analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New_Order_1101201913_autecpower,pdf.iso

Full analysis: https://app.any.run/tasks/22789278-4461-4906-ab2d-dd18c0fe8e09
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: January 10, 2019, 20:25:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/x-iso9660-image
File info: ISO 9660 CD-ROM filesystem data 'New_Order_1101201913_autecpower,'
MD5:

8A156F00290E7BA8EC3C12F94C54D82F

SHA1:

9AC05699643677B4C9F83D4514D9FF8719C73BF3

SHA256:

3189CB7669C79812550CE07FAE069CF354E81AE7053A0AA5C46F0F3F40B862B0

SSDEEP:

24576:ICdxte/80jYLT3U1jfsWa0nFbgMVB0l28NhbifcDYwYNpm6Jg79jQF:Bw80cTsjkWaWMl36cYv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • New_Order_1101201913_autecpower,pdf.exe (PID: 1744)
      • New_Order_1101201913_autecpower,pdf.exe (PID: 3300)
      • New_Order_1101201913_autecpower,pdf.exe (PID: 2892)
    • Connects to CnC server

      • RegAsm.exe (PID: 2224)
    • NanoCore was detected

      • RegAsm.exe (PID: 2224)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3088)
    • Connects to unusual port

      • RegAsm.exe (PID: 2224)
    • Creates files in the user directory

      • RegAsm.exe (PID: 2224)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

Composite

VolumeSize: 1672 kB

ISO

VolumeModifyDate: 2019:01:10 14:52:47.00+01:00
VolumeCreateDate: 2019:01:10 14:52:47.00+01:00
Software: PowerISO
RootDirectoryCreateDate: 2019:01:10 14:52:47+01:00
VolumeBlockSize: 2048
VolumeBlockCount: 836
VolumeName: New_Order_1101201913_autecpower,
System: Win32
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start rundll32.exe no specs winrar.exe new_order_1101201913_autecpower,pdf.exe no specs new_order_1101201913_autecpower,pdf.exe no specs new_order_1101201913_autecpower,pdf.exe no specs #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2860"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\New_Order_1101201913_autecpower,pdf.isoC:\Windows\system32\rundll32.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3088"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\New_Order_1101201913_autecpower,pdf.iso"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1744"C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.49157\New_Order_1101201913_autecpower,pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.49157\New_Order_1101201913_autecpower,pdf.exeWinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Version:
...
3300"C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.49703\New_Order_1101201913_autecpower,pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.49703\New_Order_1101201913_autecpower,pdf.exeWinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Exit code:
0
Version:
...
2892"C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.920\New_Order_1101201913_autecpower,pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.920\New_Order_1101201913_autecpower,pdf.exeWinRAR.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Exit code:
0
Version:
...
2224"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
New_Order_1101201913_autecpower,pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
948
Read events
859
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
2
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3088WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3088.920\New_Order_1101201913_autecpower,pdf.exeexecutable
MD5:67602A57DA68A1B94729B8D5122EACED
SHA256:7EB51996B2CDC75B99AD797024F54F7D3B7FA4A1F096927AA623722F41433EDD
3088WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3088.49703\New_Order_1101201913_autecpower,pdf.exeexecutable
MD5:67602A57DA68A1B94729B8D5122EACED
SHA256:7EB51996B2CDC75B99AD797024F54F7D3B7FA4A1F096927AA623722F41433EDD
2224RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:BE9082A3154E564D2E9E6417C8D00F21
SHA256:84655266116D4B42518BADDFE1F8523943C0296B6D207EA3D302DDAFC42F932F
2224RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
2224RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:963D5E2C9C0008DFF05518B47C367A7F
SHA256:5EACF2974C9BB2C2E24CDC651C4840DD6F4B76A98F0E85E90279F1DBB2E6F3C0
2224RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
3088WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3088.49157\New_Order_1101201913_autecpower,pdf.exeexecutable
MD5:67602A57DA68A1B94729B8D5122EACED
SHA256:7EB51996B2CDC75B99AD797024F54F7D3B7FA4A1F096927AA623722F41433EDD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2224
RegAsm.exe
91.192.100.7:6494
SOFTplus Entwicklungen GmbH
CH
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2224
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2224
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2224
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2224
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4 ETPRO signatures available at the full report
No debug info