| File name: | e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9 |
| Full analysis: | https://app.any.run/tasks/758eaaf7-d81f-402c-89c3-a7b50518607a |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | November 08, 2019, 13:49:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | UTF-8 Unicode text, with CRLF, LF line terminators |
| MD5: | F7A2CBDEAD19E67DCAB3848E3EA13D09 |
| SHA1: | 7A1840BC33EA142C841AA58DFFD0818CFC0E7B85 |
| SHA256: | E743D11D5AA1769E2EC6BB95514A248C3E2D0B3FE779C2D9E984AAC47F8C0ED9 |
| SSDEEP: | 12288:mezfR32VcGMqviYQAPBy1ddoTQw4n9bFUrJHrXQ6wmZK1MW03FN9cCX:mezJ2V/rJ9WHeJLXQpj638O |
MALICIOUS
Application was dropped or rewritten from another process
- Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
Writes to a start menu file
- Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
NANOCORE was detected
- RegSvcs.exe (PID: 2632)
SUSPICIOUS
Creates files in the user directory
- OUTLOOK.EXE (PID: 2840)
- Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
- RegSvcs.exe (PID: 2632)
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 2840)
Reads the machine GUID from the registry
- OUTLOOK.EXE (PID: 2840)
- WinRAR.exe (PID: 2816)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2816)
- Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
Connects to unusual port
- RegSvcs.exe (PID: 2632)
INFO
Manual execution by user
- OUTLOOK.EXE (PID: 2840)
- WinRAR.exe (PID: 2816)
- Bidakis dokument z zahtevami za izdelek SKBCM doc.exe (PID: 2812)
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .mbox | | | Standard Unix Mailbox (74.3) |
|---|---|---|
| .eml | | | E-Mail message (Var. 2) (25.6) |
Total processes
51
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2592 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9.mbox | C:\Windows\system32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2632 | "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Bidakis dokument z zahtevami za izdelek SKBCM doc.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Exit code: 0 Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
| |||||||||||||||
| 2812 | "C:\Users\admin\Desktop\Bidakis dokument z zahtevami za izdelek SKBCM doc.exe" | C:\Users\admin\Desktop\Bidakis dokument z zahtevami za izdelek SKBCM doc.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2816 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Bidakis dokument z zahtevami za izdelek SKBCM doc.arj" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2840 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\e743d11d5aa1769e2ec6bb95514a248c3e2d0b3fe779c2d9e984aac47f8c0ed9.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.4760.1000 Modules
| |||||||||||||||
Total events
2 110
Read events
1 530
Write events
561
Delete events
19
Modification events
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (2840) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1055 |
Value: Off | |||
Executable files
2
Suspicious files
4
Text files
14
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRB061.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\tmpB5E0.tmp | — | |
MD5:— | SHA256:— | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\G70K6L2A\Bidakis dokument z zahtevami za izdelek SKBCM doc (2).arj\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\G70K6L2A\Bidakis dokument z zahtevami za izdelek SKBCM doc.arj | compressed | |
MD5:— | SHA256:— | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:— | SHA256:— | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:— | SHA256:— | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_5BCE4D9D38F4E647AD0332B7401D27B5.dat | xml | |
MD5:0B5B8DC93D5CDF7CA798E0F70F9088E5 | SHA256:BEC0EBA2EF9D67291F450ADA494386148A210A279927D160B50C238ADDC1DF8B | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_038505D221250146B868F5B248484AAC.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7FC9D1F9-FA6A-4A02-BAA4-65A46356744D}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png | image | |
MD5:4C61C12EDBC453D7AE184976E95258E1 | SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F | |||
| 2840 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_138BBF08F615844AA6FAC3EF699C03CE.dat | xml | |
MD5:D8B37ED0410FB241C283F72B76987F18 | SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
61
DNS requests
31
Threats
30
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2840 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2840 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2632 | RegSvcs.exe | 8.8.8.8:53 | — | Google Inc. | US | malicious |
2632 | RegSvcs.exe | 192.169.69.25:5626 | meca.duckdns.org | Wowrack.com | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
meca.duckdns.org |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2632 | RegSvcs.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |