analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

ORDER009,pdf.z

Full analysis: https://app.any.run/tasks/28656908-b4ae-444f-bb16-8185e73de68f
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: November 14, 2018, 09:58:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
nanocore
rat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

2850475C06050A7B55D97E462F61C5E9

SHA1:

A012477E4EFADDAD5529832A17E170C7CCBA350C

SHA256:

A68933BC56154D1CAB5455095EF9E9000AFD7F2B114D3B04D1BE09E8ED04679C

SSDEEP:

6144:iQBxBRNTabW7SljcIMH11p0WOBM/q8nGEEMIYVdSZwZlhFnmJZMA6zU6z:3x0bTlwH/qnEEMIYVcqJrz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ORDER009.exe (PID: 3068)
      • ORDER009.exe (PID: 3336)
    • Changes the autorun value in the registry

      • ORDER009.exe (PID: 3336)
    • NanoCore was detected

      • ORDER009.exe (PID: 3336)
    • Connects to CnC server

      • ORDER009.exe (PID: 3336)
  • SUSPICIOUS

    • Connects to unusual port

      • ORDER009.exe (PID: 3336)
    • Creates files in the user directory

      • ORDER009.exe (PID: 3336)
    • Application launched itself

      • ORDER009.exe (PID: 3068)
    • Executable content was dropped or overwritten

      • ORDER009.exe (PID: 3336)
      • WinRAR.exe (PID: 1364)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: ORDER009.exe
PackingMethod: Normal
ModifyDate: 2013:09:16 19:00:07
OperatingSystem: Win32
UncompressedSize: 526528
CompressedSize: 343852
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe order009.exe no specs #NANOCORE order009.exe

Process information

PID
CMD
Path
Indicators
Parent process
1364"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ORDER009,pdf.z.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3068"C:\Users\admin\Desktop\ORDER009.exe" C:\Users\admin\Desktop\ORDER009.exeexplorer.exe
User:
admin
Company:
SLAM0
Integrity Level:
MEDIUM
Description:
ramulose
Exit code:
0
Version:
4.05
3336C:\Users\admin\Desktop\ORDER009.exe" C:\Users\admin\Desktop\ORDER009.exe
ORDER009.exe
User:
admin
Company:
SLAM0
Integrity Level:
MEDIUM
Description:
ramulose
Version:
4.05
Total events
331
Read events
311
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3336ORDER009.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:58CA14A095D3096FD6A6C58380F03A8D
SHA256:5482E766E8DFE625B26E92DA5038A3B52A38259921A551A9634DA91EF038D9FF
1364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1364.8682\ORDER009.exeexecutable
MD5:F768C7174323085100248B444A083EC8
SHA256:1730D584634D34B827AF23831F53D71309B5BC53F207E960565A01A8852CCE6B
3068ORDER009.exeC:\Users\admin\AppData\Local\Temp\~DF58EDF3ECAFC92F74.TMPbinary
MD5:6D1637DAB2540039132257CB4255175D
SHA256:B0739A79236F9E3E3E0E098C3BE61814E7CDDE0FFA4A4A8FD016E8AC8C556A24
3336ORDER009.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:F768C7174323085100248B444A083EC8
SHA256:1730D584634D34B827AF23831F53D71309B5BC53F207E960565A01A8852CCE6B
3336ORDER009.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:32D0AAE13696FF7F8AF33B2D22451028
SHA256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3336
ORDER009.exe
181.215.247.70:7000
IP-Connect LLC
UA
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
3336
ORDER009.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 15
3336
ORDER009.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
3336
ORDER009.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
5 ETPRO signatures available at the full report
No debug info