Edit tour

Windows Analysis Report
SFNM#U007e12345HBV-09876567.exe

Overview

General Information

Sample Name:	SFNM#U007e12345HBV-09876567.exe
Analysis ID:	709714
MD5:	54e31b7e289bea078ed769a046c3842e
SHA1:	bf7d74cb34792b258f46e29221c4cbff57bb6979
SHA256:	9cf831ec812b6928eb2fe0c9625da78e8f294d6a5b255ddf894bbbe5b3f7698a
Infos:

Detection

Nanocore, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected DarkTortilla Crypter

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected Nanocore Rat

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Machine Learning detection for sample

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

.NET source code contains method to dynamically call methods (often used by packers)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Creates autostart registry keys with suspicious names

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Uses reg.exe to modify the Windows registry

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

SFNM#U007e12345HBV-09876567.exe (PID: 588 cmdline: "C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe" MD5: 54E31B7E289BEA078ED769A046C3842E)

cmd.exe (PID: 5960 cmdline: cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "CHRIST,MARICERTYK" /t REG_SZ /d "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 6068 cmdline: ping 127.0.0.1 -n 38 MD5: 70C24A306F768936563ABDADB9CA9108)

reg.exe (PID: 2708 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "CHRIST,MARICERTYK" /t REG_SZ /d "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe" MD5: CEE2A7E57DF2A159A065A34913A055C2)

cmd.exe (PID: 1888 cmdline: cmd" /c ping 127.0.0.1 -n 41 > nul && copy "C:\Users\user\Desktop\SFNM#U007e12345HBV-09876567.exe" "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe" && ping 127.0.0.1 -n 41 > nul && "C:\Users\user\Favorites\SFNM~12345HBV-09876567.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PING.EXE (PID: 4768 cmdline: ping 127.0.0.1 -n 41 MD5: 70C24A306F768936563ABDADB9CA9108)

PING.EXE (PID: 920 cmdline: ping 127.0.0.1 -n 41 MD5: 70C24A306F768936563ABDADB9CA9108)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "2c83c052-5c8c-4da8-8e82-9c1bb5be", "Group": "9812", "Domain1": "9812.hopto.org", "Domain2": "91.193.75.133", "Port": 9812, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.420676515.0000000002643000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.425643462.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x43e7f:$x1: NanoCore.ClientPluginHost 0x76c6f:$x1: NanoCore.ClientPluginHost 0xa9a4f:$x1: NanoCore.ClientPluginHost 0x43ebc:$x2: IClientNetworkHost 0x76cac:$x2: IClientNetworkHost 0xa9a8c:$x2: IClientNetworkHost 0x479ef:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7a7df:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xad5bf:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.425643462.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.425643462.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.425643462.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x43be7:$a: NanoCore 0x43bf7:$a: NanoCore 0x43e2b:$a: NanoCore 0x43e3f:$a: NanoCore 0x43e7f:$a: NanoCore 0x769d7:$a: NanoCore 0x769e7:$a: NanoCore 0x76c1b:$a: NanoCore 0x76c2f:$a: NanoCore 0x76c6f:$a: NanoCore 0xa97b7:$a: NanoCore 0xa97c7:$a: NanoCore 0xa99fb:$a: NanoCore 0xa9a0f:$a: NanoCore 0xa9a4f:$a: NanoCore 0x43c46:$b: ClientPlugin 0x43e48:$b: ClientPlugin 0x43e88:$b: ClientPlugin 0x76a36:$b: ClientPlugin 0x76c38:$b: ClientPlugin 0x76c78:$b: ClientPlugin
00000000.00000002.425643462.00000000036FB000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x43e7f:$a1: NanoCore.ClientPluginHost 0x76c6f:$a1: NanoCore.ClientPluginHost 0xa9a4f:$a1: NanoCore.ClientPluginHost 0x43e3f:$a2: NanoCore.ClientPlugin 0x76c2f:$a2: NanoCore.ClientPlugin 0xa9a0f:$a2: NanoCore.ClientPlugin 0x45d98:$b1: get_BuilderSettings 0x78b88:$b1: get_BuilderSettings 0xab968:$b1: get_BuilderSettings 0x43c9b:$b2: ClientLoaderForm.resources 0x76a8b:$b2: ClientLoaderForm.resources 0xa986b:$b2: ClientLoaderForm.resources 0x454b8:$b3: PluginCommand 0x782a8:$b3: PluginCommand 0xab088:$b3: PluginCommand 0x43e70:$b4: IClientAppHost 0x76c60:$b4: IClientAppHost 0xa9a40:$b4: IClientAppHost 0x4e2f0:$b5: GetBlockHash 0x810e0:$b5: GetBlockHash 0xb3ec0:$b5: GetBlockHash
00000000.00000002.422453842.000000000293F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.426014225.00000000037FA000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x105ef:$x1: NanoCore.ClientPluginHost 0x433bd:$x1: NanoCore.ClientPluginHost 0x1062c:$x2: IClientNetworkHost 0x433fa:$x2: IClientNetworkHost 0x1415f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x46f2d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.426014225.00000000037FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.426014225.00000000037FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.426014225.00000000037FA000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10357:$a: NanoCore 0x10367:$a: NanoCore 0x1059b:$a: NanoCore 0x105af:$a: NanoCore 0x105ef:$a: NanoCore 0x43125:$a: NanoCore 0x43135:$a: NanoCore 0x43369:$a: NanoCore 0x4337d:$a: NanoCore 0x433bd:$a: NanoCore 0x103b6:$b: ClientPlugin 0x105b8:$b: ClientPlugin 0x105f8:$b: ClientPlugin 0x43184:$b: ClientPlugin 0x43386:$b: ClientPlugin 0x433c6:$b: ClientPlugin 0x104dd:$c: ProjectData 0x432ab:$c: ProjectData 0x10ee4:$d: DESCrypto 0x43cb2:$d: DESCrypto 0x188b0:$e: KeepAlive
00000000.00000002.426014225.00000000037FA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x105ef:$a1: NanoCore.ClientPluginHost 0x433bd:$a1: NanoCore.ClientPluginHost 0x105af:$a2: NanoCore.ClientPlugin 0x4337d:$a2: NanoCore.ClientPlugin 0x12508:$b1: get_BuilderSettings 0x452d6:$b1: get_BuilderSettings 0x1040b:$b2: ClientLoaderForm.resources 0x431d9:$b2: ClientLoaderForm.resources 0x11c28:$b3: PluginCommand 0x449f6:$b3: PluginCommand 0x105e0:$b4: IClientAppHost 0x433ae:$b4: IClientAppHost 0x1aa60:$b5: GetBlockHash 0x4d82e:$b5: GetBlockHash 0x12b60:$b6: AddHostEntry 0x4592e:$b6: AddHostEntry 0x16853:$b7: LogClientException 0x49621:$b7: LogClientException 0x12acd:$b8: PipeExists 0x4589b:$b8: PipeExists 0x10619:$b9: IClientLoggingHost
Process Memory Space: SFNM#U007e12345HBV-09876567.exe PID: 588	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4af40:$x1: NanoCore.ClientPluginHost 0xfe97e:$x1: NanoCore.ClientPluginHost 0x4af7d:$x2: IClientNetworkHost 0xfe9bb:$x2: IClientNetworkHost 0x4ea6e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x59af4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x65c9a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x70fd3:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1024ac:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10d532:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1196d7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: SFNM#U007e12345HBV-09876567.exe PID: 588	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: SFNM#U007e12345HBV-09876567.exe PID: 588	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: SFNM#U007e12345HBV-09876567.exe PID: 588	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4ac0d:$a: NanoCore 0x4ac1d:$a: NanoCore 0x4acdc:$a: NanoCore 0x4aceb:$a: NanoCore 0x4aeec:$a: NanoCore 0x4af00:$a: NanoCore 0x4af40:$a: NanoCore 0x5615e:$a: NanoCore 0x56170:$a: NanoCore 0x561ac:$a: NanoCore 0x62304:$a: NanoCore 0x62316:$a: NanoCore 0x62352:$a: NanoCore 0x6d63d:$a: NanoCore 0x6d64f:$a: NanoCore 0x6d68b:$a: NanoCore 0xfe64b:$a: NanoCore 0xfe65b:$a: NanoCore 0xfe71a:$a: NanoCore 0xfe729:$a: NanoCore 0xfe92a:$a: NanoCore
Process Memory Space: SFNM#U007e12345HBV-09876567.exe PID: 588	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x4af40:$a1: NanoCore.ClientPluginHost 0xfe97e:$a1: NanoCore.ClientPluginHost 0x4af00:$a2: NanoCore.ClientPlugin 0xfe93e:$a2: NanoCore.ClientPlugin 0x4ce17:$b1: get_BuilderSettings 0x100855:$b1: get_BuilderSettings 0x4acc1:$b2: ClientLoaderForm.resources 0xfe6ff:$b2: ClientLoaderForm.resources 0x4c537:$b3: PluginCommand 0xfff75:$b3: PluginCommand 0x4af31:$b4: IClientAppHost 0xfe96f:$b4: IClientAppHost 0x5536a:$b5: GetBlockHash 0x108da8:$b5: GetBlockHash 0x4d46f:$b6: AddHostEntry 0x5858e:$b6: AddHostEntry 0x64734:$b6: AddHostEntry 0x6fa6d:$b6: AddHostEntry 0x100ead:$b6: AddHostEntry 0x10bfcc:$b6: AddHostEntry 0x118171:$b6: AddHostEntry
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SFNM#U007e12345HBV-09876567.exe.372ecf2.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.SFNM#U007e12345HBV-09876567.exe.372ecf2.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.SFNM#U007e12345HBV-09876567.exe.372ecf2.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.SFNM#U007e12345HBV-09876567.exe.372ecf2.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.SFNM#U007e12345HBV-09876567.exe.372ecf2.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.2.SFNM#U007e12345HBV-09876567.exe.372ecf2.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SFNM#U007e12345HBV-09876567.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Signatures

Memory Dumps

Unpacked PEs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SFNM#U007e12345HBV-09876567.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Signatures

Memory Dumps

Unpacked PEs

Windows Analysis Report
SFNM#U007e12345HBV-09876567.exe