Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

SecuriteInfo.com.W32.AIDetect.malware2.20966.exe

Status: finished
Submission Time: 2022-05-26 15:44:09 +02:00
Malicious
Trojan
Evader
GuLoader, NanoCore

Comments

Tags

  • exe

Details

  • Analysis ID:
    634648
  • API (Web) ID:
    1002152
  • Analysis Started:
    2022-05-26 15:44:13 +02:00
  • Analysis Finished:
    2022-05-26 16:08:07 +02:00
  • MD5:
    64d7de9ac600402c1f3e5b9849cbd12c
  • SHA1:
    961f113b32ce2f0958ec5fcccf5489524cf30348
  • SHA256:
    da36f8024e0a8b325dbd71aceed611d0cc8000af85346ceea1bd2a2cf1a73eb6
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 72
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Full Report Management Report IOC Report
malicious
Score: 96
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

Third Party Analysis Engines

Open Full Report
malicious
Score: 5/68

IPs

IP Country Detection
23.105.131.186
 United States
162.159.129.233
 United States

Domains

Name IP Detection
ratagain.gleeze.com
 23.105.131.186
cdn.discordapp.com
 162.159.129.233

URLs

Name Detection
https://sectigo.com/CPS0D
https://curl.haxx.se/docs/http-cookies.html
http://www.symauth.com/cps0(
Click to see the 15 hidden entries
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
https://cdn.discordapp.com/attachments/963535165500588126/979323922124263434/NANO_uyUuDnXlo102.bin
http://nsis.sf.net/NSIS_ErrorError
http://scripts.sil.org/OFLSource
https://cdn.discordapp.com/
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
http://www.nero.com
http://ocsp.thawte.com0
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
http://www.symauth.com/rpa00
http://ocsp.sectigo.com0
http://crl.thawte.com/ThawteTimestampingCA.crl0
https://sectigo.com/CPS0
https://cdn.discordapp.com/attachments/963535165500588126/979323922124263434/NANO_uyUuDnXlo102.bin9

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat
 data
 #
C:\Users\user\AppData\Local\Temp\audio-volume-high.png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\catalog.dat
 data
 #
Click to see the 16 hidden entries
C:\Users\user\AppData\Local\Temp\vmmemctl.inf
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\nsiAE0F.tmp\System.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\network-wireless-hotspot-symbolic.symbolic.png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Temp\farme.Fej5
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\edit-clear-rtl.png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Temp\directory\filename.exe
 data
 #
C:\Users\user\AppData\Local\Temp\battery-level-10-symbolic.symbolic.png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Temp\Bolson210.ini
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\athcfg20U.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\System.Net.Http.dll
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\SourceCodePro-Medium.otf
 OpenType font data
 #
C:\Users\user\AppData\Local\Temp\Nonarguable.JAP
 data
 #
C:\Users\user\AppData\Local\Temp\NMDllHost.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\Lib.Platform.Windows.Native.dll
 PE32+ executable (DLL) (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\GooCanvas-3.0.typelib
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\Efterkommelserne.lnk
 MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
 #