analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RE_ENQUIRY.rar

Full analysis: https://app.any.run/tasks/b5fa5477-4803-4546-8405-51f6283b1ce3
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: May 15, 2019, 10:17:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

A62D06D1D530CB7A4FFD8E8806029DBE

SHA1:

FE7A74315D79F076DE30DB09CA18DD872C5CB51C

SHA256:

887FA973C76DBDE70CA931CA5E20F22466518123659B352FCFEA581D24D86E1E

SSDEEP:

6144:Unbhs525CpU5sf+QBqr3eR9L8ylatdVUTyIrIRkl3tyxiqrtKLW5HCJ:Qhs52QpCsfJBqr33eat0MuEiqrtKLW5m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • baba no no.exe (PID: 3600)
      • baba no no.exe (PID: 3200)
    • NanoCore was detected

      • baba no no.exe (PID: 3200)
    • Changes the autorun value in the registry

      • baba no no.exe (PID: 3200)
  • SUSPICIOUS

    • Creates files in the program directory

      • baba no no.exe (PID: 3200)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3132)
      • baba no no.exe (PID: 3200)
    • Application launched itself

      • baba no no.exe (PID: 3600)
    • Creates files in the user directory

      • baba no no.exe (PID: 3200)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: baba no no.exe
PackingMethod: Normal
ModifyDate: 2019:05:14 09:38:00
OperatingSystem: Win32
UncompressedSize: 681472
CompressedSize: 390087
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe baba no no.exe #NANOCORE baba no no.exe

Process information

PID
CMD
Path
Indicators
Parent process
3132"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RE_ENQUIRY.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3600"C:\Users\admin\Desktop\baba no no.exe" C:\Users\admin\Desktop\baba no no.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3200"C:\Users\admin\Desktop\baba no no.exe" C:\Users\admin\Desktop\baba no no.exe
baba no no.exe
User:
admin
Integrity Level:
HIGH
Total events
463
Read events
452
Write events
11
Delete events
0

Modification events

(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3132) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RE_ENQUIRY.rar
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3132) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3200) baba no no.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:TCP Monitor
Value:
C:\Program Files\TCP Monitor\tcpmon.exe
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3200baba no no.exeC:\Program Files\TCP Monitor\tcpmon.exeexecutable
MD5:D098F827ADD5F188F3406F05FCAB80BA
SHA256:AA15815B8EC94609603E28FC822EB8449399AEB0774F53740EEEF569108F5A1F
3200baba no no.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:841A7807290EC4D8C20ABD82125EE3B9
SHA256:5E704151935EBA1B9DD82E2A33D9C292D15CAD7534F77EDE291B71857510A485
3132WinRAR.exeC:\Users\admin\Desktop\baba no no.exeexecutable
MD5:D098F827ADD5F188F3406F05FCAB80BA
SHA256:AA15815B8EC94609603E28FC822EB8449399AEB0774F53740EEEF569108F5A1F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
24
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3200
baba no no.exe
41.231.120.139:5770
Tunisia BackBone AS
TN
malicious

DNS requests

No data

Threats

No threats detected
No debug info