Loading ...

Play interactive tourEdit tour

Analysis Report Case.exe

Overview

General Information

Joe Sandbox Version:28.0.0 Lapis Lazuli
Analysis ID:228087
Start date:06.05.2020
Start time:21:39:07
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 15s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Case.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:9
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal100.troj.evad.winEXE@8/5@1/2
EGA Information:
  • Successful, ratio: 25%
HDC Information:Failed
HCA Information:Failed
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
  • Found application associated with file extension: .exe
Warnings:
Show All
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe
  • Excluded IPs from analysis (whitelisted): 2.20.142.209, 2.20.142.210, 104.103.211.166
  • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, e5684.g.akamaiedge.net, audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, site-cdn.onenote.net.edgekey.net
  • Execution Graph export aborted for target MSBuild.exe, PID 4416 because it is empty
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Detection

StrategyScoreRangeReportingWhitelistedThreatDetection
Threshold1000 - 100false
Nanocore
malicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification Spiderchart

Analysis Advice

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook
Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis



Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsScripting11Hidden Files and Directories1Startup Items1Masquerading1Input Capture11Virtualization/Sandbox Evasion2Application Deployment SoftwareInput Capture11Data Encrypted11Uncommonly Used Port1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Replication Through Removable MediaService ExecutionStartup Items1Process Injection112Hidden Files and Directories1Network SniffingProcess Discovery2Remote ServicesData from Removable MediaExfiltration Over Other Network MediumStandard Cryptographic Protocol12Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
External Remote ServicesWindows Management InstrumentationRegistry Run Keys / Startup Folder2Path InterceptionSoftware Packing11Input CaptureApplication Window Discovery1Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationRemote Access Tools1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Drive-by CompromiseScheduled TaskSystem FirmwareDLL Search Order HijackingDisabling Security Tools1Credentials in FilesSecurity Software Discovery11Logon ScriptsInput CaptureData EncryptedStandard Non-Application Layer Protocol1SIM Card SwapPremium SMS Toll Fraud
Exploit Public-Facing ApplicationCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessVirtualization/Sandbox Evasion2Account ManipulationFile and Directory Discovery1Shared WebrootData StagedScheduled TransferStandard Application Layer Protocol2Manipulate Device CommunicationManipulate App Store Rankings or Ratings
Spearphishing LinkGraphical User InterfaceModify Existing ServiceNew ServiceProcess Injection112Brute ForceSystem Information Discovery2Third-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used PortJamming or Denial of ServiceAbuse Accessibility Features
Spearphishing AttachmentScriptingPath InterceptionScheduled TaskDeobfuscate/Decode Files or Information1Two-Factor Authentication InterceptionNetwork SniffingPass the HashEmail CollectionExfiltration Over Command and Control ChannelUncommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Spearphishing via ServiceThird-party SoftwareLogon ScriptsProcess InjectionScripting11Bash HistoryNetwork Service ScanningRemote Desktop ProtocolClipboard DataExfiltration Over Alternative ProtocolStandard Application Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Signature Overview

Click to jump to signature section


AV Detection:

barindex
Found malware configurationShow sources
Source: MSBuild.exe.4932.7.memstrMalware Configuration Extractor: NanoCore {"C2: ": ["206.123.141.99", "255.255.255.255"], "Version: ": "NanoCore Client, Version=1.2.2.0"}
Multi AV Scanner detection for dropped fileShow sources
Source: C:\Users\user\tttracer\BitLockerWizardElev.exeVirustotal: Detection: 25%Perma Link
Yara detected Nanocore RATShow sources
Source: Yara matchFile source: 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORY
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked fileShow sources
Source: 5.2.MSBuild.exe.400000.0.unpackAvira: Label: TR/Dropper.MSIL.Gen7
Source: 7.2.MSBuild.exe.400000.0.unpackAvira: Label: TR/Dropper.MSIL.Gen7

