| File name: | NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar |
| Full analysis: | https://app.any.run/tasks/34f04d1a-3d08-4b98-bcfc-cc79599ea84f |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | November 20, 2023, 13:45:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | C75744769BAE7A3E7A4A1AEC27673851 |
| SHA1: | 56B0AA88B44C532BE4975BC096CB8E4B9E7ECB49 |
| SHA256: | CEB348DFA61B34BEBCE021FA783B0AFDB874EA7205F75E7FB42B01898439BE75 |
| SSDEEP: | 98304:5S+zg4KC/4ObL3j/ZV2tKRcHhMBJcPpylijvjTZi1UBCFCX/IxCF+/h0k98nRDdj:51kC/40z3tKMrcByIT1B2zkA/Ck92thv |
MALICIOUS
Drops the executable file immediately after the start
- NanoCore.exe (PID: 3228)
- NanoCore.exe (PID: 2780)
NANOCORE has been detected (YARA)
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 2780)
Uses Task Scheduler to run other applications
- hj.exe (PID: 3944)
Starts CMD.EXE for self-deleting
- hj.exe (PID: 3944)
SUSPICIOUS
Reads the Internet Settings
- NanoCore.exe (PID: 3228)
- NanoCore.exe (PID: 2780)
Starts CMD.EXE for commands execution
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 3228)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 1508)
INFO
Checks supported languages
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 2260)
- NanoCore.exe (PID: 2780)
- dg.exe (PID: 2760)
- dg.exe (PID: 604)
Manual execution by a user
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 2780)
- notepad.exe (PID: 3616)
- dg.exe (PID: 2760)
- dg.exe (PID: 604)
Drops the executable file immediately after the start
- WinRAR.exe (PID: 3428)
Reads the computer name
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 2260)
- NanoCore.exe (PID: 2780)
- dg.exe (PID: 604)
- dg.exe (PID: 2760)
Reads the machine GUID from the registry
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 2260)
- NanoCore.exe (PID: 2780)
- dg.exe (PID: 2760)
- dg.exe (PID: 604)
Creates files or folders in the user directory
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- dg.exe (PID: 2760)
Reads Environment values
- NanoCore.exe (PID: 3228)
- hj.exe (PID: 3944)
- NanoCore.exe (PID: 2260)
- NanoCore.exe (PID: 2780)
Create files in a temporary directory
- NanoCore.exe (PID: 3228)
- NanoCore.exe (PID: 2780)
Process checks are UAC notifies on
- hj.exe (PID: 3944)
- dg.exe (PID: 2760)
- dg.exe (PID: 604)
Reads product name
- hj.exe (PID: 3944)
Checks proxy server information
- NanoCore.exe (PID: 3228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Nanocore
(PID) Process(3228) NanoCore.exe
ERROR
(PID) Process(3944) hj.exe
BuildTime2023-11-20 13:46:09.394752
Version1.2.2.0
Mutex19be7cb9-fe4b-43e4-81fe-4d463a80c695
DefaultGroupDefault
PrimaryConnectionHost127.0.0.1
BackupConnectionHost127.0.0.1
ConnectionPort6666
RunOnStartupFalse
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
(PID) Process(2780) NanoCore.exe
ERROR
TRiD
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
EXIF
ZIP
| CompressedSize: | 3066 |
|---|---|
| UncompressedSize: | 22746 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2016:06:05 21:53:56 |
| PackingMethod: | Best Compression |
| ArchivedFileName: | NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log |
Total processes
63
Monitored processes
15
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 604 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\dg.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\dg.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
| 1208 | taskkill /f /im "hj.exe" | C:\Windows\System32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1508 | "cmd.exe" /C taskkill /f /im "hj.exe" & ping -n 1 -w 3000 1.1.1.1 & type nul > "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\hj.exe" & del /f /q "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\hj.exe" | C:\Windows\System32\cmd.exe | — | hj.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1600 | "schtasks.exe" /delete /f /tn "TCP Monitor Task" | C:\Windows\System32\schtasks.exe | — | hj.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1628 | "schtasks.exe" /delete /f /tn "TCP Monitor" | C:\Windows\System32\schtasks.exe | — | hj.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2260 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: NanoCore Exit code: 0 Version: 1.2.2.0 Modules
