| File name: | NanoCore-main.zip |
| Full analysis: | https://app.any.run/tasks/d3efe9cd-176b-46de-b49a-4d791f01fb1c |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | December 13, 2024, 18:40:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | D959BC04C57BAB80CEB182EE42522F90 |
| SHA1: | 8528FDCAA5456A2CE0C0D8842761D69529A8CDD2 |
| SHA256: | EFADEDFC9C786183024FC058A6EA83C2A219D04100FBDE03559DDC05807FDA0E |
| SSDEEP: | 98304:1HmJ85wVe0rG6bZ9jzDB6Ot89tKHMxsIP1UxaxbxBXf/+vujWjButenU0B0W+Yir:1fV0rGwN96/wMGItUuBuviNIPihxhCCn |
MALICIOUS
NANOCORE has been detected (YARA)
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Changes the autorun value in the registry
- lazyshare.exe (PID: 4016)
Uses Task Scheduler to run other applications
- lazyshare.exe (PID: 4016)
SUSPICIOUS
Reads the Internet Settings
- NanoCore.exe (PID: 3508)
Executable content was dropped or overwritten
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Connects to unusual port
- lazyshare.exe (PID: 4016)
INFO
The sample compiled with english language support
- WinRAR.exe (PID: 3020)
Reads the computer name
- wmpnscfg.exe (PID: 2776)
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Manual execution by a user
- WinRAR.exe (PID: 3020)
- wmpnscfg.exe (PID: 2776)
- rundll32.exe (PID: 444)
- NanoCore.exe (PID: 3508)
- SystemPropertiesPerformance.exe (PID: 3040)
- SystemPropertiesPerformance.exe (PID: 3424)
- lazyshare.exe (PID: 4016)
The process uses the downloaded file
- WinRAR.exe (PID: 1824)
- WinRAR.exe (PID: 3020)
- lazyshare.exe (PID: 4016)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3020)
Checks supported languages
- wmpnscfg.exe (PID: 2776)
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Reads the machine GUID from the registry
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Sends debugging messages
- NanoCore.exe (PID: 3508)
Creates files or folders in the user directory
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Disables trace logs
- NanoCore.exe (PID: 3508)
Reads Environment values
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Checks proxy server information
- NanoCore.exe (PID: 3508)
Process checks whether UAC notifications are on
- lazyshare.exe (PID: 4016)
Creates files in the program directory
- lazyshare.exe (PID: 4016)
Create files in a temporary directory
- lazyshare.exe (PID: 4016)
.NET Reactor protector has been detected
- NanoCore.exe (PID: 3508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Nanocore
(PID) Process(3508) NanoCore.exe
ERROR
(PID) Process(4016) lazyshare.exe
KeyboardLoggingTrue
BuildTime2024-12-13 18:42:52.753936
Version1.2.2.0
Mutex0965f95c-74fa-40f4-9c9c-0d744a3e1912
DefaultGroupDefault
PrimaryConnectionHost206.78.170.108
BackupConnectionHost82.178.78.168
ConnectionPort54984
RunOnStartupTrue
RequestElevationTrue
BypassUserAccountControlTrue
ClearZoneIdentifierTrue
ClearAccessControlFalse
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2023:01:06 12:18:36 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | NanoCore-main/ |
Total processes
57
Monitored processes
10
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 444 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1 | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1676 | "schtasks.exe" /create /f /tn "TCP Monitor Task" /xml "C:\Users\admin\AppData\Local\Temp\tmp146C.tmp" | C:\Windows\System32\schtasks.exe | — | lazyshare.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1824 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\NanoCore-main.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2436 | "schtasks.exe" /create /f /tn "TCP Monitor" /xml "C:\Users\admin\AppData\Local\Temp\tmp13DE.tmp" | C:\Windows\System32\schtasks.exe | — | lazyshare.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2776 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3020 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar" "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3040 | "C:\Windows\system32\systempropertiesperformance.exe" | C:\Windows\System32\SystemPropertiesPerformance.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change Computer Performance Settings Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3424 | "C:\Windows\system32\systempropertiesperformance.exe" | C:\Windows\System32\SystemPropertiesPerformance.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Change Computer Performance Settings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3508 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: NanoCore Exit code: 0 Version: 1.2.2.0 Modules
