Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SFNM#U007e12345HBV-09876567.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.094150307159493
Filename:	SFNM#U007e12345HBV-09876567.exe
Filesize:	769536
MD5:	54e31b7e289bea078ed769a046c3842e
SHA1:	bf7d74cb34792b258f46e29221c4cbff57bb6979
SHA256:	9cf831ec812b6928eb2fe0c9625da78e8f294d6a5b255ddf894bbbe5b3f7698a
SHA512:	c59ce40f882f2b197a50c5127c49744101bc0f8376d414cd71750859b527377862bbc1d420dc9dae756d1c772c1d99258fd4dc30b7d175cdc3e4e0de168f5b38
SSDEEP:	12288:rJ26PbRFhkQ9Ki7cSFa9dWnSC8tLBL+TqZfs+fOrFCnT08KpfuJ:rBLhii7cl9gSCQV+Tq+FqSY
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................................ ........@.. ....................... ............`................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Detected Nanocore Rat	Remote Access Functionality	Remote Access Software
Machine Learning detection for sample	AV Detection
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara signature match	System Summary
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Detected potential crypto function	System Summary	Archive Collected Data
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
Sample file is different than original file name gathered from version info	System Summary
PE file contains strange resources	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Sample is known by Antivirus	System Summary
Found malware configuration	AV Detection
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
Reads the hosts file	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SFNM#U007e12345HBV-09876567.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SFNM#U007e12345HBV-09876567.exe.log
Category:	dropped
Dump:	SFNM#U007e12345HBV-09876567.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLU84qpE4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7GE4Kx1qE4KE4j:Mgv2HKXwYHKhQnoPtHoxHhAHKzvGHKxx
Size:	1216
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains strange resources	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe
Category:	dropped
Dump:	SFNM~12345HBV-09876567.exe.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\cmd.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.094150307159493
Encrypted:	false
Ssdeep:	12288:rJ26PbRFhkQ9Ki7cSFa9dWnSC8tLBL+TqZfs+fOrFCnT08KpfuJ:rBLhii7cl9gSCQV+Tq+FqSY
Size:	769536
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for dropped file	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Uses reg.exe to modify the Windows registry	System Summary	Modify Registry
Spawns processes	System Summary	Process Injection

C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe:Zone.Identifier
Category:	modified
Dump:	SFNM~12345HBV-09876567.exe_Zone.Identifier.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\cmd.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for dropped file	AV Detection

\Device\Null

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\Null
Category:	dropped
Dump:	Null.11.dr
ID:	dr_5
Target ID:	11
Process:	C:\Windows\SysWOW64\PING.EXE
Type:	ASCII text, with CRLF line terminators
Entropy:	4.623493426598425
Encrypted:	false
Ssdeep:	12:PKMRJpTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeT6:/Q
Size:	1661
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe

"C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe"

Details

Is windows:	false
Is dropped:	false
PID:	588
Target ID:	0
Parent PID:	6020
Name:	SFNM#U007e12345HBV-09876567.exe
Path:	C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe
Commandline:	"C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe"
Size:	769536
MD5:	54E31B7E289BEA078ED769A046C3842E
Time:	07:58:54
Date:	26/09/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe10000
Modulesize:	794624
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected DarkTortilla Crypter	Data Obfuscation
Yara detected Nanocore RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains strange resources	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\SysWOW64\cmd.exe

cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "CHRIST,MARICERTYK" /t REG_SZ /d "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe

Details

Is windows:	true
Is dropped:	false
PID:	5960
Target ID:	1
Parent PID:	588
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "CHRIST,MARICERTYK" /t REG_SZ /d "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	07:59:07
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd90000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 38

Details

Is windows:	true
Is dropped:	false
PID:	6068
Target ID:	3
Parent PID:	5960
Name:	PING.EXE
Class:	system-tools
Path:	C:\Windows\SysWOW64\PING.EXE
Commandline:	ping 127.0.0.1 -n 38
Size:	18944
MD5:	70C24A306F768936563ABDADB9CA9108
Time:	07:59:09
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xde0000
Modulesize:	36864
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Uses ping.exe to check the status of other devices and networks	Networking	System Network Configuration Discovery Remote System Discovery
Uses ping.exe to sleep	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\cmd.exe

cmd" /c ping 127.0.0.1 -n 41 > nul && copy "C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe" "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe" && ping 127.0.0.1 -n 41 > nul && "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe

