analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.dropbox.com/s/eyqro4dne3t58oa/Scan111418-56.z?dl=1

Full analysis: https://app.any.run/tasks/6fed2982-ea6e-4e9d-8ada-171cd1276a50
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 08:58:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
autoit
Indicators:
MD5:

2F8A3287D4411EAE2556DCADC071268B

SHA1:

1D208C27F8FD97388385BD1BE4CC6E8599B020B8

SHA256:

BBF778B3668FF9CC46D9AAFD3C3C48A9EF806E7770DE63B0BB2BFDD4606BC66D

SSDEEP:

3:N8DSLcVHGkpa0WQvGiNkQTraB:2OLHkpa0WNiLrA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ewc.exe (PID: 1216)
      • Scan111418-56.scr (PID: 1488)
      • ewc.exe (PID: 328)
      • RegSvcs.exe (PID: 2172)

    • Changes the autorun value in the registry

      • RegSvcs.exe (PID: 2172)

    • NanoCore was detected

      • RegSvcs.exe (PID: 2172)

    • Connects to CnC server

      • RegSvcs.exe (PID: 2172)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3032)
      • Scan111418-56.scr (PID: 1488)
      • RegSvcs.exe (PID: 2172)

    • Drop AutoIt3 executable file

      • Scan111418-56.scr (PID: 1488)

    • Application launched itself

      • ewc.exe (PID: 1216)

    • Starts application with an unusual extension

      • WinRAR.exe (PID: 3032)

    • Connects to unusual port

      • RegSvcs.exe (PID: 2172)

    • Creates files in the user directory

      • RegSvcs.exe (PID: 2172)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 3856)

    • Changes internet zones settings

      • iexplore.exe (PID: 3144)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3856)
      • iexplore.exe (PID: 3144)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3144)

    • Dropped object may contain Bitcoin addresses

      • ewc.exe (PID: 1216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
7
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe winrar.exe scan111418-56.scr ewc.exe no specs ewc.exe no specs #NANOCORE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
3144"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3856"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3144 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3032"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Scan111418-56[1].z"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1488"C:\Users\admin\AppData\Local\Temp\Rar$DIa3032.34133\Scan111418-56.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa3032.34133\Scan111418-56.scr
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1216"C:\Users\admin\AppData\Local\Temp\13570161\ewc.exe" ccu=tbs C:\Users\admin\AppData\Local\Temp\13570161\ewc.exe—Scan111418-56.scr
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
328C:\Users\admin\AppData\Local\Temp\13570161\ewc.exe C:\Users\admin\AppData\Local\Temp\13570161\QIXZKC:\Users\admin\AppData\Local\Temp\13570161\ewc.exe—ewc.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
2172"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
ewc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
1 479
Read events
1 398
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
6
Text files
51
Unknown types
3

Dropped files

PID
Process
Filename
Type
3144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3144iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3856iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@dropbox[1].txt —
MD5:—
SHA256:—
3856iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt —
MD5:—
SHA256:—
3144iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF750E9988DAB0F41A.TMP —
MD5:—
SHA256:—
3144iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF108D20D40EE03274.TMP —
MD5:—
SHA256:—
3144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9CECC4C3-E8B4-11E8-BFAB-5254004AAD11}.dat —
MD5:—
SHA256:—
3144iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018111520181116\index.datdat
MD5:860C3BD0ED256C8AEF551D84028443C9
SHA256:EAFB560A2DFFC5DE8890E55472A5B34DAF57B27A1C547A62361F78313E53D8A3
3856iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txttext
MD5:F1C277A205B2BD76A4349E9B0E93B734
SHA256:D94056649E14F3AC1D80B353B028A2AF9A4AE7ABEA7A01C29E8D7A245F335410
1488Scan111418-56.scrC:\Users\admin\AppData\Local\Temp\13570161\ccu=tbstext
MD5:93F07D959E2960DA5BF6E506EF218759
SHA256:41971D360CB54DB1E575A7BE95A47AC74A50FF999618446C59B255B903DA5F1F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3144
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3856
iexplore.exe
162.125.66.1:443
www.dropbox.com
Dropbox, Inc.
DE
shared
3144
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3856
iexplore.exe
162.125.66.6:443
uc65fcb5119360800233398c18eb.dl.dropboxusercontent.com
Dropbox, Inc.
DE
shared
2172
RegSvcs.exe
77.48.28.206:7000
—
Liberty Global Operations B.V.
CZ
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.dropbox.com
  • 162.125.66.1
shared
uc65fcb5119360800233398c18eb.dl.dropboxusercontent.com
  • 162.125.66.6
malicious

Threats

PID
Process
Class
Message
2172
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
2172
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2172
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2172
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
2172
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 64B
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.dropbox.com/s/eyqro4dne3t58oa/Scan111418-56.z?dl=1