Networking:

barindex
Detected TCP or UDP traffic on non-standard portsShow sources
Source: global trafficTCP traffic: 192.168.2.7:49708 -> 5.9.145.244:50572
Source: global trafficTCP traffic: 192.168.2.7:49711 -> 206.123.141.99:50572
Connects to IPs without corresponding DNS lookupsShow sources
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 205.185.216.10
Source: unknownTCP traffic detected without corresponding DNS query: 205.185.216.42
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 92.122.253.206
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 205.185.216.10
Source: unknownTCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknownTCP traffic detected without corresponding DNS query: 205.185.216.10
Source: unknownTCP traffic detected without corresponding DNS query: 92.122.253.206
Source: unknownTCP traffic detected without corresponding DNS query: 92.122.253.206
Source: unknownTCP traffic detected without corresponding DNS query: 40.90.23.247
Source: unknownTCP traffic detected without corresponding DNS query: 40.90.23.247
Source: unknownTCP traffic detected without corresponding DNS query: 205.185.216.42
Source: unknownTCP traffic detected without corresponding DNS query: 205.185.216.42
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 5.9.145.244
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Source: unknownTCP traffic detected without corresponding DNS query: 206.123.141.99
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: site-cdn.onenote.net
Uses HTTPSShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a raw input device (often for capturing keystrokes)Show sources
Source: MSBuild.exe, 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmpBinary or memory string: RegisterRawInputDevices

E-Banking Fraud:

barindex
Yara detected Nanocore RATShow sources
Source: Yara matchFile source: 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORY
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)Show sources
Source: 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.MSBuild.exe.4dc0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Binary is likely a compiled AutoIt script fileShow sources
Source: Case.exe, 00000000.00000003.646745142.00000000041C0000.00000004.00000001.sdmpString found in binary or memory: C "!CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: Case.exe, 00000000.00000000.643126402.000000000046E000.00000002.00020000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.
Source: Case.exe, 00000000.00000000.643126402.000000000046E000.00000002.00020000.sdmpString found in binary or memory: ?SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: BitLockerWizardElev.exe, 00000006.00000000.738917722.0000000000A8E000.00000002.00020000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.
Source: BitLockerWizardElev.exe, 00000006.00000000.738917722.0000000000A8E000.00000002.00020000.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: Case.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: Case.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Detected potential crypto functionShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA84685_2_00EA8468
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA90685_2_00EA9068
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA38505_2_00EA3850
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EAAD385_2_00EAAD38
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA2FA85_2_00EA2FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA306F5_2_00EA306F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA912F5_2_00EA912F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 5_2_00EA238F5_2_00EA238F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 7_2_056338507_2_05633850
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 7_2_056323A07_2_056323A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 7_2_05632FA87_2_05632FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeCode function: 7_2_0563306F7_2_0563306F
PE file contains strange resourcesShow sources
Source: Case.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Case.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Case.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Case.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BitLockerWizardElev.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BitLockerWizardElev.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BitLockerWizardElev.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BitLockerWizardElev.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Yara signature matchShow sources
Source: 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttracer.url, type: DROPPEDMatched rule: Methodology_Suspicious_Shortcut_Local_URL author = @itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson), description = Detects local script usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019
Source: 5.2.MSBuild.exe.4dc0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.MSBuild.exe.4dc0000.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
.NET source code contains calls to encryption/decryption functionsShow sources
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'CreateDecryptor'
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'TransformFinalBlock'
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'CreateDecryptor'
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'TransformFinalBlock'
.NET source code contains many API calls related to securityShow sources
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Classification labelShow sources
Source: classification engineClassification label: mal100.troj.evad.winEXE@8/5@1/2
Creates files inside the user directoryShow sources
Source: C:\Users\user\Desktop\Case.exeFile created: C:\Users\user\tttracerJump to behavior
Creates mutexesShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{b76cf520-a885-428b-8934-c8f0602cd3d4}
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Executes visual basic scriptsShow sources
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\tttracer\tttracer.vbs'
PE file has an executable .text section and no other executable sectionShow sources
Source: Case.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Parts of this applications are using the .NET runtime (Probably coded in C#)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\497ab1dd171eeef956401f1aeb0b9fec\mscorlib.ni.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\497ab1dd171eeef956401f1aeb0b9fec\mscorlib.ni.dllJump to behavior
Reads ini filesShow sources
Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Reads software policiesShow sources
Source: C:\Users\user\Desktop\Case.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Sample reads its own file contentShow sources
Source: C:\Users\user\Desktop\Case.exeFile read: C:\Users\user\Desktop\Case.exeJump to behavior
Spawns processesShow sources
Source: unknownProcess created: C:\Users\user\Desktop\Case.exe 'C:\Users\user\Desktop\Case.exe'
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\tttracer\tttracer.vbs'
Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe
Source: unknownProcess created: C:\Users\user\tttracer\BitLockerWizardElev.exe 'C:\Users\user\tttracer\BitLockerWizardElev.exe'
Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe
Source: C:\Users\user\Desktop\Case.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exeJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\tttracer\BitLockerWizardElev.exe 'C:\Users\user\tttracer\BitLockerWizardElev.exe' Jump to behavior
Source: C:\Users\user\tttracer\BitLockerWizardElev.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exeJump to behavior
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
Uses Microsoft SilverlightShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
Submission file is bigger than most known malware samplesShow sources
Source: Case.exeStatic file information: File size 1690112 > 1048576
Uses new MSVCR DllsShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
PE file contains a mix of data directories often seen in goodwareShow sources
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
PE file contains a debug data directoryShow sources
Source: Case.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Binary contains paths to debug symbolsShow sources
Source: Binary string: b77a5c561934e089d.pdb source: MSBuild.exe, 00000005.00000002.1065974873.0000000000CAA000.00000004.00000020.sdmp
Source: Binary string: indows\MSBuild.pdbpdbild.pdbl source: MSBuild.exe, 00000005.00000002.1066772365.00000000027F0000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\MSBuild.pdbd source: MSBuild.exe, 00000005.00000002.1066772365.00000000027F0000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.pdb source: MSBuild.exe, 00000005.00000002.1066772365.00000000027F0000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\exe\MSBuild.pdb source: MSBuild.exe, 00000005.00000002.1066772365.00000000027F0000.00000004.00000040.sdmp
Source: Binary string: f:\dd\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb source: MSBuild.exe, 00000005.00000002.1066772365.00000000027F0000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: MSBuild.exe, 00000005.00000002.1070909097.0000000004F30000.00000002.00000001.sdmp
Source: Binary string: C:\Windows\symbols\exe\MSBuild.pdb source: MSBuild.exe, 00000005.00000002.1066772365.00000000027F0000.00000004.00000040.sdmp
PE file contains a valid data directory to section mappingShow sources
Source: Case.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Case.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Case.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Case.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Case.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

