analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

SKMBT-94059493488577463745.pdf.ace

Full analysis: https://app.any.run/tasks/5ed25fe0-e10a-48c3-b11a-30ab2cdbba3e
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: March 14, 2019, 10:59:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

2940DA5521ECA611B96D7609741DE4BB

SHA1:

04EE5F90CB1F8702DDF8067F59B765DE257DC9DA

SHA256:

4BA4F07835AD9AD287BBD053C6F7B40CC8B71EDC50CD3E0EBA543144CD24FE15

SSDEEP:

6144:ioOQm5c2adOp+iAwvFkybpCpvKhwpM/4+CrhAvKRlv2l49Oxa9FensbMEqLy+tWX:z5DfwvhbGcw6wnhcSsa9OxaL07bLy+tq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 14th march.exe (PID: 3020)
      • SKMBT-94059493488577463745.pdf.scr (PID: 2504)
      • 14th march.exe (PID: 1852)

    • Writes to a start menu file

      • 14th march.exe (PID: 3020)

    • Changes the autorun value in the registry

      • 14th march.exe (PID: 1852)

    • NanoCore was detected

      • 14th march.exe (PID: 1852)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • SKMBT-94059493488577463745.pdf.scr (PID: 2504)

    • Creates files in the user directory

      • cmd.exe (PID: 3388)
      • 14th march.exe (PID: 3020)
      • 14th march.exe (PID: 1852)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3388)
      • 14th march.exe (PID: 1852)

    • Application launched itself

      • 14th march.exe (PID: 3020)

    • Connects to unusual port

      • 14th march.exe (PID: 1852)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs skmbt-94059493488577463745.pdf.scr no specs cmd.exe cmd.exe no specs 14th march.exe taskmgr.exe no specs #NANOCORE 14th march.exe

Process information

PID
CMD
Path
Indicators
Parent process
2752"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SKMBT-94059493488577463745.pdf.ace.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2504"C:\Users\admin\Desktop\SKMBT-94059493488577463745.pdf.scr" /SC:\Users\admin\Desktop\SKMBT-94059493488577463745.pdf.scr—explorer.exe
User:
admin
Company:
TMC LEMN INVEST SRL
Integrity Level:
MEDIUM
Description:
Outlook Express Backup plugin
Exit code:
0
Version:
10.14.20.1
3388"C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\Desktop\SKMBT-94059493488577463745.pdf.scr" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exe"C:\Windows\System32\cmd.exe
SKMBT-94059493488577463745.pdf.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2372"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exe"C:\Windows\System32\cmd.exe—SKMBT-94059493488577463745.pdf.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3020"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exe
cmd.exe
User:
admin
Company:
TMC LEMN INVEST SRL
Integrity Level:
MEDIUM
Description:
Outlook Express Backup plugin
Exit code:
0
Version:
10.14.20.1
3948"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1852"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exe
14th march.exe
User:
admin
Company:
TMC LEMN INVEST SRL
Integrity Level:
MEDIUM
Description:
Outlook Express Backup plugin
Version:
10.14.20.1
Total events
915
Read events
889
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2752.17853\SKMBT-94059493488577463745.pdf.scr —
MD5:—
SHA256:—
185214th march.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:C6F232E47534CD476C4929987BA32631
SHA256:2E6F1CB2E3B035402878DCE741D235807875EE3377CAFED7F845A84EFC5F4E6E
185214th march.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:F0FEDD1DA5A029809A80AF9D9C840407
SHA256:02C32CECCD694C48C8CFE2EE677395DCEF78D70C0AFD178C755B709A4AC88583
3388cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\14th march.exeexecutable
MD5:F0FEDD1DA5A029809A80AF9D9C840407
SHA256:02C32CECCD694C48C8CFE2EE677395DCEF78D70C0AFD178C755B709A4AC88583
302014th march.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\14th march.lnklnk
MD5:3AB4F83356478B30785CFC11E1B54405
SHA256:E922051B23BE5EDB19BE7DECA0C007F0021BFA19816F920CE0A6C46660C9E1D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1852
14th march.exe
45.249.90.124:1313
—
Korea Telecom
KR
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SKMBT-94059493488577463745.pdf.ace