analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | Fortnite_Account_Gen_V3.rar |
| Full analysis: | https://app.any.run/tasks/6e9e8c89-8ffd-47fb-b8b2-7078bfc6ae27 |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | January 14, 2022, 22:27:34 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | CD654A8D405C26586AD1AA3981112BF0 |
| SHA1: | C0545420C4626A6C9152D243013CC6B11308CE16 |
| SHA256: | 53FDF119354A8C15C09E15E4640DC6DAEAF95863F0845B591D97AA5CCEB43D8B |
| SSDEEP: | 12288:tJ68tSfyqHejasrJnWKV36FiS3Akg6gn/3/mvcni5PdjCnYaqANMfWv:JY9rWWKpS/ASU/ue0ANf |
MALICIOUS
Application was dropped or rewritten from another process
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 2072)
- Fortnite Account Gen V3.exe (PID: 2920)
- Fortnite Account Gen V3.exe (PID: 3556)
Uses Task Scheduler to run other applications
- Fortnite Account Gen V3.exe (PID: 2992)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 3324)
Connects to CnC server
- Fortnite Account Gen V3.exe (PID: 3556)
NANOCORE was detected
- Fortnite Account Gen V3.exe (PID: 3556)
SUSPICIOUS
Reads the computer name
- Fortnite Account Gen V3.exe (PID: 2992)
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 3556)
Checks supported languages
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 3556)
Drops a file with a compile date too recent
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
Drops a file that was compiled in debug mode
- WinRAR.exe (PID: 1408)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
Modifies files in Chrome extension folder
- chrome.exe (PID: 956)
Creates files in the user directory
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 3556)
Application launched itself
- Fortnite Account Gen V3.exe (PID: 2992)
INFO
Reads the computer name
- chrome.exe (PID: 956)
- chrome.exe (PID: 2912)
- chrome.exe (PID: 1888)
- chrome.exe (PID: 3972)
- chrome.exe (PID: 3144)
- schtasks.exe (PID: 3324)
Checks supported languages
- chrome.exe (PID: 956)
- chrome.exe (PID: 2912)
- chrome.exe (PID: 4036)
- chrome.exe (PID: 1888)
- chrome.exe (PID: 2072)
- chrome.exe (PID: 2248)
- chrome.exe (PID: 2228)
- chrome.exe (PID: 3972)
- chrome.exe (PID: 2180)
- chrome.exe (PID: 736)
- chrome.exe (PID: 2916)
- chrome.exe (PID: 2332)
- chrome.exe (PID: 3788)
- chrome.exe (PID: 2752)
- chrome.exe (PID: 3468)
- chrome.exe (PID: 3144)
- chrome.exe (PID: 3112)
- chrome.exe (PID: 3064)
- schtasks.exe (PID: 3324)
- chrome.exe (PID: 3628)
Reads the hosts file
- chrome.exe (PID: 956)
- chrome.exe (PID: 1888)
Manual execution by user
- chrome.exe (PID: 956)
Application launched itself
- chrome.exe (PID: 956)
Reads settings of System Certificates
- chrome.exe (PID: 1888)
Dropped object may contain Bitcoin addresses
- chrome.exe (PID: 956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
60
Monitored processes
25
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1408 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fortnite_Account_Gen_V3.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 2992 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Fortnite Account Gen V3.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Fortnite Account Gen V3.exe | WinRAR.exe | ||||||||||||
User: admin Company: Kee IT Integrity Level: MEDIUM Description: Leaky_Boat Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 956 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | Explorer.EXE | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 3221225547 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 4036 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6dd4d988,0x6dd4d998,0x6dd4d9a4 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2912 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1040 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1888 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1312 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2248 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2072 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2228 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 3972 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1032 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
Total events
6 906
Read events
6 816
Write events
89
Delete events
1
Modification events
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Fortnite_Account_Gen_V3.rar | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
5
Suspicious files
126
Text files
111
Unknown types
12
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E1F8E6-3BC.pma | — | |
MD5:— | SHA256:— | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC | SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\dd937b06-958b-427f-8a28-698ad4351f15.tmp | text | |
MD5:108DE700E13556711104B1915AE929E0 | SHA256:9B998FCEEA2DBAAC896CB86DABB4AFE604FEE64D58F157640EF16513546226B9 | |||
| 1408 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Fortnite Account Gen V3.exe | executable | |
MD5:CA3ACEA3E3F8995F05C69DB95D169DE3 | SHA256:1F5A52D891FE0242C8D2495C107161808230A7A147183C33BBB9BC524A1EBB76 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:8FF312A95D60ED89857FEB720D80D4E1 | SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B | |||
| 1408 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Email-Pass.dll | executable | |
MD5:BF929442B12D4B5F9906B29834BF7DB1 | SHA256:B33435AC7CDEFCF7C2ADF96738C762A95414EB7A4967EF6B88DCDA14D58BFEE0 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:5BD3C311F2136A7A88D3E197E55CF902 | SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old | text | |
MD5:995C92837E4775CAFFE387D51ADBA520 | SHA256:51247C3464FD988B72670002D01A57FBFF1348704D325DC8FF8817ED2459D0D9 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF141309.TMP | text | |
MD5:B628564B8042F6E2CC2F53710AAECDC0 | SHA256:1D3B022BDEE9F48D79E3EC1E93F519036003642D3D72D10B05CFD47F43EFBF13 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:7721CDA9F5B73CE8A135471EB53B4E0E | SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
22
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1888 | chrome.exe | GET | 403 | 104.23.132.78:80 | http://hackforums.net/ | US | html | 20.7 Kb | malicious |
1888 | chrome.exe | GET | 403 | 104.23.132.78:80 | http://hackforums.net/favicon.ico | US | html | 20.7 Kb | malicious |
1888 | chrome.exe | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | crx | 242 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1888 | chrome.exe | 142.250.185.174:443 | clients2.google.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.186.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.74:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.77:443 | accounts.google.com | Google Inc. | US | suspicious |
1888 | chrome.exe | 142.250.186.132:443 | www.google.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.227:443 | www.gstatic.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 34.104.35.123:80 | edgedl.me.gvt1.com | — | US | whitelisted |
1888 | chrome.exe | 142.250.181.227:443 | update.googleapis.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.238:443 | encrypted-tbn0.gstatic.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.184.227:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.google.com |
| whitelisted |
clients2.google.com |
| whitelisted |
accounts.google.com |
| shared |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
encrypted-tbn0.gstatic.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3556 | Fortnite Account Gen V3.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
31 ETPRO signatures available at the full report