barindex
.NET source code contains potential unpackerShow sources
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
.NET source code contains many randomly named methodsShow sources
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.csHigh entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.2.MSBuild.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.csHigh entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.csHigh entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 7.2.MSBuild.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.csHigh entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\Users\user\Desktop\Case.exeFile created: C:\Users\user\tttracer\BitLockerWizardElev.exeJump to dropped file

Boot Survival:

barindex
Creates a start menu entry (Start Menu\Programs\Startup)Show sources
Source: C:\Users\user\Desktop\Case.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttracer.urlJump to behavior
Stores files to the Windows start menu directoryShow sources
Source: C:\Users\user\Desktop\Case.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttracer.urlJump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe:Zone.Identifier read attributes | deleteJump to behavior
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Users\user\Desktop\Case.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Case.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\tttracer\BitLockerWizardElev.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\tttracer\BitLockerWizardElev.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)Show sources
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeWindow / User API: threadDelayed 694Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeWindow / User API: threadDelayed 407Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeWindow / User API: foregroundWindowGot 706Jump to behavior
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 1864Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 2760Thread sleep time: -140000s >= -30000sJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 1228Thread sleep time: -922337203685477s >= -30000sJump to behavior
Sample execution stops while process was sleeping (likely an evasion)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeLast function: Thread delayed
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)Show sources
Source: MSBuild.exe, 00000005.00000002.1071933462.0000000005C40000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: MSBuild.exe, 00000005.00000002.1071933462.0000000005C40000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: MSBuild.exe, 00000005.00000002.1071933462.0000000005C40000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: MSBuild.exe, 00000005.00000002.1066183320.0000000000D36000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000005.00000002.1071933462.0000000005C40000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Queries a list of all running processesShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging:

