| File name: | NanoCore-main.zip |
| Full analysis: | https://app.any.run/tasks/974bc89e-f194-463a-b3b5-e22f5e078edf |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | December 13, 2024, 18:46:31 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | D959BC04C57BAB80CEB182EE42522F90 |
| SHA1: | 8528FDCAA5456A2CE0C0D8842761D69529A8CDD2 |
| SHA256: | EFADEDFC9C786183024FC058A6EA83C2A219D04100FBDE03559DDC05807FDA0E |
| SSDEEP: | 98304:1HmJ85wVe0rG6bZ9jzDB6Ot89tKHMxsIP1UxaxbxBXf/+vujWjButenU0B0W+Yir:1fV0rGwN96/wMGItUuBuviNIPihxhCCn |
MALICIOUS
NANOCORE has been detected (YARA)
- NanoCore.exe (PID: 3604)
- lazyshare.exe (PID: 1092)
Changes the autorun value in the registry
- lazyshare.exe (PID: 1092)
Uses Task Scheduler to run other applications
- lazyshare.exe (PID: 1092)
SUSPICIOUS
Generic archive extractor
- WinRAR.exe (PID: 1920)
Executable content was dropped or overwritten
- lazyshare.exe (PID: 1092)
- NanoCore.exe (PID: 3604)
Reads the Internet Settings
- NanoCore.exe (PID: 3604)
Connects to unusual port
- lazyshare.exe (PID: 1092)
INFO
Reads Environment values
- NanoCore.exe (PID: 3604)
- lazyshare.exe (PID: 1092)
The process uses the downloaded file
- WinRAR.exe (PID: 1920)
- WinRAR.exe (PID: 2604)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2604)
Reads the machine GUID from the registry
- NanoCore.exe (PID: 3604)
- lazyshare.exe (PID: 1092)
Manual execution by a user
- SystemPropertiesPerformance.exe (PID: 1480)
- NanoCore.exe (PID: 3604)
- SystemPropertiesPerformance.exe (PID: 3524)
- rundll32.exe (PID: 2172)
- WinRAR.exe (PID: 2604)
- lazyshare.exe (PID: 1092)
- wmpnscfg.exe (PID: 2556)
Reads the computer name
- NanoCore.exe (PID: 3604)
- lazyshare.exe (PID: 1092)
- wmpnscfg.exe (PID: 2556)
The sample compiled with english language support
- WinRAR.exe (PID: 2604)
Checks supported languages
- NanoCore.exe (PID: 3604)
- lazyshare.exe (PID: 1092)
- wmpnscfg.exe (PID: 2556)
Sends debugging messages
- NanoCore.exe (PID: 3604)
.NET Reactor protector has been detected
- NanoCore.exe (PID: 3604)
Disables trace logs
- NanoCore.exe (PID: 3604)
Checks proxy server information
- NanoCore.exe (PID: 3604)
Creates files in the program directory
- lazyshare.exe (PID: 1092)
Creates files or folders in the user directory
- lazyshare.exe (PID: 1092)
- NanoCore.exe (PID: 3604)
Process checks whether UAC notifications are on
- lazyshare.exe (PID: 1092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Nanocore
(PID) Process(3604) NanoCore.exe
ERROR
(PID) Process(1092) lazyshare.exe
KeyboardLoggingTrue
BuildTime2024-12-13 18:47:57.479488
Version1.2.2.0
Mutexb1e99dbd-14e9-46d7-be56-481ba48ef389
DefaultGroupDefault
PrimaryConnectionHost
BackupConnectionHost209.160.31.229
ConnectionPort54984
RunOnStartupTrue
RequestElevationTrue
BypassUserAccountControlTrue
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipFileName: | NanoCore-main/ |
|---|---|
| ZipUncompressedSize: | - |
| ZipCompressedSize: | - |
| ZipCRC: | 0x00000000 |
| ZipModifyDate: | 2023:01:06 12:18:36 |
| ZipCompression: | None |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 10 |
Total processes
56
Monitored processes
10
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1920 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\NanoCore-main.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2604 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2172 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1 | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1480 | "C:\Windows\system32\systempropertiesperformance.exe" | C:\Windows\System32\SystemPropertiesPerformance.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change Computer Performance Settings Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3524 | "C:\Windows\system32\systempropertiesperformance.exe" | C:\Windows\System32\SystemPropertiesPerformance.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Change Computer Performance Settings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3604 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: NanoCore Exit code: 0 Version: 1.2.2.0 Modules
Nanocore(PID) Process(3604) NanoCore.exe ERROR | |||||||||||||||
