analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

TICKET%2083992883992AIR8389494VERVED37783PDF.7z

Full analysis: https://app.any.run/tasks/fda3143b-cf95-44ee-93d2-40dbec14b0a6
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 01:25:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7DEBDC1CB4B638EE8604C18926853C82

SHA1:

0A34977E447551DA93ECAFB56CF36161C49ABDE2

SHA256:

94431A01FE024B4F4F1EA3ED43A5639E955A96C93362587DBBF7BA36CCB91A5E

SSDEEP:

6144:CeZp1FLLl3Ry+KlMPD2R0sTWeCKp5mQC23C7GD698DUkstC9QwW39geKs:f15RlyoO0lVKp5/76sj39yz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2268)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 3632)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 584)

    • Uses Task Scheduler to run other applications

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3488)
      • schtasks.exe (PID: 2764)
      • schtasks.exe (PID: 1156)
      • schtasks.exe (PID: 2464)

    • NanoCore was detected

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 1660)

    • Changes the autorun value in the registry

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Connects to CnC server

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3392)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Creates files in the user directory

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Application launched itself

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)

    • Executes scripts

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2552)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 2324)

  • INFO

    • Manual execution by user

      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1380)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1076)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 2088)
      • TICKET 83992883992AIR8389494VERVED37783PDF.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
15
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe ticket 83992883992air8389494verved37783pdf.exe ticket 83992883992air8389494verved37783pdf.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs ticket 83992883992air8389494verved37783pdf.exe schtasks.exe no specs #NANOCORE ticket 83992883992air8389494verved37783pdf.exe vbc.exe vbc.exe no specs schtasks.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs schtasks.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs schtasks.exe no specs ticket 83992883992air8389494verved37783pdf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3392"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\d2df2d27-d7a5-434d-890b-2b17a6764520.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2088"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
1380"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
1076"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
1812"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe" C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
WCF Discovery Client
Exit code:
0
Version:
1.4.4.0
3488"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EzvLxlvnUHcS" /XML "C:\Users\admin\AppData\Local\Temp\tmp2DF9.tmp"C:\Windows\System32\schtasks.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2552"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe"C:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exe
TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WCF Discovery Client
Version:
1.4.4.0
1660"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\osp0rviw.flj"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
2324"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\admin\AppData\Local\Temp\zhjdtomb.a13"c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
1156"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EzvLxlvnUHcS" /XML "C:\Users\admin\AppData\Local\Temp\tmpABD3.tmp"C:\Windows\System32\schtasks.exe—TICKET 83992883992AIR8389494VERVED37783PDF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
762
Read events
724
Write events
38
Delete events
0

Modification events

(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3392) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\d2df2d27-d7a5-434d-890b-2b17a6764520.rar
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(3392) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
3
Suspicious files
4
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
2552TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bak —
MD5:—
SHA256:—
1660vbc.exeC:\Users\admin\AppData\Local\Temp\osp0rviw.flj —
MD5:—
SHA256:—
2324vbc.exeC:\Users\admin\AppData\Local\Temp\zhjdtomb.a13 —
MD5:—
SHA256:—
1812TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmpDF67.tmp —
MD5:—
SHA256:—
2088TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmp2DF9.tmpxml
MD5:5B86F53490178601BEFC2792A818C6E7
SHA256:F6384C7AE2BA63652A4019C1CE8491F46FDCD31A09ED8D2C83E77D40346CF2AB
2552TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:7604AE3870D22FC85AEF3154D26FE0EE
SHA256:683B6926D9937396014838AD5D64D41B561F4FDE6E6EF35B35231E96061EDA39
1380TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmpABD3.tmpxml
MD5:5B86F53490178601BEFC2792A818C6E7
SHA256:F6384C7AE2BA63652A4019C1CE8491F46FDCD31A09ED8D2C83E77D40346CF2AB
3392WinRAR.exeC:\Users\admin\Desktop\TICKET 83992883992AIR8389494VERVED37783PDF.exeexecutable
MD5:7604AE3870D22FC85AEF3154D26FE0EE
SHA256:683B6926D9937396014838AD5D64D41B561F4FDE6E6EF35B35231E96061EDA39
2088TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Roaming\EzvLxlvnUHcS.exeexecutable
MD5:7604AE3870D22FC85AEF3154D26FE0EE
SHA256:683B6926D9937396014838AD5D64D41B561F4FDE6E6EF35B35231E96061EDA39
1076TICKET 83992883992AIR8389494VERVED37783PDF.exeC:\Users\admin\AppData\Local\Temp\tmpC353.tmpxml
MD5:5B86F53490178601BEFC2792A818C6E7
SHA256:F6384C7AE2BA63652A4019C1CE8491F46FDCD31A09ED8D2C83E77D40346CF2AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
178.239.21.116:1186
—
Telekomunikacije Republike Srpske akcionarsko drustvo Banja Luka
BA
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2552
TICKET 83992883992AIR8389494VERVED37783PDF.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
25 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
TICKET%2083992883992AIR8389494VERVED37783PDF.7z