barindex
Enables debug privilegesShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeProcess token adjusted: DebugJump to behavior
Creates guard pages, often used to prevent reverse engineering and debuggingShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Maps a DLL or memory area into another processShow sources
Source: C:\Users\user\Desktop\Case.exeSection loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe protection: execute and read and writeJump to behavior
Source: C:\Users\user\tttracer\BitLockerWizardElev.exeSection loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe protection: execute and read and writeJump to behavior
Creates a process in suspended mode (likely to inject code)Show sources
Source: C:\Users\user\Desktop\Case.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exeJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\tttracer\BitLockerWizardElev.exe 'C:\Users\user\tttracer\BitLockerWizardElev.exe' Jump to behavior
Source: C:\Users\user\tttracer\BitLockerWizardElev.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exeJump to behavior
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: MSBuild.exe, 00000005.00000002.1068196691.0000000002BD8000.00000004.00000001.sdmpBinary or memory string: Program Manager
Source: MSBuild.exe, 00000005.00000002.1066648632.00000000012C0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000005.00000002.1066648632.00000000012C0000.00000002.00000001.sdmpBinary or memory string: Progman
Source: MSBuild.exe, 00000005.00000002.1068196691.0000000002BD8000.00000004.00000001.sdmpBinary or memory string: Program Manager0
Source: Case.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: MSBuild.exe, 00000005.00000002.1066391142.0000000000D62000.00000004.00000020.sdmpBinary or memory string: Program Managernels.ContextBindingElementImporter, system.workflowservices,
Source: MSBuild.exe, 00000005.00000002.1066648632.00000000012C0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: MSBuild.exe, 00000005.00000002.1066101064.0000000000D0D000.00000004.00000020.sdmpBinary or memory string: qProgram Manager
Source: MSBuild.exe, 00000005.00000002.1066648632.00000000012C0000.00000002.00000001.sdmpBinary or memory string: =Program Managerb

Language, Device and Operating System Detection:

barindex
Queries the cryptographic machine GUIDShow sources
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RATShow sources
Source: Yara matchFile source: 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORY
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Detected Nanocore RatShow sources
Source: MSBuild.exe, 00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: MSBuild.exe, 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RATShow sources
Source: Yara matchFile source: 00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4416, type: MEMORY
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 4932, type: MEMORY
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.5390000.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 5.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

Malware Configuration

Threatname: NanoCore

{"C2: ": ["206.123.141.99", "255.255.255.255"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Simulations

Behavior and APIs

TimeTypeDescription
21:39:39AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttracer.url
21:39:55API Interceptor800x Sleep call for process: MSBuild.exe modified

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\tttracer\BitLockerWizardElev.exe25%VirustotalBrowse

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
5.2.MSBuild.exe.400000.0.unpack100%AviraTR/Dropper.MSIL.Gen7Download File
7.2.MSBuild.exe.400000.0.unpack100%AviraTR/Dropper.MSIL.Gen7Download File

Domains

SourceDetectionScannerLabelLink
site-cdn.onenote.net0%VirustotalBrowse

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttracer.urlMethodology_Suspicious_Shortcut_Local_URLDetects local script usage for .URL persistence@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)
  • 0x13:$file: URL=file:///
  • 0x0:$url_explicit: [InternetShortcut]

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
    00000007.00000002.830470924.0000000004490000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
    • 0x4a3dd:$a: NanoCore
    • 0x4a436:$a: NanoCore
    • 0x4a473:$a: NanoCore
    • 0x4a4ec:$a: NanoCore
    • 0x5db97:$a: NanoCore
    • 0x5dbac:$a: NanoCore
    • 0x5dbe1:$a: NanoCore
    • 0x7665b:$a: NanoCore
    • 0x76670:$a: NanoCore
    • 0x766a5:$a: NanoCore
    • 0x4a43f:$b: ClientPlugin
    • 0x4a47c:$b: ClientPlugin
    • 0x4ad7a:$b: ClientPlugin
    • 0x4ad87:$b: ClientPlugin
    • 0x5d953:$b: ClientPlugin
    • 0x5d96e:$b: ClientPlugin
    • 0x5d99e:$b: ClientPlugin
    • 0x5dbb5:$b: ClientPlugin
    • 0x5dbea:$b: ClientPlugin
    • 0x76417:$b: ClientPlugin
    • 0x76432:$b: ClientPlugin
    00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0xe75:$x1: NanoCore.ClientPluginHost
    • 0xe8f:$x2: IClientNetworkHost
    00000005.00000002.1070759629.0000000004DC0000.00000004.00000001.sdmpNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
    • 0xe75:$x2: NanoCore.ClientPluginHost
    • 0x1261:$s3: PipeExists
    • 0x1136:$s4: PipeCreated
    • 0xeb0:$s5: IClientLoggingHost
    00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0xf7ad:$x1: NanoCore.ClientPluginHost
    • 0xf7da:$x2: IClientNetworkHost
    00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmpNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
    • 0xf7ad:$x2: NanoCore.ClientPluginHost
    • 0x10888:$s4: PipeCreated
    • 0xf7c7:$s5: IClientLoggingHost
    00000005.00000002.1071456929.0000000005390000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
      00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
      • 0xff8d:$x1: NanoCore.ClientPluginHost
      • 0xffca:$x2: IClientNetworkHost
      • 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
      00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
        00000005.00000002.1064842916.0000000000402000.00000040.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
        • 0xfcf5:$a: NanoCore
        • 0xfd05:$a: NanoCore
        • 0xff39:$a: NanoCore
        • 0xff4d:$a: NanoCore
        • 0xff8d:$a: NanoCore
        • 0xfd54:$b: ClientPlugin
        • 0xff56:$b: ClientPlugin
        • 0xff96:$b: ClientPlugin
        • 0xfe7b:$c: ProjectData
        • 0x10882:$d: DESCrypto
        • 0x1824e:$e: KeepAlive
        • 0x1623c:$g: LogClientMessage
        • 0x12437:$i: get_Connected
        • 0x10bb8:$j: #=q
        • 0x10be8:$j: #=q
        • 0x10c04:$j: #=q
        • 0x10c34:$j: #=q
        • 0x10c50:$j: #=q
        • 0x10c6c:$j: #=q
        • 0x10c9c:$j: #=q
        • 0x10cb8:$j: #=q
        00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
          00000007.00000002.830375197.0000000003490000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
          • 0x24a53:$a: NanoCore
          • 0x24aac:$a: NanoCore
          • 0x24ae9:$a: NanoCore
          • 0x24b62:$a: NanoCore
          • 0x24ab5:$b: ClientPlugin
          • 0x24af2:$b: ClientPlugin
          • 0x253f0:$b: ClientPlugin
          • 0x253fd:$b: ClientPlugin
          • 0x1c2a3:$e: KeepAlive
          • 0x24f3d:$g: LogClientMessage
          • 0x24ebd:$i: get_Connected
          • 0x16a85:$j: #=q
          • 0x16ab5:$j: #=q
          • 0x16af1:$j: #=q
          • 0x16b19:$j: #=q
          • 0x16b49:$j: #=q
          • 0x16b79:$j: #=q
          • 0x16ba9:$j: #=q
          • 0x16bd9:$j: #=q
          • 0x16bf5:$j: #=q
          • 0x16c25:$j: #=q
          00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
            00000005.00000002.1069377121.0000000003B87000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
            • 0x33dd:$a: NanoCore
            • 0x3436:$a: NanoCore
            • 0x3473:$a: NanoCore
            • 0x34ec:$a: NanoCore
            • 0x16b97:$a: NanoCore
            • 0x16bac:$a: NanoCore
            • 0x16be1:$a: NanoCore
            • 0x2f65b:$a: NanoCore
            • 0x2f670:$a: NanoCore
            • 0x2f6a5:$a: NanoCore
            • 0x343f:$b: ClientPlugin
            • 0x347c:$b: ClientPlugin
            • 0x3d7a:$b: ClientPlugin
            • 0x3d87:$b: ClientPlugin
            • 0x16953:$b: ClientPlugin
            • 0x1696e:$b: ClientPlugin
            • 0x1699e:$b: ClientPlugin
            • 0x16bb5:$b: ClientPlugin
            • 0x16bea:$b: ClientPlugin
            • 0x2f417:$b: ClientPlugin
            • 0x2f432:$b: ClientPlugin
            00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
            • 0xff8d:$x1: NanoCore.ClientPluginHost
            • 0xffca:$x2: IClientNetworkHost
            • 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
            00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
