analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

b84f19c1345d696ae9d920b0365bba38.zip

Full analysis: https://app.any.run/tasks/0c7f1bd0-7eca-4aa1-9501-d204aa4f716b
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 06:36:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
rat
nanocore
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1CCB1F750A64715A7C862A62288BBF3F

SHA1:

86359809C18EEC1388E68F520E190264422B8C8E

SHA256:

931BAA6746442C5AB644191084C5AA3A8449780CF3D1213DCAA8108380F8986B

SSDEEP:

24576:iJLn+cayL23J54N4AHneJvxA21bFD8qc6GxN1Ex:4Lbayi3J62AHwS21bpJc6Uq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Swift Copy.scr (PID: 4072)
      • RegSvcs.exe (PID: 3928)
      • jrg.exe (PID: 3416)
      • jrg.exe (PID: 3100)

    • Changes the autorun value in the registry

      • jrg.exe (PID: 3416)

    • NanoCore was detected

      • RegSvcs.exe (PID: 3928)

    • Connects to CnC server

      • RegSvcs.exe (PID: 3928)

  • SUSPICIOUS

    • Drop AutoIt3 executable file

      • Swift Copy.scr (PID: 4072)

    • Executable content was dropped or overwritten

      • Swift Copy.scr (PID: 4072)
      • WinRAR.exe (PID: 1388)
      • jrg.exe (PID: 3416)

    • Starts application with an unusual extension

      • WinRAR.exe (PID: 1388)

    • Creates files in the user directory

      • RegSvcs.exe (PID: 3928)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • jrg.exe (PID: 3100)
      • Swift Copy.scr (PID: 4072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: b84f19c1345d696ae9d920b0365bba38
ZipUncompressedSize: 873207
ZipCompressedSize: 873354
ZipCRC: 0x3443a9a4
ZipModifyDate: 2019:04:25 09:36:19
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs winrar.exe swift copy.scr jrg.exe no specs jrg.exe #NANOCORE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
3864"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\b84f19c1345d696ae9d920b0365bba38.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1388"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\b84f19c1345d696ae9d920b0365bba38.xz"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
4072"C:\Users\admin\AppData\Local\Temp\Rar$DIa1388.26530\Swift Copy.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa1388.26530\Swift Copy.scr
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3100"C:\Users\admin\AppData\Local\Temp\08610125\jrg.exe" cnq=ifv C:\Users\admin\AppData\Local\Temp\08610125\jrg.exe—Swift Copy.scr
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
3416C:\Users\admin\AppData\Local\Temp\08610125\jrg.exe C:\Users\admin\AppData\Local\Temp\08610125\QSHPZC:\Users\admin\AppData\Local\Temp\08610125\jrg.exe
jrg.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
3928"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe
jrg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
1 252
Read events
1 222
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
46
Unknown types
1

Dropped files

PID
Process
Filename
Type
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3864.24218\b84f19c1345d696ae9d920b0365bba38 —
MD5:—
SHA256:—
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\cnq=ifvtext
MD5:66619B8A7D543545B06FDCA36231D162
SHA256:CF60524DC1EC7253695C093B61A8522F67394A934066A6A3ED9F859A5E6901F2
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\rbr.docxtext
MD5:5706E4A9BAEF20D377CBA0CCCBBEF4C2
SHA256:E767B9A84B7302D01700A3143D7AF6CA995478EDF9BC5FB287A2C13B2C1BD278
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\mxe.bmptext
MD5:4F07E4A6354CD898134B2004BA1A6AC9
SHA256:FA2B79C55566A8BB55C7EDA8E43C812E2904885987B5475FAF4DF79AFADB28C1
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\vmg.mp4text
MD5:EBCE28992069A80F80B5E5D262497CAD
SHA256:302CFD80A499EF52B67033E5B156449CBE6F7EBBF89D1DC5C51A8C97A06007A2
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\qxa.bmptext
MD5:C5D8ECFEAD06B99B6FD1FE63B0A99CD3
SHA256:0B232D30DE0BC1BD387BBC7D70D15F89E8611F42BF1F364AD0725CCECC802683
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\nme.txttext
MD5:76524D73E35DFBA944C15D92A6F65BCB
SHA256:F314E66A1850C7512FC7F3D871F886F5850595B630120A39BAC585D16F8628E0
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\oev.dattext
MD5:32BC9E8C00533DD70DA25FA7A6CA5217
SHA256:A4100614633C13B8D597984BBD8B152AF140F348395E0841ADBFEA6907CFA68D
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\UpDownConstants.dattext
MD5:270125880FBC9A41931532D27B84CEBF
SHA256:BDED5569AA8DB033D63E4A204BC8104884F4806915F494F04192401133B61F78
4072Swift Copy.scrC:\Users\admin\AppData\Local\Temp\08610125\rog.ppttext
MD5:61B6FB28A55207364C77CEACA658E228
SHA256:E81066445D27299B53BA1756142807126E44531AB67EB66688E37686B0E9B692
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3928
RegSvcs.exe
31.171.152.106:1978
ncores.hopto.org
Keminet Ltd.
AL
malicious
3928
RegSvcs.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
ncores.hopto.org
  • 31.171.152.106
malicious

Threats

PID
Process
Class
Message
3928
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3928
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
62 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b84f19c1345d696ae9d920b0365bba38.zip