| |||||||||||||||
| 2312 | "C:\Windows\System32\cmd.exe" /C ping -n 1 -w 4000 1.1.1.1 & "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Windows\System32\cmd.exe | — | NanoCore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2444 | ping -n 1 -w 4000 1.1.1.1 | C:\Windows\System32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2760 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\dg.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\dg.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
| 2780 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: NanoCore Exit code: 0 Version: 1.2.2.0 Modules
Nanocore(PID) Process(2780) NanoCore.exe ERROR | |||||||||||||||
Total events
10 881
Read events
10 788
Write events
85
Delete events
8
Modification events
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3428) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3228) NanoCore.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | NodeSlots |
Value: 0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202 | |||
| (PID) Process: | (3228) NanoCore.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | MRUListEx |
Value: 0E00000001000000020000000700000000000000060000000C0000000B0000000D0000000A0000000900000008000000030000000500000004000000FFFFFFFF | |||
Executable files
14
Suspicious files
60
Text files
347
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.xml | xml | |
MD5:5D0381A56563B1CA8928E3CF087F1625 | SHA256:0497B92461C2A9CE3101D9397FB3079F60979164336A16653D282273D3085BCC | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dll | executable | |
MD5:BDC8945F1D799C845408522E372D1DBD | SHA256:61E9D5C0727665E9EF3F328141397BE47C65ED11AB621C644B5BBF1D67138403 | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite | binary | |
MD5:EA522FC387E8E1C1C65E946C9118E2C7 | SHA256:AE429DBFCA9416CFC6832AED1190FA7B9EB90127328136A249DE024349FD3B3B | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\core.sqlite | binary | |
MD5:3732DF3263FBAA868BB866BCCA1F402C | SHA256:716D9992711B5B17ECA841836BA5A63DB0A62251BD056A92DB96DECCFA887B41 | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\geolocation.sqlite | binary | |
MD5:0E8D861CDDEDE3A0B2B02CFC0B060B99 | SHA256:11BD851D8994D3CA9D078144679AA2DC06841ADDD0947B8FA8AD36758BDECF7A | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\client.bin | executable | |
MD5:906A949E34472F99BA683EFF21907231 | SHA256:9D3EA5AF7DC261BF93C76F55D702A315AA22FB241E4207DC86CD834C262245C8 | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBlack.ncp | binary | |
MD5:794AB16C092EBF2B1D812D6CCE158537 | SHA256:7919B7998D6B359D7CB700018DC2D69FF6FFB45BD01C9C190B98FB4C9FF4BEAB | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MultiCore.ncp | binary | |
MD5:BECB82E1E914E906BE158E3F9DD658AC | SHA256:5494ADF651FC64E3AA6C08E38165D8DBFEC52056CDF4FADAE90B76B0E6816A33 | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MiscTools.ncp | binary | |
MD5:78E3006FC6468EB7DFC7761072B84AC6 | SHA256:3A3A3B105EEFB45E3B70CC1592E484DF02DF7020D5154E8C2E5D7D439E295E46 | |||
| 3428 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3428.41646\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBrowser.ncp | binary | |
MD5:8B13FDC96AF0A84C152F5A601DCC6B06 | SHA256:997C41B05150480BCFAE9ABB3132FC807F6C6B511B810B554FDB5AEDF89F5DB0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3228 | NanoCore.exe | 192.168.100.2:5351 | — | — | — | whitelisted |
3228 | NanoCore.exe | 35.212.156.187:80 | lazyshare.net | GOOGLE | US | unknown |
3228 | NanoCore.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2780 | NanoCore.exe | 192.168.100.2:5351 | — | — | — | whitelisted |
2780 | NanoCore.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2780 | NanoCore.exe | 35.212.156.187:80 | lazyshare.net | GOOGLE | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
lazyshare.net |
| unknown |
Threats
Process | Message |
|---|---|
NanoCore.exe | Trying to load native SQLite library "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
|
NanoCore.exe | Trying to load native SQLite library "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
|