| 1092 | "C:\Users\admin\AppData\Roaming\lazyshare.exe" | C:\Users\admin\AppData\Roaming\lazyshare.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
Nanocore(PID) Process(1092) lazyshare.exe KeyboardLoggingTrue BuildTime2024-12-13 18:47:57.479488 Version1.2.2.0 Mutexb1e99dbd-14e9-46d7-be56-481ba48ef389 DefaultGroupDefault PrimaryConnectionHost BackupConnectionHost209.160.31.229 ConnectionPort54984 RunOnStartupTrue RequestElevationTrue BypassUserAccountControlTrue ClearZoneIdentifierTrue ClearAccessControlFalse SetCriticalProcessFalse PreventSystemSleepTrue ActivateAwayModeFalse EnableDebugModeFalse RunDelay0 ConnectDelay4000 RestartDelay5000 TimeoutInterval5000 KeepAliveTimeout30000 MutexTimeout5000 LanTimeout2500 WanTimeout8000 BufferSize65535 MaxPacketSize10485760 GCThreshold10485760 UseCustomDnsServerTrue PrimaryDnsServer8.8.8.8 BackupDnsServer8.8.4.4 | |||||||||||||||
| 2412 | "schtasks.exe" /create /f /tn "TCP Monitor" /xml "C:\Users\admin\AppData\Local\Temp\tmpF682.tmp" | C:\Windows\System32\schtasks.exe | — | lazyshare.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2004 | "schtasks.exe" /create /f /tn "TCP Monitor Task" /xml "C:\Users\admin\AppData\Local\Temp\tmpF72F.tmp" | C:\Windows\System32\schtasks.exe | — | lazyshare.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2556 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
8 217
Read events
8 058
Write events
149
Delete events
10
Modification events
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\NanoCore-main.zip | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1920) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
12
Suspicious files
55
Text files
350
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1920 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1920.41547\NanoCore-main\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar | — | |
MD5:— | SHA256:— | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\AIO.ncp | binary | |
MD5:60C274CCB344DA9E3D77449F6068D253 | SHA256:0A59AAEE013C57F3B6190D683160D88CA1C5868565CBF5ACBB7B17D3E925C602 | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\DucPlugin.ncp | binary | |
MD5:5ECA68A8368E0E144B7016E30B85515C | SHA256:E2CE89B3E68B003CB27E2C5652CCBA073C8938BEF194E51830539B2464A3F676 | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MiscTools.ncp | binary | |
MD5:78E3006FC6468EB7DFC7761072B84AC6 | SHA256:3A3A3B105EEFB45E3B70CC1592E484DF02DF7020D5154E8C2E5D7D439E295E46 | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\geolocation.sqlite | sqlite | |
MD5:0E8D861CDDEDE3A0B2B02CFC0B060B99 | SHA256:11BD851D8994D3CA9D078144679AA2DC06841ADDD0947B8FA8AD36758BDECF7A | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBlack.ncp | binary | |
MD5:794AB16C092EBF2B1D812D6CCE158537 | SHA256:7919B7998D6B359D7CB700018DC2D69FF6FFB45BD01C9C190B98FB4C9FF4BEAB | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\network.sqlite | binary | |
MD5:856342A3A887715F53CD7277A2B220AF | SHA256:DE1CC5F927BDC0ACE22CF11BEBE0B83977B16338A97724E2489302A0FCDA0173 | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.xml | xml | |
MD5:5D0381A56563B1CA8928E3CF087F1625 | SHA256:0497B92461C2A9CE3101D9397FB3079F60979164336A16653D282273D3085BCC | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | executable | |
MD5:1728ACC244115CBAFD3B810277D2E321 | SHA256:EC359F50CA15395F273899C0FF7C0CD87AB5C2E23FDCFC6C72FEDC0097161D4B | |||
| 2604 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log | text | |
MD5:0061A98407086FB3106B61FE5D0FBB27 | SHA256:054DBC3E14992BEA750E1F366C16F6B0C861BC9DB2617BE91CBF7306FD25219A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
119
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1108 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
3604 | NanoCore.exe | 192.168.100.2:5351 | — | — | — | whitelisted |
3604 | NanoCore.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3604 | NanoCore.exe | 35.212.156.187:80 | lazyshare.net | GOOGLE | US | unknown |
1092 | lazyshare.exe | 209.160.31.229:54984 | — | HOPONE-GLOBAL | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
lazyshare.net |
| unknown |
Threats
Process | Message |
|---|---|
NanoCore.exe | Trying to load native SQLite library "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
|