
moran101.duckdns.org
  • 185.247.228.161
malicious

Threats

PID
Process
Class
Message
2480
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2480
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2480
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2480
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2480
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2480
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2480
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2480
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2480
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2480
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
36 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Img-US10018922189-0001901001.img