File name:

Games Checker By DeC0de.zip

Full analysis: https://app.any.run/tasks/9405fc0b-bfed-4ef6-a029-7d3f224231a6
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: December 06, 2018, 13:16:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7DBE8DDDB9444F343AECAF5722D0CBD2

SHA1:

55CB8309D7FA197093556FCC8408A54E6A74E114

SHA256:

575C04E0AE08E64D7D819AA5D754A5457636708A3DA8036F81D214190E112248

SSDEEP:

24576:HApfO5QWjY2Pir2SXAf8BBB8ShA08X02zq:HAePiFs08Xu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • NanoCore was detected

      • Games Checker By Dec0de.exe (PID: 2992)
    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1360)
    • Application was dropped or rewritten from another process

      • Games Checker By Dec0de.exe (PID: 2992)
    • Changes the autorun value in the registry

      • Games Checker By Dec0de.exe (PID: 2992)
    • Uses Task Scheduler to run other applications

      • Games Checker By Dec0de.exe (PID: 2992)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2272)
      • schtasks.exe (PID: 3336)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3416)
      • Games Checker By Dec0de.exe (PID: 2992)
    • Creates files in the program directory

      • Games Checker By Dec0de.exe (PID: 2992)
    • Creates files in the user directory

      • Games Checker By Dec0de.exe (PID: 2992)
    • Connects to unusual port

      • Games Checker By Dec0de.exe (PID: 2992)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: None
ZipModifyDate: 2018:12:06 13:08:09
ZipCRC: 0xade0582d
ZipCompressedSize: 377344
ZipUncompressedSize: 377344
ZipFileName: Games Checker By DeC0de/Games Checker By Dec0de.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs #NANOCORE games checker by dec0de.exe schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1360"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2272"schtasks.exe" /create /f /tn "TCP Monitor" /xml "C:\Users\admin\AppData\Local\Temp\tmpE14B.tmp"C:\Windows\system32\schtasks.exeGames Checker By Dec0de.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2992"C:\Users\admin\Desktop\Games Checker By DeC0de\Games Checker By Dec0de.exe" C:\Users\admin\Desktop\Games Checker By DeC0de\Games Checker By Dec0de.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\games checker by dec0de\games checker by dec0de.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3336"schtasks.exe" /create /f /tn "TCP Monitor Task" /xml "C:\Users\admin\AppData\Local\Temp\tmpE1D9.tmp"C:\Windows\system32\schtasks.exeGames Checker By Dec0de.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Games Checker By DeC0de.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
796
Read events
787
Write events
9
Delete events
0

Modification events

(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3416) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Games Checker By DeC0de.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2992) Games Checker By Dec0de.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:TCP Monitor
Value:
C:\Program Files\TCP Monitor\tcpmon.exe
Executable files
5
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2992Games Checker By Dec0de.exeC:\Users\admin\AppData\Local\Temp\tmpE14B.tmp
MD5:
SHA256:
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3416.21670\Games Checker By DeC0de\Games Checker By Dec0de.exeexecutable
MD5:
SHA256:
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3416.21670\Games Checker By DeC0de\MailKit.dllexecutable
MD5:
SHA256:
2992Games Checker By Dec0de.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:
SHA256:
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3416.21670\Games Checker By DeC0de\xNet.dllexecutable
MD5:3DF8D87A482EFAD957D83819ADB3020F
SHA256:2AC175B4D44245EE8E7AEE9CC36DF86925EF903D8516F20A2C51D84E35F23DA4
2992Games Checker By Dec0de.exeC:\Program Files\TCP Monitor\tcpmon.exeexecutable
MD5:
SHA256:
2992Games Checker By Dec0de.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\task.dattext
MD5:
SHA256:
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3416.21670\Games Checker By DeC0de\ControlzEx.dllexecutable
MD5:5CF2837021516334344629CB679D40B5
SHA256:55CAE0AF8517AC2D787B210AC6F79C9AAC7F58035B69FAAF620A90F33E2676FC
2992Games Checker By Dec0de.exeC:\Users\admin\AppData\Local\Temp\tmpE1D9.tmpxml
MD5:E4118E3EC98934AA1D4235C87B44AA31
SHA256:EFC475D73603DF6A26978D7BCAC27004830137E97FDD1656140B4A08C07470D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
28
DNS requests
14
Threats
14

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2992
Games Checker By Dec0de.exe
8.8.8.8:53
Google Inc.
US
malicious
2992
Games Checker By Dec0de.exe
85.184.173.74:54984
wauf.ddns.net
Aura Fiber OE A/S
DK
malicious

DNS requests

Domain
IP
Reputation
wauf.ddns.net
  • 85.184.173.74
malicious

Threats

PID
Process
Class
Message
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2992
Games Checker By Dec0de.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
No debug info