File name: | Оферта-5764237,pdf.iso |
Full analysis: | https://app.any.run/tasks/57f69cc1-4795-456d-9498-c85de2675c64 |
Verdict: | Malicious activity |
Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
Analysis date: | February 19, 2019, 06:53:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-iso9660-image |
File info: | ISO 9660 CD-ROM filesystem data '??????-5764237,pdf' |
MD5: | 913B8543790E99EFB53832B310BD5A49 |
SHA1: | BF1F783AAC463ABE94805FFBFFD072D2199687CC |
SHA256: | 3F6A6EEC9E47642835863E42CAB5AC85EDED3CA82966E87022748C3B22AEEBEF |
SSDEEP: | 6144:/pTGoisEpj8+szTPEpdkdZRUZw38YU7l0t4pv1UFtT9QiHIGANtOv1Gl6qGWdFls:RTJijpABvOZwMo4pv1UFt5dHIGrKs |
.gmc | | | Game Music Creator Music (13.5) |
---|---|---|
.abr | | | Adobe PhotoShop Brush (12) |
VolumeSize: | 434 kB |
---|
VolumeModifyDate: | 2019:02:18 16:36:41.00+03:00 |
---|---|
VolumeCreateDate: | 2019:02:18 16:36:41.00+03:00 |
Software: | PowerISO |
RootDirectoryCreateDate: | 2019:02:18 16:36:41+03:00 |
VolumeBlockSize: | 2048 |
VolumeBlockCount: | 217 |
VolumeName: | ??????-5764237,pdf |
System: | Win32 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2984 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Оферта-5764237,pdf.iso | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2952 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Оферта-5764237,pdf.iso" | C:\Program Files\WinRAR\WinRAR.exe | rundll32.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2400 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.24026\Оферта-5764237,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.24026\Оферта-5764237,pdf.exe | WinRAR.exe | |
User: admin Company: unwelcoming Integrity Level: MEDIUM Description: razzed Exit code: 1 Version: 5.3.6.6 | ||||
2252 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.24026\Оферта-5764237,pdf.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | Оферта-5764237,pdf.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3640 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.36946\Оферта-5764237,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.36946\Оферта-5764237,pdf.exe | WinRAR.exe | |
User: admin Company: unwelcoming Integrity Level: MEDIUM Description: razzed Exit code: 1 Version: 5.3.6.6 | ||||
2844 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.36946\Оферта-5764237,pdf.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | Оферта-5764237,pdf.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2400 | Оферта-5764237,pdf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\verify.eu.url | ini | |
MD5:62C8BECF6C1C9AAC3B5FEF495F69D522 | SHA256:D5EFD179FB673FC1310C36B2C9D279DBFDE03BAB981DC1C02F3941F79C8AED16 | |||
3640 | Оферта-5764237,pdf.exe | C:\Users\admin\AppData\Roaming\verify\verify.exe | executable | |
MD5:836BA1F83CCAE00FD987C3383AFD401C | SHA256:5E84675D0D84D8FA5C2791539BF4617DE101624EA2663C00A5B6FF0107C40729 | |||
2952 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.24026\Оферта-5764237,pdf.exe | executable | |
MD5:836BA1F83CCAE00FD987C3383AFD401C | SHA256:5E84675D0D84D8FA5C2791539BF4617DE101624EA2663C00A5B6FF0107C40729 | |||
3640 | Оферта-5764237,pdf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\verify.eu.url | ini | |
MD5:62C8BECF6C1C9AAC3B5FEF495F69D522 | SHA256:D5EFD179FB673FC1310C36B2C9D279DBFDE03BAB981DC1C02F3941F79C8AED16 | |||
2252 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | text | |
MD5:803CFF1B883F6215D63C094C40D1C60F | SHA256:F6CC46E66AEAD5FDFC905322F8EA265B7C7330EF687EDD8F9347C386A2AE26A0 | |||
2400 | Оферта-5764237,pdf.exe | C:\Users\admin\AppData\Roaming\verify\verify.exe | executable | |
MD5:836BA1F83CCAE00FD987C3383AFD401C | SHA256:5E84675D0D84D8FA5C2791539BF4617DE101624EA2663C00A5B6FF0107C40729 | |||
2952 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2952.36946\Оферта-5764237,pdf.exe | executable | |
MD5:836BA1F83CCAE00FD987C3383AFD401C | SHA256:5E84675D0D84D8FA5C2791539BF4617DE101624EA2663C00A5B6FF0107C40729 | |||
2252 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.dat | bs | |
MD5:822E7FE00E2173CB5212587A1FDF24EE | SHA256:CAE40891D4DB69BB9C9E328BBC7B98C9DF3E55BC245F8F31BCD5BB57932D078F | |||
2252 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bin | binary | |
MD5:4E5E92E2369688041CC82EF9650EDED2 | SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48 | |||
2252 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.dat | binary | |
MD5:4D784935677AE26ACDC3FB84FA1E6CF8 | SHA256:C77E2D82DB9066E4DBFDE3AE0461A4259505F435EC0DB2CE3BD005BE0E2DE67C |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2252 | RegAsm.exe | 8.8.8.8:53 | — | Google Inc. | US | whitelisted |
— | — | 8.8.8.8:53 | — | Google Inc. | US | whitelisted |
— | — | 194.5.99.16:5626 | duncan222.ddns.net | — | FR | malicious |
2252 | RegAsm.exe | 194.5.99.16:5626 | duncan222.ddns.net | — | FR | malicious |
Domain | IP | Reputation |
---|---|---|
duncan222.ddns.net |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2252 | RegAsm.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
2252 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] NanoCore.RAT |
Process | Message |
---|---|
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |