analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar |
| Full analysis: | https://app.any.run/tasks/8c99d166-a97d-4e02-bcb7-b4b47297295f |
| Verdict: | Malicious activity |
| Analysis date: | July 16, 2019, 22:42:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | C75744769BAE7A3E7A4A1AEC27673851 |
| SHA1: | 56B0AA88B44C532BE4975BC096CB8E4B9E7ECB49 |
| SHA256: | CEB348DFA61B34BEBCE021FA783B0AFDB874EA7205F75E7FB42B01898439BE75 |
| SSDEEP: | 98304:5S+zg4KC/4ObL3j/ZV2tKRcHhMBJcPpylijvjTZi1UBCFCX/IxCF+/h0k98nRDdj:51kC/40z3tKMrcByIT1B2zkA/Ck92thv |
MALICIOUS
Application was dropped or rewritten from another process
- NanoCore.exe (PID: 3668)
- PluginCompiler.exe (PID: 2804)
Loads dropped or rewritten executable
- NanoCore.exe (PID: 3668)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3476)
Creates files in the user directory
- NanoCore.exe (PID: 3668)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
EXIF
ZIP
| CompressedSize: | 3066 |
|---|---|
| UncompressedSize: | 22746 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2016:06:05 21:53:28 |
| PackingMethod: | Best Compression |
| ArchivedFileName: | NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log |
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3476 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 3668 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM Description: NanoCore Version: 1.2.2.0 | ||||
| 2804 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47953\NanoCore 1.2.2.0_Cracked By Alcatraz3222\PluginCompiler.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47953\NanoCore 1.2.2.0_Cracked By Alcatraz3222\PluginCompiler.exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.2.0.0 | ||||
Total events
501
Read events
464
Write events
0
Delete events
0
Modification events
Executable files
16
Suspicious files
41
Text files
692
Unknown types
13
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Exceptions\Client\1.2.2.0\c42214a80aee43e514d5aba60af06da2.log | text | |
MD5:C42214A80AEE43E514D5ABA60AF06DA2 | SHA256:F93190510C1434EF43C6C389544C5172BF47C4CE1DE57C762616929428563B86 | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | executable | |
MD5:1728ACC244115CBAFD3B810277D2E321 | SHA256:EC359F50CA15395F273899C0FF7C0CD87AB5C2E23FDCFC6C72FEDC0097161D4B | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\core.sqlite | sqlite | |
MD5:3732DF3263FBAA868BB866BCCA1F402C | SHA256:716D9992711B5B17ECA841836BA5A63DB0A62251BD056A92DB96DECCFA887B41 | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\PluginCompiler.exe | executable | |
MD5:E2D1C5DF11F9573F6C5D0A7AD1A79FBF | SHA256:0B41B2FCD0F1A4E913D3EFE293F713849D59EFEBB27BAC060AB31BED51AC2F6B | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\network.sqlite | sqlite | |
MD5:856342A3A887715F53CD7277A2B220AF | SHA256:DE1CC5F927BDC0ACE22CF11BEBE0B83977B16338A97724E2489302A0FCDA0173 | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dll | executable | |
MD5:BDC8945F1D799C845408522E372D1DBD | SHA256:61E9D5C0727665E9EF3F328141397BE47C65ED11AB621C644B5BBF1D67138403 | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\geolocation.sqlite | sqlite | |
MD5:0E8D861CDDEDE3A0B2B02CFC0B060B99 | SHA256:11BD851D8994D3CA9D078144679AA2DC06841ADDD0947B8FA8AD36758BDECF7A | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite | sqlite | |
MD5:EA522FC387E8E1C1C65E946C9118E2C7 | SHA256:AE429DBFCA9416CFC6832AED1190FA7B9EB90127328136A249DE024349FD3B3B | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\CorePlugin.ncp | binary | |
MD5:7914E7302F72D330AA5F6C5C8C26DF43 | SHA256:F66985518B1E56A04F512D110F5B79F21ED91CBCBF6BD3E17EBA3DCDFB85F9B5 | |||
| 3476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MultiCore.ncp | binary | |
MD5:BECB82E1E914E906BE158E3F9DD658AC | SHA256:5494ADF651FC64E3AA6C08E38165D8DBFEC52056CDF4FADAE90B76B0E6816A33 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
DNS requests
Domain | IP | Reputation |
|---|---|---|
lazyshare.net |
| unknown |
Threats
Process | Message |
|---|---|
NanoCore.exe | Trying to load native SQLite library "C:\Users\admin\AppData\Local\Temp\Rar$EXa3476.47164\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
|