analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

document.z

Full analysis: https://app.any.run/tasks/f5fbea1f-b4a4-41ab-9ae4-0df29116016b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: January 22, 2019, 14:10:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

4D4842A26674EB8F1A2B9FAAC7BC9245

SHA1:

B51C84D3B0073064581A7836C0A6D9FDBC37BCD9

SHA256:

3CCA2162B81E500BB980EF16345A34B46F5DFF45D7CEA734AB1690587D520AB1

SSDEEP:

6144:o3Xzif/+8jvSK6P6PpdPX3/+sS4PVsda1FbouQ7fjLMUGhya5T:EWf/s0dPX3/7Ns2RouQ7fjLlGhykT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • document.exe (PID: 792)
      • app.exe (PID: 2436)
      • app.exe (PID: 1964)

    • Writes to a start menu file

      • app.exe (PID: 2436)

    • Changes the autorun value in the registry

      • app.exe (PID: 1964)

    • NanoCore was detected

      • app.exe (PID: 1964)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3004)
      • cmd.exe (PID: 1844)
      • app.exe (PID: 1964)

    • Starts CMD.EXE for commands execution

      • document.exe (PID: 792)

    • Creates files in the user directory

      • cmd.exe (PID: 1844)
      • app.exe (PID: 2436)
      • app.exe (PID: 1964)

    • Application launched itself

      • app.exe (PID: 2436)

    • Connects to unusual port

      • app.exe (PID: 1964)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 3004)
      • cmd.exe (PID: 1844)
      • app.exe (PID: 1964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 397115
UncompressedSize: 421888
OperatingSystem: Win32
ModifyDate: 2019:01:21 21:39:28
PackingMethod: Normal
ArchivedFileName: document.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe document.exe no specs cmd.exe cmd.exe no specs app.exe #NANOCORE app.exe

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Roaming\document.z.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
792"C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26039\document.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26039\document.exe—WinRAR.exe
User:
admin
Company:
Gas Natural Fenosa
Integrity Level:
MEDIUM
Description:
Application Server Command Line Admin Too
Exit code:
0
Version:
11.2.26.2
1844"C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26039\document.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"C:\Windows\System32\cmd.exe
document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3700"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"C:\Windows\System32\cmd.exe—document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2436"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe
cmd.exe
User:
admin
Company:
Gas Natural Fenosa
Integrity Level:
MEDIUM
Description:
Application Server Command Line Admin Too
Exit code:
0
Version:
11.2.26.2
1964"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe
app.exe
User:
admin
Company:
Gas Natural Fenosa
Integrity Level:
MEDIUM
Description:
Application Server Command Line Admin Too
Version:
11.2.26.2
Total events
897
Read events
880
Write events
17
Delete events
0

Modification events

(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Roaming\document.z.rar
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
3
Suspicious files
1
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3004WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3004.26039\document.exeexecutable
MD5:373E3A58810EA64B4A3D6100902D803D
SHA256:5EE9079FE753A4F87E50520BAE08D2A47F6B3A56CB1B98EF06E9642C49E06A0C
1964app.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:373E3A58810EA64B4A3D6100902D803D
SHA256:5EE9079FE753A4F87E50520BAE08D2A47F6B3A56CB1B98EF06E9642C49E06A0C
1844cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exeexecutable
MD5:373E3A58810EA64B4A3D6100902D803D
SHA256:5EE9079FE753A4F87E50520BAE08D2A47F6B3A56CB1B98EF06E9642C49E06A0C
2436app.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.lnklnk
MD5:843E3F945348A7C1516AF13552AD019E
SHA256:78C01078935AF8F8EEA38EDF29EE29C102E1A20758D39E23C9635BA9B0AF2D1C
1964app.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:AC2B05707941C087F42707B9ED1EB0DB
SHA256:912A27295A8DCDAFFA699A64E7835C68ABF53D9C37F962FB0B5E551C631E1451
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
24
DNS requests
9
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1964
app.exe
129.56.128.190:6090
creativity680.hopto.org
AS-NATCOM
NG
unknown
1964
app.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
1964
app.exe
185.84.181.64:6090
—
Radore Veri Merkezi Hizmetleri A.S.
TR
unknown

DNS requests

Domain
IP
Reputation
creativity680.hopto.org
  • 129.56.128.190
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
document.z