analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

4749008331898880.zip

Full analysis: https://app.any.run/tasks/4456afeb-7f73-4f0c-868f-829f2b429305
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: July 13, 2020, 05:47:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
rat
nanocore
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C5680B3A6BD578EA2F40998F14D5D9EE

SHA1:

F466CE2B698F968514514265B06D245ADC036322

SHA256:

6A732B69E853E2AD1F9C8C28BA6EF89F7A0458098B7212AF581C7C9A7FA41FFD

SSDEEP:

6144:DvFB6mo2SYahcuVjdBMd0JHZ3wVDgKFdigjkvAdqKBHfLn:DvzqFZZn5ZAXOn+BDn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • corona.exe (PID: 2460)
    • NANOCORE was detected

      • RegSvcs.exe (PID: 2616)
    • Connects to CnC server

      • RegSvcs.exe (PID: 2616)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1840)
    • Creates files in the user directory

      • RegSvcs.exe (PID: 2616)
  • INFO

    • Manual execution by user

      • corona.exe (PID: 2460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x0138c1af
ZipCompressedSize: 320798
ZipUncompressedSize: 496640
ZipFileName: 57174c910f4a37c16ce2c9d84aac1ca48724069355c2713edf4fed77eb6c19f7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe corona.exe #NANOCORE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
1840"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4749008331898880.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2460"C:\Users\admin\Desktop\corona.exe" C:\Users\admin\Desktop\corona.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
WinFormControl
Exit code:
0
Version:
1.0.0.0
2616"{path}"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
corona.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
465
Read events
442
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1840WinRAR.exeC:\Users\admin\Desktop\57174c910f4a37c16ce2c9d84aac1ca48724069355c2713edf4fed77eb6c19f7executable
MD5:E0E097A9ED8B33A5E66A9FF58A4A2BDF
SHA256:57174C910F4A37C16CE2C9D84AAC1CA48724069355C2713EDF4FED77EB6C19F7
2616RegSvcs.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:42FBDC0094982602A304405C963DF8A8
SHA256:CB8F830D944C1BE87464E634A59627AACBD7B4845BA4692B79B797810D0289BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
50
DNS requests
25
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2616
RegSvcs.exe
192.169.69.25:54822
54822.duckdns.org
Wowrack.com
US
malicious
2616
RegSvcs.exe
8.8.8.8:53
Google Inc.
US
whitelisted
8.8.8.8:53
Google Inc.
US
whitelisted
192.169.69.25:54822
54822.duckdns.org
Wowrack.com
US
malicious

DNS requests

Domain
IP
Reputation
54822.duckdns.org
  • 192.169.69.25
malicious

Threats

PID
Process
Class
Message
2616
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2616
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2616
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2616
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2616
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2616
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
No debug info