analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859

Full analysis: https://app.any.run/tasks/fd62df26-ea55-4234-8e88-cebd6101055a
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: September 18, 2019, 21:40:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

FEBD5DBF03EC044F5CEE4A57A8440213

SHA1:

5B117FF7CA19618314944CE8FF6737C110B30CEE

SHA256:

7E2FD31C9C860812D84FCFDFC2AE262D95104C2275EC5298EF8CF24A162380BB

SSDEEP:

6144:Y2Nztfj5+6kCPiThtotonKzTv8xKbPENrs3lX0xlhLve6OkPZ84858A2S9o3/0Vr:xNxfdavdOenu6g8NiAROkPZ84858976

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe (PID: 3236)
    • NANOCORE was detected

      • RegAsm.exe (PID: 2256)
    • Application was dropped or rewritten from another process

      • TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe (PID: 3236)
  • SUSPICIOUS

    • Creates files in the user directory

      • RegAsm.exe (PID: 2256)
    • Executable content was dropped or overwritten

      • TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe (PID: 3236)
      • WinRAR.exe (PID: 2756)
    • Connects to unusual port

      • RegAsm.exe (PID: 2256)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 371722
UncompressedSize: 542208
OperatingSystem: Win32
ModifyDate: 2019:08:08 08:26:11
PackingMethod: Normal
ArchivedFileName: TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe transferencia de consignacion de pago exitoso soporte de confirmacion  soporte-img-6249624963298859pdf.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2756"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3236"C:\Users\admin\AppData\Local\Temp\Rar$EXa2756.36273\TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2756.36273\TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
2256"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
447
Read events
434
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2756WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2756.36273\TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exeexecutable
MD5:B7AB18DFEB2509CC00A54EC7A8D9601F
SHA256:DF131485F682809839E157DD91573311FE5792A6D659B869B8C2FB3BD13E75B5
3236TRANSFERENCIA DE CONSIGNACION DE PAGO EXITOSO SOPORTE DE CONFIRMACION SOPORTE-IMG-6249624963298859pdf.exeC:\Users\admin\chrome.exeexecutable
MD5:B7AB18DFEB2509CC00A54EC7A8D9601F
SHA256:DF131485F682809839E157DD91573311FE5792A6D659B869B8C2FB3BD13E75B5
2256RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:D21AE6BF1491498505AFAB9634CB4D00
SHA256:3463F3273DC415DDEF486B5430346AE8A669BCDA2A110EC75A558EF4B3397FD4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2256
RegAsm.exe
8.8.8.8:53
Google Inc.
US
whitelisted
2256
RegAsm.exe
181.61.168.188:1996
retet.duckdns.org
Telmex Colombia S.A.
CO
malicious

DNS requests

Domain
IP
Reputation
retet.duckdns.org
  • 181.61.168.188
malicious

Threats

PID
Process
Class
Message
2256
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2256
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2256
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info