Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

file.exe

Status: finished
Submission Time: 2023-06-02 15:34:14 +02:00
Malicious
Trojan
Evader
Nanocore, zgRAT

Comments

Tags

  • NET
  • exe
  • MSIL
  • x64
  • zgRAT

Details

  • Analysis ID:
    880637
  • API (Web) ID:
    1247617
  • Analysis Started:
    2023-06-02 15:37:42 +02:00
  • Analysis Finished:
    2023-06-02 15:49:25 +02:00
  • MD5:
    8d93c7903bfd5900d72dbeb3b0968508
  • SHA1:
    fad787dd1ebae5cc64aaf7762dd6f49de50adfa7
  • SHA256:
    685522dda736e8c071fcc9dc4b7bb3d58c45f36828eb0b8ca8557e5ec56499ad
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 27/70
malicious
Score: 16/37
malicious
malicious

IPs

IP Country Detection
197.210.227.232
 Nigeria
91.193.75.178
 Serbia

Domains

Name IP Detection
ezemnia3.ddns.net
 197.210.227.232

URLs

Name Detection
ezemnia3.ddns.net
91.193.75.178
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file.exe.log
 CSV text
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
 Non-ISO extended-ASCII text, with no line terminators
 #
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
Click to see the 2 hidden entries
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log
 ASCII text, with CRLF line terminators
 #
\Device\ConDrv
 ASCII text, with CRLF line terminators
 #