analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Fax%20Copy%2011100987375903.exe

Full analysis: https://app.any.run/tasks/61c95910-30ae-406b-80ff-db1a67abe0a4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 10, 2019, 16:27:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
trojan
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

F25474545660F209153DF0262CDE99A8

SHA1:

316B1D698B3DCCACAB7475B2FEB1C92118E22603

SHA256:

FB6680DCAA501BCC117497B699335137AF3EB2416B3BBB259BC7B1112054E966

SSDEEP:

24576:v66hu2YFCC8X+s8Ot4VNCBDE/ESZDEK83CZM6lPwXDGE5:vJhFYwOs8c4VTESnZ/mDGU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RegAsm.exe (PID: 2292)
      • RegAsm.exe (PID: 3312)
    • NanoCore was detected

      • RegAsm.exe (PID: 2292)
    • Changes the autorun value in the registry

      • RegAsm.exe (PID: 2292)
    • Connects to CnC server

      • RegAsm.exe (PID: 2292)
    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3128)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 2292)
      • iexplore.exe (PID: 3128)
      • iexplore.exe (PID: 2376)
    • Creates files in the user directory

      • RegAsm.exe (PID: 2292)
    • Connects to unusual port

      • RegAsm.exe (PID: 2292)
  • INFO

    • Application was crashed

      • d991d9f9-0aea-4a79-879e-1c84eb63db18.exe (PID: 2976)
      • Fax%20Copy%2011100987375903[1].exe (PID: 3048)
    • Changes internet zones settings

      • iexplore.exe (PID: 2376)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3128)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2376)
      • iexplore.exe (PID: 3128)
    • Application launched itself

      • iexplore.exe (PID: 2376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (81)
.dll | Win32 Dynamic Link Library (generic) (7.2)
.exe | Win32 Executable (generic) (4.9)
.exe | Win16/32 Executable Delphi generic (2.2)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

AssemblyVersion: 0.0.0.0
ProductVersion: 0.0.0.0
OriginalFileName: AHyoZUjPziFviSDJm.exe
LegalCopyright:
InternalName: AHyoZUjPziFviSDJm.exe
FileVersion: 0.0.0.0
FileDescription:
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xc779e
UninitializedDataSize: -
InitializedDataSize: 70144
CodeSize: 808960
LinkerVersion: 6
PEType: PE32
TimeStamp: 2019:01:07 17:12:22+01:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start d991d9f9-0aea-4a79-879e-1c84eb63db18.exe #NANOCORE regasm.exe iexplore.exe iexplore.exe fax%20copy%2011100987375903[1].exe regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2976"C:\Users\admin\AppData\Local\Temp\d991d9f9-0aea-4a79-879e-1c84eb63db18.exe" C:\Users\admin\AppData\Local\Temp\d991d9f9-0aea-4a79-879e-1c84eb63db18.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221225477
Version:
0.0.0.0
2292"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
d991d9f9-0aea-4a79-879e-1c84eb63db18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.6.1055.0 built by: NETFXREL2
2376"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3128"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2376 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3048"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\Fax%20Copy%2011100987375903[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\Fax%20Copy%2011100987375903[1].exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221225477
Version:
0.0.0.0
3312"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFax%20Copy%2011100987375903[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
Total events
762
Read events
699
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
4
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
2292RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\settings.bak
MD5:
SHA256:
2376iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico
MD5:
SHA256:
2376iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2376iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\Fax%20Copy%2011100987375903[1].exeexecutable
MD5:F25474545660F209153DF0262CDE99A8
SHA256:FB6680DCAA501BCC117497B699335137AF3EB2416B3BBB259BC7B1112054E966
2292RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\catalog.datbs
MD5:07E869EFFFDD2F65137C6602BBA2CB52
SHA256:C85AE7394C293A4322032A2F8802833DBF39245201D19B7E01E5F789986A527A
2376iexplore.exeC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:C4B02ECFA2F53E319F1D341E83FBC5E9
SHA256:DB95E8CA7D72A652365048A2D4906D8E73F0E7206F2FC52CE9BE449A3B5C6026
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019011020190111\index.datdat
MD5:E1596ACE887921EFFBAC617BC2966B0F
SHA256:D4BE8E444F941EDE36F0F095A8FFCFDC72B8952639C8E34D8A83BB2B39EB335D
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Fax%20Copy%2011100987375903[1].exeexecutable
MD5:F25474545660F209153DF0262CDE99A8
SHA256:FB6680DCAA501BCC117497B699335137AF3EB2416B3BBB259BC7B1112054E966
2376iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019011020190111\index.datdat
MD5:36DDE2AA0F5333893DD97B2B89122FC2
SHA256:4C954167F045FEE3DF98AD4FFD0B42ED015A85F38255DA441C30B2953FC63CED
2292RegAsm.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\storage.datbinary
MD5:A105FB6B4BC3FB24B50E13B44662A3FA
SHA256:4FAB9BEE46A47D37F7421FB93A90582EF3C8D0E26C0C3E5F32418DF2FCEBC36B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3128
iexplore.exe
GET
200
162.215.253.15:80
http://mahavirherbals.com/copy/Fax%20Copy%2011100987375903.exe
US
executable
959 Kb
malicious
2376
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2292
RegAsm.exe
8.8.8.8:53
Google Inc.
US
whitelisted
2376
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2292
RegAsm.exe
172.93.225.210:1010
parcel.duckdns.org
Nexeon Technologies, Inc.
US
malicious
3128
iexplore.exe
162.215.253.15:80
mahavirherbals.com
PDR
US
malicious

DNS requests

Domain
IP
Reputation
parcel.duckdns.org
  • 172.93.225.210
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
mahavirherbals.com
  • 162.215.253.15
malicious

Threats

PID
Process
Class
Message
2292
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
2292
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] NanoCore.RAT
3128
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2292
RegAsm.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
25 ETPRO signatures available at the full report
No debug info