File name: | Оферта-5764237,pdf.iso |
Full analysis: | https://app.any.run/tasks/d10c566a-1d7d-4677-a6cd-1caff622d88f |
Verdict: | Malicious activity |
Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
Analysis date: | February 19, 2019, 06:59:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-iso9660-image |
File info: | ISO 9660 CD-ROM filesystem data '??????-5764237,pdf' |
MD5: | 913B8543790E99EFB53832B310BD5A49 |
SHA1: | BF1F783AAC463ABE94805FFBFFD072D2199687CC |
SHA256: | 3F6A6EEC9E47642835863E42CAB5AC85EDED3CA82966E87022748C3B22AEEBEF |
SSDEEP: | 6144:/pTGoisEpj8+szTPEpdkdZRUZw38YU7l0t4pv1UFtT9QiHIGANtOv1Gl6qGWdFls:RTJijpABvOZwMo4pv1UFt5dHIGrKs |
.gmc | | | Game Music Creator Music (13.5) |
---|---|---|
.abr | | | Adobe PhotoShop Brush (12) |
System: | Win32 |
---|---|
VolumeName: | ??????-5764237,pdf |
VolumeBlockCount: | 217 |
VolumeBlockSize: | 2048 |
RootDirectoryCreateDate: | 2019:02:18 16:36:41+03:00 |
Software: | PowerISO |
VolumeCreateDate: | 2019:02:18 16:36:41.00+03:00 |
VolumeModifyDate: | 2019:02:18 16:36:41.00+03:00 |
VolumeSize: | 434 kB |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2964 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Оферта-5764237,pdf.iso | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2844 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Оферта-5764237,pdf.iso" | C:\Program Files\WinRAR\WinRAR.exe | rundll32.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2548 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.11645\Оферта-5764237,pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.11645\Оферта-5764237,pdf.exe | WinRAR.exe | |
User: admin Company: unwelcoming Integrity Level: MEDIUM Description: razzed Exit code: 1 Version: 5.3.6.6 | ||||
2356 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.11645\Оферта-5764237,pdf.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | Оферта-5764237,pdf.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2844 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.11645\Оферта-5764237,pdf.exe | executable | |
MD5:836BA1F83CCAE00FD987C3383AFD401C | SHA256:5E84675D0D84D8FA5C2791539BF4617DE101624EA2663C00A5B6FF0107C40729 | |||
2548 | Оферта-5764237,pdf.exe | C:\Users\admin\AppData\Roaming\verify\verify.exe | executable | |
MD5:836BA1F83CCAE00FD987C3383AFD401C | SHA256:5E84675D0D84D8FA5C2791539BF4617DE101624EA2663C00A5B6FF0107C40729 | |||
2356 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | binary | |
MD5:CCD406BC71673BDEE3FF066A489C20D2 | SHA256:8178FC30414DF75B318EEB1D16F41B34E91C21A511827DED0DDA037645B4451D | |||
2548 | Оферта-5764237,pdf.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\verify.eu.url | ini | |
MD5:62C8BECF6C1C9AAC3B5FEF495F69D522 | SHA256:D5EFD179FB673FC1310C36B2C9D279DBFDE03BAB981DC1C02F3941F79C8AED16 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2356 | RegAsm.exe | 8.8.8.8:53 | — | Google Inc. | US | whitelisted |
2356 | RegAsm.exe | 194.5.99.16:5626 | duncan222.ddns.net | — | FR | malicious |
Domain | IP | Reputation |
---|---|---|
duncan222.ddns.net |
| malicious |
Process | Message |
---|---|
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |
Оферта-5764237,pdf.exe | User32.dll |