File name:

funnything.exe

Full analysis: https://app.any.run/tasks/4ad62793-4eaf-4ebf-9d43-cdc7f214a67f
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: March 02, 2024, 19:52:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
nanocore
rat
remote
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6ACA8FFD54AF068F0C7F85FA3C65C576

SHA1:

4D6DDDB08DFFCEAE59BE6D619483B825B73FD492

SHA256:

3DE5571DD02A60841B980B77961D78A3734EFA5AFD1F17416A77310473D2F5BA

SSDEEP:

6144:7r+qqvRbNrmq1g5S1kFpcVeikky8gDxfQs75yn7JdbZfSfm93WVN:zaRbVmq1mjp+b+1QGkn7J9Zfsm93WVN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • funnything.exe (PID: 3668)
      • nan.exe (PID: 3692)

    • NANOCORE has been detected (YARA)

      • funnything.exe (PID: 3668)
      • nan.exe (PID: 3692)

    • Gets %windir% folder path (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 1432)

    • Create files in the Startup directory

      • wscript.exe (PID: 1432)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 1432)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 1432)

    • Gets username (SCRIPT)

      • wscript.exe (PID: 1432)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 1432)

    • Changes the autorun value in the registry

      • nan.exe (PID: 3692)

    • NANOCORE has been detected (SURICATA)

      • nan.exe (PID: 3692)

    • Unusual connection from system programs

      • wscript.exe (PID: 1432)

    • Connects to the CnC server

      • nan.exe (PID: 3692)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 1432)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1432)

  • SUSPICIOUS

    • Reads the Internet Settings

      • funnything.exe (PID: 3668)
      • wscript.exe (PID: 1432)
      • nan.exe (PID: 3692)

    • Executable content was dropped or overwritten

      • funnything.exe (PID: 3668)
      • nan.exe (PID: 3692)

    • Reads security settings of Internet Explorer

      • funnything.exe (PID: 3668)
      • nan.exe (PID: 3692)

    • The process executes VB scripts

      • funnything.exe (PID: 3668)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 1432)
      • wscript.exe (PID: 3488)

    • Gets a collection of all available drive names (SCRIPT)

      • wscript.exe (PID: 1432)

    • Gets disk free space (SCRIPT)

      • wscript.exe (PID: 1432)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 1432)

    • Creates a Folder object (SCRIPT)

      • wscript.exe (PID: 1432)

    • Accesses local storage devices (Win32_LogicalDisk) via WMI (SCRIPT)

      • wscript.exe (PID: 1432)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 1432)

    • Gets computer name (SCRIPT)

      • wscript.exe (PID: 1432)

    • Gets the drive type (SCRIPT)

      • wscript.exe (PID: 1432)

    • Checks whether the drive is ready (SCRIPT)

      • wscript.exe (PID: 1432)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 1432)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 1432)

    • Accesses WMI object caption (SCRIPT)

      • wscript.exe (PID: 1432)

    • Accesses operating system name via WMI (SCRIPT)

      • wscript.exe (PID: 1432)

    • Connects to unusual port

      • wscript.exe (PID: 1432)
      • nan.exe (PID: 3692)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3616)

    • Starts CMD.EXE for commands execution

      • salinewin.exe (PID: 2632)

  • INFO

    • Checks supported languages

      • funnything.exe (PID: 3668)
      • nan.exe (PID: 3692)
      • nan.exe (PID: 2896)
      • salinewin.exe (PID: 2632)

    • Reads the computer name

      • funnything.exe (PID: 3668)
      • nan.exe (PID: 3692)
      • nan.exe (PID: 2896)
      • salinewin.exe (PID: 2632)

    • Process checks whether UAC notifications are on

      • nan.exe (PID: 3692)

    • Reads Environment values

      • nan.exe (PID: 3692)

    • Reads the machine GUID from the registry

      • nan.exe (PID: 3692)
      • nan.exe (PID: 2896)

    • Creates files or folders in the user directory

      • nan.exe (PID: 3692)

    • Manual execution by a user

      • nan.exe (PID: 2896)
      • wscript.exe (PID: 3488)

    • Checks proxy server information

      • wscript.exe (PID: 1432)

    • Reads product name

      • nan.exe (PID: 3692)

    • Create files in a temporary directory

      • nan.exe (PID: 3692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Nanocore

