top title background image
flash

Invoices 073.exe

Status: finished
Submission Time: 2020-10-18 08:33:14 +02:00
Malicious
Trojan
Spyware
Evader
Nanocore Quasar

Comments

Tags

  • exe
  • NanoCore
  • Outlook
  • RAT

Details

  • Analysis ID:
    299737
  • API (Web) ID:
    494574
  • Analysis Started:
    2020-10-18 08:33:15 +02:00
  • Analysis Finished:
    2020-10-18 08:47:31 +02:00
  • MD5:
    73001776630fb357ae9f8927e3630d58
  • SHA1:
    43872ed3bc2d020e102cb8da8944796cb7254a4b
  • SHA256:
    572c44582bd57e673a2fffa68259bd82cf37b9f95030e2d8906b588e71d808e0
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 9/48
malicious

IPs

IP Country Detection
1.2.3.4
Australia
3.23.182.29
United States
208.95.112.1
United States
Click to see the 3 hidden entries
3.129.187.220
United States
3.136.65.236
United States
18.220.222.33
United States

Domains

Name IP Detection
3.tcp.ngrok.io
3.129.187.220
ip-api.com
208.95.112.1

URLs

Name Detection
http://www.galapagosdesign.com/DPlease
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
Click to see the 34 hidden entries
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-jones.html
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://www.symauth.com/rpa00
http://ip-api.com/json/
http://www.jiyu-kobo.co.jp/
http://ip-api.com
http://www.founder.com.cn/cn/cThe
http://api.ipify.org/
http://www.fontbureau.com/designers8
http://www.fonts.com
http://www.sandoll.co.kr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.sakkal.com
http://www.tiro.com
http://www.fontbureau.com
http://www.fontbureau.com/designersG
http://freegeoip.net/xml/
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
http://schemas.datacontract.org/2004/07/
http://www.fontbureau.com/designers?
http://ocsp.thawte.com0
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com/designers
http://www.goodfont.co.kr
http://www.symauth.com/cps0(
http://www.carterandcone.coml
http://ip-api.com4
http://www.sajatypeworks.com
http://www.typography.netD
http://www.fontbureau.com/designers/cabarga.htmlN

Dropped files

Name File Type Hashes Detection
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Invoices 073.exe.log
ASCII text, with CRLF line terminators
#
Click to see the 7 hidden entries
C:\Users\user\AppData\Local\Temp\Bin.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Client-built.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
ISO-8859 text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Client-built.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\c7ebace9-d4f3-4576-b8fe-2fe996e42813\Fdf.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\Logs\10-18-2020
data
#