analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

11.rar

Full analysis: https://app.any.run/tasks/d6e2c736-1cc8-481d-a6d1-91e4fd4182a4
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Analysis date: April 23, 2019, 20:13:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

82E6277A7D859925F2C21B083A30CE48

SHA1:

8643EB9A20323CDBB2DB5381E2B17BA0F8390D3A

SHA256:

EA0EF2825977E7F32D4FFEFD582CCC4DEAF8CE3AB22E27E0214FD4BCAD85D391

SSDEEP:

49152:pUD5/eMIqUAr+zHYudmr35XHbYhaHpaNXd/EGSBYa:OD5WMIqXruHYudS5HbmjLXm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Nandos.exe (PID: 2104)
      • MSBuild.exe (PID: 4000)
    • NanoCore was detected

      • MSBuild.exe (PID: 4000)
    • Changes the autorun value in the registry

      • Nandos.exe (PID: 2104)
      • MSBuild.exe (PID: 4000)
    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3200)
    • Connects to CnC server

      • MSBuild.exe (PID: 4000)
  • SUSPICIOUS

    • Creates files in the user directory

      • MSBuild.exe (PID: 4000)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3896)
      • Nandos.exe (PID: 2104)
      • MSBuild.exe (PID: 4000)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs nandos.exe #NANOCORE msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
3896"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\11.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3200"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2104"C:\Users\admin\Desktop\Nandos New checker\Nandos.exe" C:\Users\admin\Desktop\Nandos New checker\Nandos.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
pwlauncher.exe
Exit code:
0
Version:
6.3.9600.0
4000"{path}"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Nandos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.6.1055.0 built by: NETFXREL2
Total events
816
Read events
794
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
2
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3896.40962\Nandos New checker\Nandos.exeexecutable
MD5:A2C85EB81C2E1CB151646951190A5C61
SHA256:4880C2F6FF653A3D545DE491790A0A522C53E9E23DB3DE305472BA8745110DDE
2104Nandos.exeC:\Users\admin\Documents\KsYCJğPcAG\tHPLeCğMML.exeexecutable
MD5:A2C85EB81C2E1CB151646951190A5C61
SHA256:4880C2F6FF653A3D545DE491790A0A522C53E9E23DB3DE305472BA8745110DDE
4000MSBuild.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.binbinary
MD5:4E5E92E2369688041CC82EF9650EDED2
SHA256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3896.40962\Nandos New checker\Milky.dllexecutable
MD5:7D70F3734AB260D9FAE32C05D004D3BE
SHA256:8DF63EF4920DF2FCCA6143FE7CC6C8E652270FED455B8D6460084FF7A3D74217
4000MSBuild.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:268C576767FEB60E548D67C13F9DC4CF
SHA256:D8EFB11BCAEA9C40ABAB4A9B8B2ECB2ACC46C3FAFE25145BCE72E04F3A357B7B
4000MSBuild.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:2E52F446105FBF828E63CF808B721F9C
SHA256:2F7479AA2661BD259747BC89106031C11B3A3F79F12190E7F19F5DF65B7C15C8
4000MSBuild.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:9E7D0351E4DF94A9B0BADCEB6A9DB963
SHA256:AAFC7B40C5FE680A2BB549C3B90AABAAC63163F74FFFC0B00277C6BBFF88B757
4000MSBuild.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:0517EF5A34A4ED8E9AACFA71201A23C9
SHA256:70ECCABE83DF280DD393AA683CF9A408F766E015FFEC4F78F0444BD46E3FA4FA
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3896.40962\Nandos New checker\Newtonsoft.Json.dllexecutable
MD5:D827DD8A8C4B2A2CFA23C7F90F3CCE95
SHA256:B66749B81E1489FCD8D754B2AD39EBE0DB681344E392A3F49DC9235643BDBD06
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3896.40962\Nandos New checker\xNet-Ameliorated.dllexecutable
MD5:44D7396D8B6FBD8F1E9FF4D0278BB767
SHA256:16EA0EAB1FFE6B3B05ABF1B04BAA7C2695885795C5BFECB6CFCFA595A0FA7B30
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4000
MSBuild.exe
86.19.46.158:1604
Virgin Media Limited
GB
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
4000
MSBuild.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
4000
MSBuild.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
43 ETPRO signatures available at the full report
No debug info