              00000007.00000002.827384127.0000000000402000.00000040.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
              • 0xfcf5:$a: NanoCore
              • 0xfd05:$a: NanoCore
              • 0xff39:$a: NanoCore
              • 0xff4d:$a: NanoCore
              • 0xff8d:$a: NanoCore
              • 0xfd54:$b: ClientPlugin
              • 0xff56:$b: ClientPlugin
              • 0xff96:$b: ClientPlugin
              • 0xfe7b:$c: ProjectData
              • 0x10882:$d: DESCrypto
              • 0x1824e:$e: KeepAlive
              • 0x1623c:$g: LogClientMessage
              • 0x12437:$i: get_Connected
              • 0x10bb8:$j: #=q
              • 0x10be8:$j: #=q
              • 0x10c04:$j: #=q
              • 0x10c34:$j: #=q
              • 0x10c50:$j: #=q
              • 0x10c6c:$j: #=q
              • 0x10c9c:$j: #=q
              • 0x10cb8:$j: #=q
              Process Memory Space: MSBuild.exe PID: 4416Nanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
              • 0x49f2b:$x1: NanoCore.ClientPluginHost
              • 0x5c1b6:$x1: NanoCore.ClientPluginHost
              • 0x93a96:$x1: NanoCore.ClientPluginHost
              • 0xad543:$x1: NanoCore.ClientPluginHost
              • 0x173b05:$x1: NanoCore.ClientPluginHost
              • 0x1796c4:$x1: NanoCore.ClientPluginHost
              • 0x18a531:$x1: NanoCore.ClientPluginHost
              • 0x49f51:$x2: IClientNetworkHost
              • 0x5c1dc:$x2: IClientNetworkHost
              • 0x93adb:$x2: IClientNetworkHost
              • 0xad5a4:$x2: IClientNetworkHost
              • 0x173b2b:$x2: IClientNetworkHost
              • 0x179709:$x2: IClientNetworkHost
              • 0x18a576:$x2: IClientNetworkHost
              • 0xb29a9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
              • 0xc091b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
              Process Memory Space: MSBuild.exe PID: 4416JoeSecurity_NanocoreYara detected Nanocore RATJoe Security
                Process Memory Space: MSBuild.exe PID: 4416NanoCoreunknown Kevin Breen <kevin@techanarchy.net>
                • 0x49e1d:$a: NanoCore
                • 0x49ebe:$a: NanoCore
                • 0x49f2b:$a: NanoCore
                • 0x49fec:$a: NanoCore
                • 0x4aebd:$a: NanoCore
                • 0x4af10:$a: NanoCore
                • 0x4af49:$a: NanoCore
                • 0x4afbc:$a: NanoCore
                • 0x5c0a8:$a: NanoCore
                • 0x5c149:$a: NanoCore
                • 0x5c1b6:$a: NanoCore
                • 0x5c277:$a: NanoCore
                • 0x5d148:$a: NanoCore
                • 0x5d19b:$a: NanoCore
                • 0x5d1d4:$a: NanoCore
                • 0x5d247:$a: NanoCore
                • 0x8caae:$a: NanoCore
                • 0x93a10:$a: NanoCore
                • 0x93a3d:$a: NanoCore
                • 0x93a96:$a: NanoCore
                • 0x9b2a5:$a: NanoCore
                Process Memory Space: MSBuild.exe PID: 4932Nanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
                • 0x7700:$x1: NanoCore.ClientPluginHost
                • 0xd2bf:$x1: NanoCore.ClientPluginHost
                • 0x1e12c:$x1: NanoCore.ClientPluginHost
                • 0x4447f:$x1: NanoCore.ClientPluginHost
                • 0x510f6:$x1: NanoCore.ClientPluginHost
                • 0x7726:$x2: IClientNetworkHost
                • 0xd304:$x2: IClientNetworkHost
                • 0x1e171:$x2: IClientNetworkHost
                • 0x444a5:$x2: IClientNetworkHost
                • 0x51157:$x2: IClientNetworkHost
                • 0x5655c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
                • 0x644ce:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
                Process Memory Space: MSBuild.exe PID: 4932JoeSecurity_NanocoreYara detected Nanocore RATJoe Security
                  Process Memory Space: MSBuild.exe PID: 4932NanoCoreunknown Kevin Breen <kevin@techanarchy.net>
                  • 0x75f2:$a: NanoCore
                  • 0x7693:$a: NanoCore
                  • 0x7700:$a: NanoCore
                  • 0x77c1:$a: NanoCore
                  • 0x8692:$a: NanoCore
                  • 0x86e5:$a: NanoCore
                  • 0x871e:$a: NanoCore
                  • 0x8791:$a: NanoCore
                  • 0xd239:$a: NanoCore
                  • 0xd266:$a: NanoCore
                  • 0xd2bf:$a: NanoCore
                  • 0x14ace:$a: NanoCore
                  • 0x14ae1:$a: NanoCore
                  • 0x14b13:$a: NanoCore
                  • 0x1e0a6:$a: NanoCore
                  • 0x1e0d3:$a: NanoCore
                  • 0x1e12c:$a: NanoCore
                  • 0x2593b:$a: NanoCore
                  • 0x2594e:$a: NanoCore
                  • 0x25980:$a: NanoCore
                  • 0x37989:$a: NanoCore