(PID) Process(3692) nan.exe
KeyboardLoggingTrue
BuildTime2024-03-02 19:47:13.325304
Version1.2.2.0
Mutex2e5f3c36-4873-479c-80aa-92426c28e6ac
DefaultGroupDefault
PrimaryConnectionHostBaggard437.ddns.net
BackupConnectionHostBaggard437.ddns.net
ConnectionPort8131
RunOnStartupTrue
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5006
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8003
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x0154
OSVersion: -
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NANOCORE funnything.exe wscript.exe #NANOCORE nan.exe nan.exe no specs wscript.exe no specs salinewin.exe no specs salinewin.exe cmd.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\AppData\Local\Temp\salinewin.exe" C:\Users\admin\AppData\Local\Temp\salinewin.exe—nan.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\salinewin.exe
c:\windows\system32\ntdll.dll
1432"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\kj.vbs" C:\Windows\System32\wscript.exe
funnything.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2632"C:\Users\admin\AppData\Local\Temp\salinewin.exe" C:\Users\admin\AppData\Local\Temp\salinewin.exe
nan.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\salinewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
2896"C:\Users\admin\Desktop\nan.exe" C:\Users\admin\Desktop\nan.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\nan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2992REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3488"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\kj.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3616C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /fC:\Windows\System32\cmd.exe—salinewin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3668"C:\Users\admin\AppData\Local\Temp\funnything.exe" C:\Users\admin\AppData\Local\Temp\funnything.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\funnything.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3692"C:\Users\admin\Desktop\nan.exe" C:\Users\admin\Desktop\nan.exe
funnything.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\nan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Nanocore
(PID) Process(3692) nan.exe
KeyboardLoggingTrue
BuildTime2024-03-02 19:47:13.325304
Version1.2.2.0
Mutex2e5f3c36-4873-479c-80aa-92426c28e6ac
DefaultGroupDefault
PrimaryConnectionHostBaggard437.ddns.net
BackupConnectionHostBaggard437.ddns.net
ConnectionPort8131
RunOnStartupTrue
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5006
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8003
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
Total events
5 464
Read events
5 352
Write events
97
Delete events
15

Modification events

(PID) Process:(3668) funnything.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3668) funnything.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3668) funnything.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3668) funnything.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER
Operation:writeName:KJ
Value:
No
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:System.vbs
Value:
"C:\Users\admin\AppData\Local\Temp\System.vbs"
(PID) Process:(1432) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:System.vbs
Value:
"C:\Users\admin\AppData\Local\Temp\System.vbs"
(PID) Process:(3692) nan.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:TCP Monitor
Value:
C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1432) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
3
Suspicious files
1
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
2632salinewin.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
3668funnything.exeC:\Users\admin\Desktop\nan.exeexecutable
MD5:C98F5B4483F6B0F6EE0058F2E2C49B52
SHA256:2FA2CBE2B65BC74CB56F993E1BE684E4A31C94C4E749A278DB0EB078A471ADF3
3668funnything.exeC:\Users\admin\Desktop\kj.vbstext
MD5:1FADA102E3C8E5D9D866CC7DF94D0C32
SHA256:977FC109161458CE8722BA42CB83A7E609F6E5AFA90855702D8797BD82B794BE
3692nan.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbinary
MD5:5C33875B0D9ED1CDD09EF767C77A9B6D
SHA256:9D1BD160E7720DC3129B93930BE4CF5093C2490994D169541FC4214CE001DBDA
3692nan.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:C98F5B4483F6B0F6EE0058F2E2C49B52
SHA256:2FA2CBE2B65BC74CB56F993E1BE684E4A31C94C4E749A278DB0EB078A471ADF3
3692nan.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:B3AF27165C2EE971B8A61A445D77BD77
SHA256:9C53BF0F8016861052B1709C6D6691C5490254BCBC61E1B86EB99CB934778CEF
1432wscript.exeC:\Users\admin\AppData\Local\Temp\System.vbstext
MD5:1FADA102E3C8E5D9D866CC7DF94D0C32
SHA256:977FC109161458CE8722BA42CB83A7E609F6E5AFA90855702D8797BD82B794BE
1432wscript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.vbstext
MD5:1FADA102E3C8E5D9D866CC7DF94D0C32
SHA256:977FC109161458CE8722BA42CB83A7E609F6E5AFA90855702D8797BD82B794BE
3692nan.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:CFF614A2B14418BC9021E86D3D4C6E8D
SHA256:D2080D69752D67869EEB37A61DD8112061D9B55C93B0427A3E9D4CEBE01D4BF4
3692nan.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bakbinary
MD5:B3AF27165C2EE971B8A61A445D77BD77
SHA256:9C53BF0F8016861052B1709C6D6691C5490254BCBC61E1B86EB99CB934778CEF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
18
DNS requests
3
Threats
61

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3692
nan.exe
139.84.139.29:8131
Baggard437.ddns.net
AS-CHOOPA
US
malicious
1432
wscript.exe
139.84.139.29:9981
Baggard437.ddns.net
AS-CHOOPA
US
malicious

DNS requests

Domain
IP
Reputation
Baggard437.ddns.net
  • 139.84.139.29
unknown
baggard437.ddns.net
  • 139.84.139.29
unknown

Threats

PID
Process
Class
Message
3692
nan.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1080
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3692
nan.exe
A Network Trojan was detected
ET MALWARE NanoCore RAT Keepalive Response 3
3692
nan.exe
A Network Trojan was detected
ET MALWARE NanoCore RAT Keepalive Response 1
3692
nan.exe
A Network Trojan was detected
ET MALWARE NanoCore RAT Keepalive Response 3
3692
nan.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3692
nan.exe
A Network Trojan was detected
ET MALWARE NanoCore RAT Keepalive Response 1
54 ETPRO signatures available at the full report
Process
Message
funnything.exe
%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
funnything.exe