analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample.zip

Full analysis: https://app.any.run/tasks/ff368a1c-659a-481f-b76d-ea84c1cbab78
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: October 09, 2019, 16:54:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
rat
nanocore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E2F26958F2E4999F3CD6AF6DE352453D

SHA1:

121FFEC31894704BCDFD793AEE8D55515776464B

SHA256:

436FD59DDB97D1121249BBCB47C3DB6A4A258318EE1A3B505B89F898B080D1D6

SSDEEP:

24576:PhXhgV+kCr0y9NY04XfCgn6/g7i3iMFfR8siWtTafzRDyec9+XpGta87xHpw6Yzz:JXyV7Cr0yTcXfrgg4FfRdgfFDyef4Y8m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • matoidghp.exe (PID: 3824)
      • KKK.exe (PID: 3552)
      • RegSvcs.exe (PID: 3652)

    • Changes the autorun value in the registry

      • RegSvcs.exe (PID: 3652)
      • matoidghp.exe (PID: 3824)

    • NANOCORE was detected

      • RegSvcs.exe (PID: 3652)

  • SUSPICIOUS

    • Drop AutoIt3 executable file

      • KKK.exe (PID: 3552)

    • Executes scripts

      • KKK.exe (PID: 3552)

    • Executable content was dropped or overwritten

      • KKK.exe (PID: 3552)
      • RegSvcs.exe (PID: 3652)
      • matoidghp.exe (PID: 3824)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • matoidghp.exe (PID: 3824)

    • Creates files in the user directory

      • RegSvcs.exe (PID: 3652)

  • INFO

    • Manual execution by user

      • KKK.exe (PID: 3552)

    • Dropped object may contain Bitcoin addresses

      • KKK.exe (PID: 3552)

    • Reads internet explorer settings

      • mshta.exe (PID: 2920)
      • mshta.exe (PID: 2784)
      • mshta.exe (PID: 3764)
      • mshta.exe (PID: 2212)
      • mshta.exe (PID: 3484)
      • mshta.exe (PID: 2224)
      • mshta.exe (PID: 3212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ef9399691deee804becb065f2b1506959d10b04a1c194ff68df355b3b7f74df5.bin
ZipUncompressedSize: 1289387
ZipCompressedSize: 1159785
ZipCRC: 0x42051ef6
ZipModifyDate: 2019:10:09 16:54:00
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 788
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs kkk.exe wscript.exe no specs matoidghp.exe mshta.exe no specs mshta.exe no specs mshta.exe no specs mshta.exe no specs mshta.exe no specs mshta.exe no specs mshta.exe no specs #NANOCORE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2928"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3552"C:\Users\admin\Desktop\KKK.exe" C:\Users\admin\Desktop\KKK.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3728"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\11929990\mttm.vbs" C:\Windows\System32\WScript.exe—KKK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3824"C:\Users\admin\AppData\Local\Temp\11929990\matoidghp.exe" jwuat.xefC:\Users\admin\AppData\Local\Temp\11929990\matoidghp.exe
WScript.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Version:
3, 3, 8, 1
2784"C:\Windows\system32\mshta.exe" C:\Windows\system32\mshta.exe—matoidghp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2920"C:\Windows\system32\mshta.exe" C:\Windows\system32\mshta.exe—matoidghp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3764"C:\Windows\system32\mshta.exe" C:\Windows\system32\mshta.exe—matoidghp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2212"C:\Windows\system32\mshta.exe" C:\Windows\system32\mshta.exe—matoidghp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3484"C:\Windows\system32\mshta.exe" C:\Windows\system32\mshta.exe—matoidghp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2224"C:\Windows\system32\mshta.exe" C:\Windows\system32\mshta.exe—matoidghp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 506
Read events
1 398
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
81
Unknown types
1

Dropped files

PID
Process
Filename
Type
2928WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2928.8255\ef9399691deee804becb065f2b1506959d10b04a1c194ff68df355b3b7f74df5.bin —
MD5:—
SHA256:—
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\jwuat.xef —
MD5:—
SHA256:—
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\bfkemoqi.pdftext
MD5:76BDB11050F103316E5090E5FC573845
SHA256:E1F56CAE095AE6CDDBAFE91D8D58CD6C0BBB7D778E2F6ACE6B0E6A5F78675EC3
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\ulutewjh.xlstext
MD5:940B0CADA609BF7579C97E6AF98FBCE5
SHA256:2DAE9759D762F6CA22E5F70A0C7593967DFA1BD16C108B6DBD2BF23B0DB4CCDE
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\argfujqxxm.dattext
MD5:3E5E87C2C8CF199E979390DB828A7B34
SHA256:7FEFE9828DA84337F05303D6A952D6C89D6A6FA43DF2B9E4ADC46C9856CCB9F9
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\ohcei.logtext
MD5:F1700D5AAD306699FC4BC7E21732EC13
SHA256:1F5988C7E5C23E3C2D38A3BF2F9E83847595F106969FE4FC4EDA98BE534F7091
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\rubnr.mp3text
MD5:B48BFD1C5AB11BF38BEF2A017E9A9159
SHA256:46FBAB56093EA277F04A366750DA06BD1EB0CD76372F539B0C59D961B2EB5EC3
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\liqqjx.jpgtext
MD5:A91DAF2A8F93D49AB5DD4B8698313D19
SHA256:54EDF389F2F5F5C5E61378A3B592BA78E55969EF85D4F3D440DA183D703F59A4
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\rpbbamiuaq.msctext
MD5:FE46719F13DB2F0D9FD78B06F6A3C38E
SHA256:C5954F7FED1CEFC1B23C3AE3257F8A6BF3608EE65A27A78F9F8BE2EE9CF9199A
3552KKK.exeC:\Users\admin\AppData\Local\Temp\11929990\lljducgowp.xlstext
MD5:6F8CE06EEBC6CE28492BDCCC4368299B
SHA256:1451B1F62ADE82188BA7C645639805CB8763AA57769376C36192DFC88E729006
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
12
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
8.8.8.8:53
—
Google Inc.
US
whitelisted
3652
RegSvcs.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
—
—
194.5.99.46:1977
gbengajb.hopto.org
—
FR
unknown
3652
RegSvcs.exe
194.5.99.46:1977
gbengajb.hopto.org
—
FR
unknown

DNS requests

Domain
IP
Reputation
gbengajb.hopto.org
  • 194.5.99.46
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sample.zip