| File name: | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466 |
| Full analysis: | https://app.any.run/tasks/e8660ff0-ce9e-44c6-bda2-1f8079116b75 |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | October 31, 2022, 08:07:37 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 5C4D20B4A621D7B81F273B94DF51E5DA |
| SHA1: | F7854F2F054DB782670B104DEBD0251BF3F270E3 |
| SHA256: | 8C4EE640E89E6A663BB0D8B2377D8A8DF1C57A58C6218E3C732FCBBB2A09F24B |
| SSDEEP: | 12288:rKt+AgHtDg5xE1uDMRLf5w62Ir6Oxwjc42pkJDq0QK8Qgv24xrNYVorLb355w3zt:D4/D+LfO6xxwp5Qmgv2IoorX3g39 |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 2022-Oct-31 01:30:02 |
| Debug artifacts: |
|
| Comments: | - |
| CompanyName: | Polar Semiconductor |
| FileDescription: | Student Data |
| FileVersion: | 1.0.0.0 |
| InternalName: | bW60VEp.exe |
| LegalCopyright: | Copyright © Polar Semiconductor 2011 |
| LegalTrademarks: | - |
| OriginalFilename: | bW60VEp.exe |
| ProductName: | Student Data |
| ProductVersion: | 1.0.0.0 |
| Assembly Version: | 1.0.0.0 |
| e_magic: | MZ |
|---|---|
| e_cblp: | 144 |
| e_cp: | 3 |
| e_crlc: | - |
| e_cparhdr: | 4 |
| e_minalloc: | - |
| e_maxalloc: | 65535 |
| e_ss: | - |
| e_sp: | 184 |
| e_csum: | - |
| e_ip: | - |
| e_cs: | - |
| e_ovno: | - |
| e_oemid: | - |
| e_oeminfo: | - |
| e_lfanew: | 128 |
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| NumberofSections: | 3 |
| TimeDateStamp: | 2022-Oct-31 01:30:02 |
| PointerToSymbolTable: | - |
| NumberOfSymbols: | - |
| SizeOfOptionalHeader: | 224 |
| Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 8192 | 832116 | 832512 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.56125 |
.rsrc | 843776 | 1532 | 1536 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.21862 |
.reloc | 851968 | 12 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.0980042 |
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 3.31752 | 880 | UNKNOWN | UNKNOWN | RT_VERSION |
1 (#2) | 5.00112 | 490 | UNKNOWN | UNKNOWN | RT_MANIFEST |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2300 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WCqNyePxXt" /XML "C:\Users\admin\AppData\Local\Temp\tmpFBB6.tmp" | C:\Windows\System32\schtasks.exe | — | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2488 | "{path}" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | ||||||||||||
User: admin Company: Polar Semiconductor Integrity Level: MEDIUM Description: Student Data Exit code: 0 Version: 1.0.0.0 Modules
Nanocore(PID) Process(2488) SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe KeyboardLoggingTrue BuildTime2022-10-19 14:11:43.223312 Version1.2.2.0 Mutex08765466-ad1b-454f-af1f-45839cebf1d5 DefaultGroupDefault PrimaryConnectionHostderanano.ddns.net BackupConnectionHost80.76.51.109 ConnectionPort1010 RunOnStartupTrue RequestElevationFalse BypassUserAccountControlTrue ClearZoneIdentifierTrue ClearAccessControlFalse SetCriticalProcessFalse PreventSystemSleepTrue ActivateAwayModeFalse EnableDebugModeFalse RunDelay0 ConnectDelay4000 RestartDelay5000 TimeoutInterval5000 KeepAliveTimeout30000 MutexTimeout5000 LanTimeout2500 WanTimeout8000 BufferSize65535 MaxPacketSize10485760 GCThreshold10485760 UseCustomDnsServerTrue PrimaryDnsServer8.8.8.8 BackupDnsServer8.8.4.4 | |||||||||||||||
| 3280 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Explorer.EXE | ||||||||||||
User: admin Company: Polar Semiconductor Integrity Level: MEDIUM Description: Student Data Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| (PID) Process: | (3280) SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3280) SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3280) SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3280) SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2488) SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | TCP Monitor |
Value: C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3280 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Local\Temp\tmpFBB6.tmp | xml | |
MD5:— | SHA256:— | |||
| 2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | binary | |
MD5:— | SHA256:— | |||
| 2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exe | executable | |
MD5:— | SHA256:— | |||
| 3280 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Roaming\WCqNyePxXt.exe | executable | |
MD5:— | SHA256:— | |||
| 2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.dat | binary | |
MD5:— | SHA256:— | |||
| 2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bin | binary | |
MD5:4E5E92E2369688041CC82EF9650EDED2 | SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48 | |||
| 2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.dat | bs | |
MD5:32D0AAE13696FF7F8AF33B2D22451028 | SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29 | |||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | 80.76.51.109:1010 | deranano.ddns.net | Delis LLC | US | malicious |
Domain | IP | Reputation |
|---|---|---|
deranano.ddns.net |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
2488 | SecuriteInfo.com.Win32.CrypterX-gen.7127.29466.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |