| File name: | NanoCore-main.zip |
| Full analysis: | https://app.any.run/tasks/d3efe9cd-176b-46de-b49a-4d791f01fb1c |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | December 13, 2024, 18:40:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | D959BC04C57BAB80CEB182EE42522F90 |
| SHA1: | 8528FDCAA5456A2CE0C0D8842761D69529A8CDD2 |
| SHA256: | EFADEDFC9C786183024FC058A6EA83C2A219D04100FBDE03559DDC05807FDA0E |
| SSDEEP: | 98304:1HmJ85wVe0rG6bZ9jzDB6Ot89tKHMxsIP1UxaxbxBXf/+vujWjButenU0B0W+Yir:1fV0rGwN96/wMGItUuBuviNIPihxhCCn |
MALICIOUS
Changes the autorun value in the registry
- lazyshare.exe (PID: 4016)
Uses Task Scheduler to run other applications
- lazyshare.exe (PID: 4016)
NANOCORE has been detected (YARA)
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
SUSPICIOUS
Executable content was dropped or overwritten
- lazyshare.exe (PID: 4016)
- NanoCore.exe (PID: 3508)
Reads the Internet Settings
- NanoCore.exe (PID: 3508)
Connects to unusual port
- lazyshare.exe (PID: 4016)
INFO
Manual execution by a user
- wmpnscfg.exe (PID: 2776)
- NanoCore.exe (PID: 3508)
- rundll32.exe (PID: 444)
- SystemPropertiesPerformance.exe (PID: 3040)
- WinRAR.exe (PID: 3020)
- SystemPropertiesPerformance.exe (PID: 3424)
- lazyshare.exe (PID: 4016)
Disables trace logs
- NanoCore.exe (PID: 3508)
Checks supported languages
- NanoCore.exe (PID: 3508)
- wmpnscfg.exe (PID: 2776)
- lazyshare.exe (PID: 4016)
The process uses the downloaded file
- WinRAR.exe (PID: 3020)
- WinRAR.exe (PID: 1824)
- lazyshare.exe (PID: 4016)
Sends debugging messages
- NanoCore.exe (PID: 3508)
Reads the computer name
- wmpnscfg.exe (PID: 2776)
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Creates files or folders in the user directory
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
The sample compiled with english language support
- WinRAR.exe (PID: 3020)
Reads Environment values
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Reads the machine GUID from the registry
- NanoCore.exe (PID: 3508)
- lazyshare.exe (PID: 4016)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3020)
Process checks whether UAC notifications are on
- lazyshare.exe (PID: 4016)
Creates files in the program directory
- lazyshare.exe (PID: 4016)
Checks proxy server information
- NanoCore.exe (PID: 3508)
.NET Reactor protector has been detected
- NanoCore.exe (PID: 3508)
Create files in a temporary directory
- lazyshare.exe (PID: 4016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Nanocore
(PID) Process(3508) NanoCore.exe
ERROR
(PID) Process(4016) lazyshare.exe
BackupDnsServer8.8.4.4
PrimaryDnsServer8.8.8.8
UseCustomDnsServerTrue
GCThreshold10485760
MaxPacketSize10485760
BufferSize65535
WanTimeout8000
LanTimeout2500
MutexTimeout5000
KeepAliveTimeout30000
TimeoutInterval5000
RestartDelay5000
ConnectDelay4000
RunDelay0
EnableDebugModeFalse
ActivateAwayModeFalse
PreventSystemSleepTrue
SetCriticalProcessFalse
ClearAccessControlFalse
ClearZoneIdentifierTrue
BypassUserAccountControlTrue
RequestElevationTrue
RunOnStartupTrue
ConnectionPort54984
BackupConnectionHost82.178.78.168
PrimaryConnectionHost206.78.170.108
DefaultGroupDefault
Mutex0965f95c-74fa-40f4-9c9c-0d744a3e1912
Version1.2.2.0
BuildTime2024-12-13 18:42:52.753936
KeyboardLoggingTrue
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2023:01:06 12:18:36 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | NanoCore-main/ |
Total processes
57
Monitored processes
10
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1824 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\NanoCore-main.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3020 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar" "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2776 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 444 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1 | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3040 | "C:\Windows\system32\systempropertiesperformance.exe" | C:\Windows\System32\SystemPropertiesPerformance.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change Computer Performance Settings Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3424 | "C:\Windows\system32\systempropertiesperformance.exe" | C:\Windows\System32\SystemPropertiesPerformance.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Change Computer Performance Settings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3508 | "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: NanoCore Exit code: 0 Version: 1.2.2.0 Modules
