analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

6.zip

Full analysis: https://app.any.run/tasks/b0ccd103-9737-434b-90f5-af34a69c97b3
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: January 18, 2019, 08:47:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

2F048704A120CAB340B657E6D00B87FC

SHA1:

9F43C1EB613777529AF55068C556C57D916C422F

SHA256:

C5BCB0C9D611A0849599413629E90F8F68C991C8E7F93F7B912873234B111306

SSDEEP:

98304:EGI5IIwb7bFc1COZ7CSKor+AhTPBeuKGIAI:Ep5/wbC0OrNrBgpd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Steam Account Checker - FLM.exe (PID: 2400)
      • Host Process for Windows Tasks.exe (PID: 3064)
      • Host Process for Windows Tasks.exe (PID: 4008)
      • Regasm.exe (PID: 2760)
      • Host Process for Windows Tasks.exe (PID: 1088)
      • Regasm.exe (PID: 3340)
      • Host Process for Windows Tasks.exe (PID: 3564)
      • Regasm.exe (PID: 2424)
      • Regasm.exe (PID: 1724)

    • Uses Task Scheduler to run other applications

      • Steam Account Checker - FLM.exe (PID: 2400)

    • NanoCore was detected

      • Regasm.exe (PID: 2760)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3660)
      • mmc.exe (PID: 2156)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 416)

    • Changes the autorun value in the registry

      • Regasm.exe (PID: 2760)

  • SUSPICIOUS

    • Creates files in the user directory

      • Steam Account Checker - FLM.exe (PID: 2400)
      • Regasm.exe (PID: 2760)

    • Executable content was dropped or overwritten

      • Steam Account Checker - FLM.exe (PID: 2400)
      • WinRAR.exe (PID: 3036)
      • Regasm.exe (PID: 2760)

    • Starts itself from another location

      • Steam Account Checker - FLM.exe (PID: 2400)

    • Connects to unusual port

      • Regasm.exe (PID: 2760)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: None
ZipModifyDate: 2019:01:18 03:27:11
ZipCRC: 0x393c6741
ZipCompressedSize: 3241984
ZipUncompressedSize: 3241984
ZipFileName: Steam Account Checker/HazardEdit.Tools.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
14
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe steam account checker - flm.exe schtasks.exe no specs host process for windows tasks.exe no specs #NANOCORE regasm.exe searchprotocolhost.exe no specs host process for windows tasks.exe no specs regasm.exe no specs host process for windows tasks.exe no specs regasm.exe no specs host process for windows tasks.exe no specs regasm.exe no specs mmc.exe no specs mmc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3036"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\6.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2400"C:\Users\admin\Desktop\Steam Account Checker\Steam Account Checker - FLM.exe" C:\Users\admin\Desktop\Steam Account Checker\Steam Account Checker - FLM.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3660schtasks /create /f /sc minute /mo 1 /tn "'Steam Account Checker - FLM'" /tr "'C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe'"C:\Windows\system32\schtasks.exe—Steam Account Checker - FLM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3064"C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe" C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe—Steam Account Checker - FLM.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2760"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe
Host Process for Windows Tasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.6.1055.0 built by: NETFXREL2
416"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
1088"C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe" C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe—taskeng.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3340"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe—Host Process for Windows Tasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
4008"C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe" C:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exe—taskeng.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
1724"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regasm.exe—Host Process for Windows Tasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Total events
1 228
Read events
1 211
Write events
17
Delete events
0

Modification events

(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3036) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\6.zip
(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3036) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(416) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(416) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
11
Suspicious files
2
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\ElasticEmail.WebApiClient.dllexecutable
MD5:E36F206E384B7EE506FC8A3AA7AC0BB9
SHA256:D63E591117BB5B241CB30DE9D7AA4EF606E9A1128A8F6D58BD3F58FFB36242CF
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\HazardEdit.Tools.dllexecutable
MD5:C42AFB10D2659AD23CDE33539CEEF88C
SHA256:EB9337F0ECD9F85F521FE9060A4FF306804138F5C31FE329B45C4BD7E2D6342C
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\Cyotek.Windows.Forms.ColorPicker.dllexecutable
MD5:07A187F8941315DF7D1327532C8CE506
SHA256:83679BABD6D4640756B63F4E65668E82608BBC07F7669A469E524A279C2D5853
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\Steam Account Checker - FLM.exeexecutable
MD5:5AF0571C2D1AB1BD9C516DF4A4630746
SHA256:3F3CC0FF6A4092BE67F5F0EA378976C128A7846B64EC25D3F5CAAC2C75B8142D
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\Results\Results From January 12, 2019 @ 07.08\Bad Checked By TCM's Skin Checker.txttext
MD5:B01D30E18A75E5802F9F8210B48B032D
SHA256:8EAC4624E3BBF060A602DAB36D83DCC1817DD75D9E7029C08DAD94D4CEFC58B4
2400Steam Account Checker - FLM.exeC:\Users\admin\AppData\Roaming\Host Process for Windows Tasks.exeexecutable
MD5:5AF0571C2D1AB1BD9C516DF4A4630746
SHA256:3F3CC0FF6A4092BE67F5F0EA378976C128A7846B64EC25D3F5CAAC2C75B8142D
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\GeoIP.datbinary
MD5:1F897B5825CF91799831862620911AFF
SHA256:5F85518CF71E7B53544E0BD0C1874D1F89A0D6DE7A6AD50683517575AAA56301
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\MailKit.dllexecutable
MD5:BE99F9896236C6106887959541D22F05
SHA256:786E2126D22AFABCB42D57CF07760690C18C21007C93ABAED0CB4C7FE2044EB6
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\Bunifu_UI_v1.5.3.dllexecutable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
3036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3036.28298\Steam Account Checker\NotificationSound\beep.wavwav
MD5:248DDC4190B35F7DAE7F2C851F7F0E2C
SHA256:8A57FAA5E59D2DD499F103E8188217FFB13331E153DC2A726B5247001336C0D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
24
DNS requests
12
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2760
Regasm.exe
82.10.185.160:1085
piglion.ddns.net
Virgin Media Limited
GB
suspicious
2760
Regasm.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
piglion.ddns.net
  • 82.10.185.160
malicious

Threats

PID
Process
Class
Message
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Generic dynamic DNS detection
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Generic dynamic DNS detection
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Generic dynamic DNS detection
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Generic dynamic DNS detection
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Query to a Suspicious *.ddns.net Domain
2760
Regasm.exe
A Network Trojan was detected
SC BAD_UNKNOWN Generic dynamic DNS detection
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
6.zip