analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9

Full analysis: https://app.any.run/tasks/758eaaf7-d81f-402c-89c3-a7b50518607a
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: November 08, 2019, 13:49:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
nanocore
Indicators:
MIME: text/plain
File info: UTF-8 Unicode text, with CRLF, LF line terminators
MD5:

F7A2CBDEAD19E67DCAB3848E3EA13D09

SHA1:

7A1840BC33EA142C841AA58DFFD0818CFC0E7B85

SHA256:

E743D11D5AA1769E2EC6BB95514A248C3E2D0B3FE779C2D9E984AAC47F8C0ED9

SSDEEP:

12288:mezfR32VcGMqviYQAPBy1ddoTQw4n9bFUrJHrXQ6wmZK1MW03FN9cCX:mezJ2V/rJ9WHeJLXQpj638O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)

    • Application was dropped or rewritten from another process

      • Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)

    • NANOCORE was detected

      • RegSvcs.exe (PID: 2632)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • OUTLOOK.EXE (PID: 2840)
      • WinRAR.exe (PID: 2816)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2840)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2840)
      • Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
      • RegSvcs.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
      • WinRAR.exe (PID: 2816)

    • Connects to unusual port

      • RegSvcs.exe (PID: 2632)

  • INFO

    • Manual execution by user

      • OUTLOOK.EXE (PID: 2840)
      • WinRAR.exe (PID: 2816)
      • Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.mbox | Standard Unix Mailbox (74.3)
.eml | E-Mail message (Var. 2) (25.6)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs outlook.exe winrar.exe bidakis dokument z zahtevami za izdelek skbcm doc.exe #NANOCORE regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
2592"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9.mboxC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2840"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.4760.1000
2816"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Bidakis dokument z zahtevami za izdelek SKBCM doc.arj" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2812"C:\Users\admin\Desktop\Bidakis dokument z zahtevami za izdelek SKBCM doc.exe" C:\Users\admin\Desktop\Bidakis dokument z zahtevami za izdelek SKBCM doc.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
2632"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Bidakis dokument z zahtevami za izdelek SKBCM doc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Total events
2 110
Read events
1 530
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
14
Unknown types
1

Dropped files

PID
Process
Filename
Type
2840OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRB061.tmp.cvr —
MD5:—
SHA256:—
2840OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmpB5E0.tmp —
MD5:—
SHA256:—
2840OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\G70K6L2A\Bidakis dokument z zahtevami za izdelek SKBCM doc (2).arj\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
2840OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:52E75EEB8A43C946CDDE72940D00D38C
SHA256:57BDA265C0CAC6AE27EC852E3922B6DB6B3FBDA4B4A88BC17C37749166C7C654
2840OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:B07059E6663903A1DD995597CDD1FB50
SHA256:C43C4E9AEDEDE292A48FEEDCA40D0DB0675532DB4F295C954DDAE518A3719D61
2812Bidakis dokument z zahtevami za izdelek SKBCM doc.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\consent.urltext
MD5:EB54CB25DCCB78FFC7F5098F4A14F8F7
SHA256:D61131AF4D71DBA0F1DBB4D21E27E3613B0BCAA1A9844E5649D6E7DE7D00EED1
2812Bidakis dokument z zahtevami za izdelek SKBCM doc.exeC:\Users\admin\consent\consent.vbstext
MD5:15A8C953782363C9F01C99D4134F5006
SHA256:A89359F13B6D1481CC20FB453DE691DA2A1614299407274B5F09295C6B3EF08A
2840OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\G70K6L2A\Bidakis dokument z zahtevami za izdelek SKBCM doc.arjcompressed
MD5:AFDA3B8D5A4870EAF523AE0A02DF513C
SHA256:D92D7C6B8AC9C4064F85EEA8A79EEADFD55FC9662E468AD160E9F3F4A19750F2
2840OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_5BCE4D9D38F4E647AD0332B7401D27B5.datxml
MD5:0B5B8DC93D5CDF7CA798E0F70F9088E5
SHA256:BEC0EBA2EF9D67291F450ADA494386148A210A279927D160B50C238ADDC1DF8B
2812Bidakis dokument z zahtevami za izdelek SKBCM doc.exeC:\Users\admin\consent\clip.exeexecutable
MD5:EFEC01E376E7441ACD3DDB9E890A7C10
SHA256:5DB9118518294ED1EBB405C7DA36ADC179080379A62386EF2B235E96CB672164
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
61
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2840
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2840
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2632
RegSvcs.exe
192.169.69.25:5626
meca.duckdns.org
Wowrack.com
US
malicious
2632
RegSvcs.exe
8.8.8.8:53
—
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
meca.duckdns.org
  • 192.169.69.25
malicious

Threats

PID
Process
Class
Message
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2632
RegSvcs.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9