analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Img-8999991817-000012111.img

Full analysis: https://app.any.run/tasks/de64caf8-aed9-47dd-b050-02937ea08012
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 06:47:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nanocore
rat
Indicators:
MIME: application/x-iso9660-image
File info: UDF filesystem data (version 1.5) 'DESKTOP'
MD5:

9FE51E17DCB0B9C26ED950320AA4EED2

SHA1:

D47023FF8033AA06FB1CFD4AA1BD5F7472AC16C2

SHA256:

9A433B4A45CA25B5223C2F69AC62BE30C8DDEF252AF25ADCC3B85E50C9BA857B

SSDEEP:

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaorYerffk61YXNZKrp5:gh+ZkldoPK8YaorYMfk/9I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Img-8999991817-000012111.exe (PID: 2300)
      • Img-8999991817-000012111.exe (PID: 2488)

    • Changes the autorun value in the registry

      • Img-8999991817-000012111.exe (PID: 2488)

    • NanoCore was detected

      • RegAsm.exe (PID: 3364)

    • Connects to CnC server

      • RegAsm.exe (PID: 3364)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 388)
      • Img-8999991817-000012111.exe (PID: 2488)

    • Starts CMD.EXE for self-deleting

      • Img-8999991817-000012111.exe (PID: 2488)
      • Img-8999991817-000012111.exe (PID: 2300)

    • Starts CMD.EXE for commands execution

      • Img-8999991817-000012111.exe (PID: 2488)
      • Img-8999991817-000012111.exe (PID: 2300)

    • Creates files in the user directory

      • Img-8999991817-000012111.exe (PID: 2488)
      • RegAsm.exe (PID: 3364)

  • INFO

    • Manual execution by user

      • Img-8999991817-000012111.exe (PID: 2300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

Composite

VolumeSize: 1894 kB

ISO

VolumeModifyDate: 2019:06:10 14:37:12.00+01:00
VolumeCreateDate: 2019:06:10 14:37:12.00+01:00
Software: IMGBURN V2.5.8.0 - THE ULTIMATE IMAGE BURNER!
VolumeSetName: UNDEFINED
RootDirectoryCreateDate: 2019:06:10 14:37:12+01:00
VolumeBlockSize: 2048
VolumeBlockCount: 947
VolumeName: DESKTOP
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start rundll32.exe no specs winrar.exe img-8999991817-000012111.exe img-8999991817-000012111.exe no specs cmd.exe no specs timeout.exe no specs #NANOCORE regasm.exe cmd.exe no specs timeout.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3484"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\Img-8999991817-000012111.img.isoC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
388"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Img-8999991817-000012111.img.iso"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2488"C:\Users\admin\AppData\Local\Temp\Rar$EXa388.6008\Img-8999991817-000012111.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa388.6008\Img-8999991817-000012111.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2300"C:\Users\admin\Desktop\Img-8999991817-000012111.img\Img-8999991817-000012111.exe" C:\Users\admin\Desktop\Img-8999991817-000012111.img\Img-8999991817-000012111.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4080"C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\admin\AppData\Local\Temp\Rar$EXa388.6008\Img-8999991817-000012111.exe"C:\Windows\System32\cmd.exe—Img-8999991817-000012111.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2600TimeOut 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3364"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Img-8999991817-000012111.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.6.1055.0 built by: NETFXREL2
2776"C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\admin\Desktop\Img-8999991817-000012111.img\Img-8999991817-000012111.exe"C:\Windows\System32\cmd.exe—Img-8999991817-000012111.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1496TimeOut 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2468"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—Img-8999991817-000012111.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
797
Read events
695
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
3
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3364RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:682D07460F19A72B81EDB9D9DFE18A8E
SHA256:2A30A542CE79B883C9A747AE3D48AD07DA8FDC9FEF6D47620F9208CA1E8B8AFF
388WinRAR.exeC:\Users\admin\Desktop\Img-8999991817-000012111.img\Img-8999991817-000012111.exeexecutable
MD5:3A5F01F5C83FEF855DEAEC744EC595B2
SHA256:F50F40288CAECB33486932629124EA0DFB5511005754984FEBF7FC3AFA32BEC1
388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa388.6008\Img-8999991817-000012111.exeexecutable
MD5:3A5F01F5C83FEF855DEAEC744EC595B2
SHA256:F50F40288CAECB33486932629124EA0DFB5511005754984FEBF7FC3AFA32BEC1
2488Img-8999991817-000012111.exeC:\Users\admin\AppData\Roaming\dfgfgrer\dfdff.exeexecutable
MD5:12D6D70044D2ED4C5ADA63AE5730676D
SHA256:A6287799D4804B45BC17893DD805C3E3250D6AEBCE4667291750E437F843E2BE
3364RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
3364RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:7E8F4A764B981D5B82D1CC49D341E9C6
SHA256:0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
3364RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3364
RegAsm.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted
3364
RegAsm.exe
81.92.202.146:54984
avt.duckdns.org
Venus Business Communications Limited
GB
malicious

DNS requests

Domain
IP
Reputation
avt.duckdns.org
  • 81.92.202.146
malicious

Threats

PID
Process
Class
Message
3364
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3364
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3364
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3364
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3364
RegAsm.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3364
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3364
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3364
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Img-8999991817-000012111.img