Nanocore(PID) Process(3508) NanoCore.exe ERROR | |||||||||||||||
| 4016 | "C:\Users\admin\AppData\Roaming\lazyshare.exe" | C:\Users\admin\AppData\Roaming\lazyshare.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
Nanocore(PID) Process(4016) lazyshare.exe KeyboardLoggingTrue BuildTime2024-12-13 18:42:52.753936 Version1.2.2.0 Mutex0965f95c-74fa-40f4-9c9c-0d744a3e1912 DefaultGroupDefault PrimaryConnectionHost206.78.170.108 BackupConnectionHost82.178.78.168 ConnectionPort54984 RunOnStartupTrue RequestElevationTrue BypassUserAccountControlTrue ClearZoneIdentifierTrue ClearAccessControlFalse SetCriticalProcessFalse PreventSystemSleepTrue ActivateAwayModeFalse EnableDebugModeFalse RunDelay0 ConnectDelay4000 RestartDelay5000 TimeoutInterval5000 KeepAliveTimeout30000 MutexTimeout5000 LanTimeout2500 WanTimeout8000 BufferSize65535 MaxPacketSize10485760 GCThreshold10485760 UseCustomDnsServerTrue PrimaryDnsServer8.8.8.8 BackupDnsServer8.8.4.4 | |||||||||||||||
Total events
9 797
Read events
9 635
Write events
151
Delete events
11
Modification events
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\NanoCore-main.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
12
Suspicious files
52
Text files
349
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1824.10088\NanoCore-main\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar | — | |
MD5:— | SHA256:— | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite | sqlite | |
MD5:EA522FC387E8E1C1C65E946C9118E2C7 | SHA256:AE429DBFCA9416CFC6832AED1190FA7B9EB90127328136A249DE024349FD3B3B | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\client.bin | executable | |
MD5:906A949E34472F99BA683EFF21907231 | SHA256:9D3EA5AF7DC261BF93C76F55D702A315AA22FB241E4207DC86CD834C262245C8 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dll | executable | |
MD5:BDC8945F1D799C845408522E372D1DBD | SHA256:61E9D5C0727665E9EF3F328141397BE47C65ED11AB621C644B5BBF1D67138403 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\DucPlugin.ncp | binary | |
MD5:5ECA68A8368E0E144B7016E30B85515C | SHA256:E2CE89B3E68B003CB27E2C5652CCBA073C8938BEF194E51830539B2464A3F676 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | executable | |
MD5:1728ACC244115CBAFD3B810277D2E321 | SHA256:EC359F50CA15395F273899C0FF7C0CD87AB5C2E23FDCFC6C72FEDC0097161D4B | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\AIO.ncp | binary | |
MD5:60C274CCB344DA9E3D77449F6068D253 | SHA256:0A59AAEE013C57F3B6190D683160D88CA1C5868565CBF5ACBB7B17D3E925C602 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\CorePlugin.ncp | binary | |
MD5:7914E7302F72D330AA5F6C5C8C26DF43 | SHA256:F66985518B1E56A04F512D110F5B79F21ED91CBCBF6BD3E17EBA3DCDFB85F9B5 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log | text | |
MD5:0061A98407086FB3106B61FE5D0FBB27 | SHA256:054DBC3E14992BEA750E1F366C16F6B0C861BC9DB2617BE91CBF7306FD25219A | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\geolocation.sqlite | sqlite | |
MD5:0E8D861CDDEDE3A0B2B02CFC0B060B99 | SHA256:11BD851D8994D3CA9D078144679AA2DC06841ADDD0947B8FA8AD36758BDECF7A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
21
DNS requests
7
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1108 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3508 | NanoCore.exe | 192.168.100.2:5351 | — | — | — | whitelisted |
3508 | NanoCore.exe | 35.212.156.187:80 | lazyshare.net | GOOGLE | US | unknown |
3508 | NanoCore.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4016 | lazyshare.exe | 206.78.170.108:54984 | — | TCOE | US | unknown |
4016 | lazyshare.exe | 82.178.78.168:54984 | — | Oman Telecommunications Company (S.A.O.G) | OM | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
lazyshare.net |
| unknown |
dns.msftncsi.com |
| whitelisted |
Threats
Process | Message |
|---|---|
NanoCore.exe | Trying to load native SQLite library "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
|