                  Unpacked PEs

                  SourceRuleDescriptionAuthorStrings
                  5.2.MSBuild.exe.4dc0000.2.raw.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
                  • 0xe75:$x1: NanoCore.ClientPluginHost
                  • 0xe8f:$x2: IClientNetworkHost
                  5.2.MSBuild.exe.4dc0000.2.raw.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
                  • 0xe75:$x2: NanoCore.ClientPluginHost
                  • 0x1261:$s3: PipeExists
                  • 0x1136:$s4: PipeCreated
                  • 0xeb0:$s5: IClientLoggingHost
                  5.2.MSBuild.exe.5390000.4.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
                  • 0xd9ad:$x1: NanoCore.ClientPluginHost
                  • 0xd9da:$x2: IClientNetworkHost
                  5.2.MSBuild.exe.5390000.4.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
                  • 0xd9ad:$x2: NanoCore.ClientPluginHost
                  • 0xea88:$s4: PipeCreated
                  • 0xd9c7:$s5: IClientLoggingHost
                  5.2.MSBuild.exe.5390000.4.unpackJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
                    5.2.MSBuild.exe.5390000.4.raw.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
                    • 0xf7ad:$x1: NanoCore.ClientPluginHost
                    • 0xf7da:$x2: IClientNetworkHost
                    5.2.MSBuild.exe.5390000.4.raw.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
                    • 0xf7ad:$x2: NanoCore.ClientPluginHost
                    • 0x10888:$s4: PipeCreated
                    • 0xf7c7:$s5: IClientLoggingHost
                    5.2.MSBuild.exe.5390000.4.raw.unpackJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
                      5.2.MSBuild.exe.400000.0.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
                      • 0x1018d:$x1: NanoCore.ClientPluginHost
                      • 0x101ca:$x2: IClientNetworkHost
                      • 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
                      5.2.MSBuild.exe.400000.0.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
                      • 0xff05:$x1: NanoCore Client.exe
                      • 0x1018d:$x2: NanoCore.ClientPluginHost
                      • 0x117c6:$s1: PluginCommand
                      • 0x117ba:$s2: FileCommand
                      • 0x1266b:$s3: PipeExists
                      • 0x18422:$s4: PipeCreated
                      • 0x101b7:$s5: IClientLoggingHost
                      5.2.MSBuild.exe.400000.0.unpackJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
                        5.2.MSBuild.exe.400000.0.unpackNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
                        • 0xfef5:$a: NanoCore
                        • 0xff05:$a: NanoCore
                        • 0x10139:$a: NanoCore
                        • 0x1014d:$a: NanoCore
                        • 0x1018d:$a: NanoCore
                        • 0xff54:$b: ClientPlugin
                        • 0x10156:$b: ClientPlugin
                        • 0x10196:$b: ClientPlugin
                        • 0x1007b:$c: ProjectData
                        • 0x10a82:$d: DESCrypto
                        • 0x1844e:$e: KeepAlive
                        • 0x1643c:$g: LogClientMessage
                        • 0x12637:$i: get_Connected
                        • 0x10db8:$j: #=q
                        • 0x10de8:$j: #=q
                        • 0x10e04:$j: #=q
                        • 0x10e34:$j: #=q
                        • 0x10e50:$j: #=q
                        • 0x10e6c:$j: #=q
                        • 0x10e9c:$j: #=q
                        • 0x10eb8:$j: #=q
                        7.2.MSBuild.exe.400000.0.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
                        • 0x1018d:$x1: NanoCore.ClientPluginHost
                        • 0x101ca:$x2: IClientNetworkHost
                        • 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
                        7.2.MSBuild.exe.400000.0.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
                        • 0xff05:$x1: NanoCore Client.exe
                        • 0x1018d:$x2: NanoCore.ClientPluginHost
                        • 0x117c6:$s1: PluginCommand
                        • 0x117ba:$s2: FileCommand
                        • 0x1266b:$s3: PipeExists
                        • 0x18422:$s4: PipeCreated
                        • 0x101b7:$s5: IClientLoggingHost
                        7.2.MSBuild.exe.400000.0.unpackJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
                          7.2.MSBuild.exe.400000.0.unpackNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
                          • 0xfef5:$a: NanoCore
                          • 0xff05:$a: NanoCore
                          • 0x10139:$a: NanoCore
                          • 0x1014d:$a: NanoCore
                          • 0x1018d:$a: NanoCore
                          • 0xff54:$b: ClientPlugin
                          • 0x10156:$b: ClientPlugin
                          • 0x10196:$b: ClientPlugin
                          • 0x1007b:$c: ProjectData
                          • 0x10a82:$d: DESCrypto
                          • 0x1844e:$e: KeepAlive
                          • 0x1643c:$g: LogClientMessage
                          • 0x12637:$i: get_Connected
                          • 0x10db8:$j: #=q
                          • 0x10de8:$j: #=q
                          • 0x10e04:$j: #=q
                          • 0x10e34:$j: #=q
                          • 0x10e50:$j: #=q
                          • 0x10e6c:$j: #=q
                          • 0x10e9c:$j: #=q
                          • 0x10eb8:$j: #=q