Nanocore(PID) Process(3508) NanoCore.exe ERROR | |||||||||||||||
| 4016 | "C:\Users\admin\AppData\Roaming\lazyshare.exe" | C:\Users\admin\AppData\Roaming\lazyshare.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
Nanocore(PID) Process(4016) lazyshare.exe BackupDnsServer8.8.4.4 PrimaryDnsServer8.8.8.8 UseCustomDnsServerTrue GCThreshold10485760 MaxPacketSize10485760 BufferSize65535 WanTimeout8000 LanTimeout2500 MutexTimeout5000 KeepAliveTimeout30000 TimeoutInterval5000 RestartDelay5000 ConnectDelay4000 RunDelay0 EnableDebugModeFalse ActivateAwayModeFalse PreventSystemSleepTrue SetCriticalProcessFalse ClearAccessControlFalse ClearZoneIdentifierTrue BypassUserAccountControlTrue RequestElevationTrue RunOnStartupTrue ConnectionPort54984 BackupConnectionHost82.178.78.168 PrimaryConnectionHost206.78.170.108 DefaultGroupDefault Mutex0965f95c-74fa-40f4-9c9c-0d744a3e1912 Version1.2.2.0 BuildTime2024-12-13 18:42:52.753936 KeyboardLoggingTrue | |||||||||||||||
| 2436 | "schtasks.exe" /create /f /tn "TCP Monitor" /xml "C:\Users\admin\AppData\Local\Temp\tmp13DE.tmp" | C:\Windows\System32\schtasks.exe | — | lazyshare.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1676 | "schtasks.exe" /create /f /tn "TCP Monitor Task" /xml "C:\Users\admin\AppData\Local\Temp\tmp146C.tmp" | C:\Windows\System32\schtasks.exe | — | lazyshare.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
9 797
Read events
9 635
Write events
151
Delete events
11
Modification events
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\NanoCore-main.zip | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
12
Suspicious files
52
Text files
349
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1824.10088\NanoCore-main\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar | — | |
MD5:— | SHA256:— | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Exceptions\Client\1.2.2.0\c42214a80aee43e514d5aba60af06da2.log | text | |
MD5:C42214A80AEE43E514D5ABA60AF06DA2 | SHA256:F93190510C1434EF43C6C389544C5172BF47C4CE1DE57C762616929428563B86 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\geolocation.sqlite | sqlite | |
MD5:0E8D861CDDEDE3A0B2B02CFC0B060B99 | SHA256:11BD851D8994D3CA9D078144679AA2DC06841ADDD0947B8FA8AD36758BDECF7A | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\CorePlugin.ncp | binary | |
MD5:7914E7302F72D330AA5F6C5C8C26DF43 | SHA256:F66985518B1E56A04F512D110F5B79F21ED91CBCBF6BD3E17EBA3DCDFB85F9B5 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dll | executable | |
MD5:BDC8945F1D799C845408522E372D1DBD | SHA256:61E9D5C0727665E9EF3F328141397BE47C65ED11AB621C644B5BBF1D67138403 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe | executable | |
MD5:1728ACC244115CBAFD3B810277D2E321 | SHA256:EC359F50CA15395F273899C0FF7C0CD87AB5C2E23FDCFC6C72FEDC0097161D4B | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBlack.ncp | binary | |
MD5:794AB16C092EBF2B1D812D6CCE158537 | SHA256:7919B7998D6B359D7CB700018DC2D69FF6FFB45BD01C9C190B98FB4C9FF4BEAB | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log | text | |
MD5:0061A98407086FB3106B61FE5D0FBB27 | SHA256:054DBC3E14992BEA750E1F366C16F6B0C861BC9DB2617BE91CBF7306FD25219A | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\core.sqlite | sqlite | |
MD5:3732DF3263FBAA868BB866BCCA1F402C | SHA256:716D9992711B5B17ECA841836BA5A63DB0A62251BD056A92DB96DECCFA887B41 | |||
| 3020 | WinRAR.exe | C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite | sqlite | |
MD5:EA522FC387E8E1C1C65E946C9118E2C7 | SHA256:AE429DBFCA9416CFC6832AED1190FA7B9EB90127328136A249DE024349FD3B3B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
21
DNS requests
7
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1108 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3508 | NanoCore.exe | 192.168.100.2:5351 | — | — | — | whitelisted |
3508 | NanoCore.exe | 35.212.156.187:80 | lazyshare.net | GOOGLE | US | unknown |
3508 | NanoCore.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4016 | lazyshare.exe | 206.78.170.108:54984 | — | TCOE | US | unknown |
4016 | lazyshare.exe | 82.178.78.168:54984 | — | Oman Telecommunications Company (S.A.O.G) | OM | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
lazyshare.net |
| unknown |
dns.msftncsi.com |
| whitelisted |
Threats
Process | Message |
|---|---|
NanoCore.exe | Trying to load native SQLite library "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
|