Details

Is windows:	true
Is dropped:	false
PID:	1888
Target ID:	4
Parent PID:	588
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	cmd" /c ping 127.0.0.1 -n 41 > nul && copy "C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe" "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe" && ping 127.0.0.1 -n 41 > nul && "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	07:59:39
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd90000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 41

Details

Is windows:	true
Is dropped:	false
PID:	4768
Target ID:	9
Parent PID:	1888
Name:	PING.EXE
Class:	system-tools
Path:	C:\Windows\SysWOW64\PING.EXE
Commandline:	ping 127.0.0.1 -n 41
Size:	18944
MD5:	70C24A306F768936563ABDADB9CA9108
Time:	07:59:41
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xde0000
Modulesize:	36864
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Uses ping.exe to check the status of other devices and networks	Networking	System Network Configuration Discovery Remote System Discovery
Uses ping.exe to sleep	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "CHRIST,MARICERTYK" /t REG_SZ /d "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2708
Target ID:	10
Parent PID:	5960
Name:	reg.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\reg.exe
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "CHRIST,MARICERTYK" /t REG_SZ /d "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe"
Size:	59392
MD5:	CEE2A7E57DF2A159A065A34913A055C2
Time:	07:59:50
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xc20000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses reg.exe to modify the Windows registry	System Summary	Modify Registry
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 41

Details

Is windows:	true
Is dropped:	false
PID:	920
Target ID:	11
Parent PID:	1888
Name:	PING.EXE
Class:	system-tools
Path:	C:\Windows\SysWOW64\PING.EXE
Commandline:	ping 127.0.0.1 -n 41
Size:	18944
MD5:	70C24A306F768936563ABDADB9CA9108
Time:	08:00:25
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xde0000
Modulesize:	36864
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Uses ping.exe to check the status of other devices and networks	Networking	System Network Configuration Discovery Remote System Discovery
Uses ping.exe to sleep	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	5928
Target ID:	2
Parent PID:	5960
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	07:59:08
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7c72c0000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	972
Target ID:	7
Parent PID:	1888
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	07:59:41
Date:	26/09/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7c72c0000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

9812.hopto.org

91.193.75.133

http://www.fontbureau.com/designersG

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.fontbureau.com/designers?

unknown

http://www.tiro.com

unknown

http://www.fontbureau.com/designers

unknown

http://ns.adobe.c/g

unknown

http://www.goodfont.co.kr

unknown

http://www.carterandcone.com

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

https://www.google.com

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://fontfabrik.com

unknown

http://www.tiro.comgo

unknown

http://www.jiyu-kobo.co.jp/it-i

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.jiyu-kobo.co.jp/Y0

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://www.sakkal.com

unknown

http://www.jiyu-kobo.co.jp//lA

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.tiro.comslnt

unknown

http://ns.adobe.cobj

unknown

http://www.founder.com.cn/cnz.

unknown

http://www.jiyu-kobo.co.jp/P

unknown

http://www.tiro.comt

unknown

http://www.jiyu-kobo.co.jp/wl

unknown

http://www.jiyu-kobo.co.jp/Rl

unknown

http://www.jiyu-kobo.co.jp/jp/

unknown

http://www.fontbureau.coma

unknown

http://www.jiyu-kobo.co.jp/jp/Yl

unknown

http://www.carterandcone.coml

unknown

http://www.carterandcone.comk

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

http://www.zhongyicts.com.cna

unknown

http://www.jiyu-kobo.co.jp/Y0/

unknown

http://www.monotype.

unknown

http://www.carterandcone.como.-

unknown

http://www.jiyu-kobo.co.jp/Yl

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://www.jiyu-kobo.co.jp/i

unknown

http://www.fontbureau.com/designers8

unknown

http://www.jiyu-kobo.co.jp/6l8

unknown

http://www.jiyu-kobo.co.jp/jp/=l/

unknown

http://www.jiyu-kobo.co.jp/Dl&

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SFNM#U007e12345HBV-09876567.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSFNM#U007e12345HBV-09876567.exe

Files

Processes

URLs

IOC Report
SFNM#U007e12345HBV-09876567.exe