                          Sigma Overview


                          System Summary:

                          barindex
                          Sigma detected: Drops script at startup locationShow sources
                          Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Case.exe, ProcessId: 4124, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tttracer.url
                          Sigma detected: NanoCoreShow sources
                          Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe, ProcessId: 4416, TargetFilename: C:\Users\user\AppData\Roaming\59407D34-C8C5-44DF-A766-BA8A11CB1CB0\run.dat

                          Joe Sandbox View / Context

                          IPs

                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                          206.123.141.99Court Case.jarGet hashmaliciousBrowse

                            Domains

                            No context

                            ASN

                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                            unknownhttp://internetslang.comGet hashmaliciousBrowse
                            • 64.74.236.127
                            #U260e#Ufe0fVM4 May, 2020_6446-172.htmGet hashmaliciousBrowse
                            • 5.160.139.86
                            https://docs.google.com/uc?export=download&id=18WkaU3uqJjGddX0C7rySxkEUcexcKAGdGet hashmaliciousBrowse
                            • 216.58.215.225
                            1vInNmZSuC.exeGet hashmaliciousBrowse
                            • 99.80.110.198
                            #Ud83d#Udd0a#Ud83d#Udcde +44 7912-392561 audio.htmGet hashmaliciousBrowse
                            • 172.94.114.82
                            Doc-7988.xlsGet hashmaliciousBrowse
                            • 52.114.77.33
                            http://govermentbids.com/Get hashmaliciousBrowse
                            • 162.247.242.18
                            https://disadent.com/#safety@vueling.comGet hashmaliciousBrowse
                            • 95.216.33.133
                            Your JLR_v2.1.1_apkpure.com.apkGet hashmaliciousBrowse
                            • 35.190.88.7
                            com Audio_46834.htmGet hashmaliciousBrowse
                            • 13.224.197.30
                            https://enlacegc.com/workmonde/ab/Get hashmaliciousBrowse
                            • 192.185.87.173
                            https://centralvalleyfiredistrict-my.sharepoint.com/:o:/g/personal/cdahlhauser_centralvalleyfire_com/ErfN3NtAi9JIpOFG7kMZJAoBTifDzDUf4sQxD8R-E8l-yw?e=j0vdYsGet hashmaliciousBrowse
                            • 52.114.132.20
                            https://t.co/KyP7ybSwPVGet hashmaliciousBrowse
                            • 18.195.128.171
                            https://insights.vertrax.com/-temporary-slug-278e561b-20b5-4b0a-be9c-c148d0c330edGet hashmaliciousBrowse
                            • 69.39.238.8
                            EmploymentVerification_177011840_05052020.vbsGet hashmaliciousBrowse
                            • 195.154.61.18
                            Nuovo Server - Servizi (172.16.0.64) - collegamento.exeGet hashmaliciousBrowse
                            • 172.16.0.64
                            http://complainceskey.comGet hashmaliciousBrowse
                            • 104.16.132.229
                            https://dt3.uk/wp-admin/files/confirmation/Office365htmlGet hashmaliciousBrowse
                            • 185.26.149.40
                            https://atrontx-my.sharepoint.com/:u:/g/personal/cloving_atrongroup_com/EX3fRIR1zH1Kr7UUT4j1FlgBg1gqmsItMcHYVYKMlP7soA?e=dQ4tweGet hashmaliciousBrowse
                            • 52.114.74.43
                            https://redsea7.comGet hashmaliciousBrowse
                            • 103.102.44.182
                            WANSECURITY-WANSecurityIncUSinvoice_34315R18.jarGet hashmaliciousBrowse
                            • 172.111.213.60
                            invoice_34315R18.jarGet hashmaliciousBrowse
                            • 172.111.213.60
                            invoice_DR6BV549S.mhtmlGet hashmaliciousBrowse
                            • 172.111.213.60

                            JA3 Fingerprints

                            No context

                            Dropped Files

                            No context

                            Screenshots