Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

H1GC5Z4C39PAYMENTRECEIPT.exe

Status: finished
Submission Time: 2021-10-23 20:51:09 +02:00
Malicious
Trojan
Exploiter
Evader
Nanocore

Comments

Tags

  • exe
  • NanoCore
  • RAT

Details

  • Analysis ID:
    508131
  • API (Web) ID:
    875698
  • Analysis Started:
    2021-10-23 20:51:10 +02:00
  • Analysis Finished:
    2021-10-23 21:05:33 +02:00
  • MD5:
    33c1ebab9ea309a6c217404373190bea
  • SHA1:
    8349bdbc19687cf3baf7167562fc7e5febc0b088
  • SHA256:
    8948abf5e6d357805d72b6d05015e70c705e2a7bbd58704d63fcdb1a9b2116dd
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Full Report Management Report IOC Report
clean
0/100

IPs

IP Country Detection
162.159.130.233
 United States
162.159.129.233
 United States
185.140.53.3
 Sweden
Click to see the 1 hidden entries
162.159.135.233
 United States

Domains

Name IP Detection
kenimaf.duckdns.org
 185.140.53.3
cdn.discordapp.com
 162.159.135.233

URLs

Name Detection
kenimaf.duckdns.org
https://dev.virtualearth.net/REST/v1/Locations
https://cdn.discordapp.com/attachments/8
Click to see the 60 hidden entries
https://dev.virtualearth.net/REST/v1/Routes/
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
https://www.roblox.com/develop
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
https://dev.virtualearth.net/REST/v1/Transit/Stops/
http://crl.ver)
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
http://upx.sf.net
https://www.tiktok.com/legal/report/feedback
https://cdn.discordapp.com
https://corp.roblox.com/parents/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
https://dev.virtualearth.net/mapcontrol/logging.ashx
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
https://www.disneyplus.com/legal/privacy-policy
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
https://dynamic.t
https://dev.virtualearth.net/REST/v1/Routes/Transit
https://disneyplus.com/legal.
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
https://www.roblox.com/info/privacy
http://www.g5e.com/termsofservice
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
https://dev.ditu.live.com/REST/v1/Locations
http://help.disneyplus.com.
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
https://dev.virtualearth.net/REST/v1/Routes/Driving
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
https://corp.roblox.com/contact/
https://t0.tiles.ditu.live.com/tiles/gen
https://dev.virtualearth.net/REST/v1/Routes/Walking
https://cdn.discordapp.com/attachments/893177342426509335/901499557731528784/A77E94C1.jpg
https://cdn.discordapp.com/attachments/893177342426509335/901499560617185340/D5FE4DAE.jpg&0qep
http://metro.mahapps.com/winfx/xaml/iconpacks
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
http://google.com
http://metro.mahapps.com/winfx/xaml/controls
http://templarian.com/
https://dev.ditu.live.com/mapcontrol/logging.ashx
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
https://cdn.discordapp.com/attachments/893177342426509335/901499560617185340/D5FE4DAE.jpg
http://www.g5e.com/G5_End_User_License_Supplemental_Terms
https://dev.virtualearth.net/REST/v1/Transit/Schedules/
https://appexmapsappupdate.blob.core.windows.net
https://en.help.roblox.com/hc/en-us
https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.bingmapsportal.com
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
http://creativecommons.org/licenses/by-nd/3.0/
https://www.disneyplus.com/legal/your-california-privacy-rights
https://support.g5e.com/hc/en-us/categories/360002985040-Hidden-City-Hidden-Object-Adventure
https://dev.ditu.live.com/REST/v1/Routes/

Dropped files

Name File Type Hashes Detection
C:\Program Files\Common Files\system\???????????????\svchost.exe:Zone.Identifier
 ASCII text, with CRLF line terminators
 #
C:\Program Files\Common Files\system\???????????????\svchost.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
 Non-ISO extended-ASCII text, with no line terminators
 #
Click to see the 42 hidden entries
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vh53n2qx.mea.psm1
 very short file (no magic)
 #
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
 MS Windows registry file, NT/2000 or above
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjiehb3u.k1i.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxi53fh1.cqo.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
 data
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak
 data
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
 data
 #
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
 data
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.2RJ4LWAD.20211023205247.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.5JXpHlSM.20211023205209.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.7RmwsCf9.20211023205232.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.GaWLd4X5.20211023205207.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.e3wQngm5.20211023205248.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.fI18M4vr.20211023205229.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.ha7CDTE2.20211023205210.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.mmdUpYCq.20211023205230.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Documents\20211023\PowerShell_transcript.192799.p3u2Mf5a.20211023205250.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211024_035203_654.etl
 data
 #
C:\Windows\appcompat\Programs\Amcache.hve
 MS Windows registry file, NT/2000 or above
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpuvb2qq.obd.ps1
 very short file (no magic)
 #
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_H1GC5Z4C39PAYMEN_7a64fa686aa2b449b23ea7d97cf2f941195b149c_e6297b6c_1a2860c4\Report.wer
 Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4609.tmp.dmp
 Mini DuMP crash report, 15 streams, Sun Oct 24 03:52:26 2021, 0x1205a4 type
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FFD.tmp.WERInternalMetadata.xml
 XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5126.tmp.xml
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER51F0.tmp.csv
 data
 #
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5646.tmp.txt
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
 data
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0alq1rnq.fvw.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0p4rveuo.xaw.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_afikvgxk.w0q.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uddlyd1a.j3i.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f443ifhm.psd.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ghev4lsv.yqs.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ib12pe5t.ob1.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5gb5bv2.hft.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kby1zsrx.atd.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgptrent.tdm.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwuon4io.mbd.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ol20jfnz.w0w.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1wgqfhc.cqq.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r2v5bdm4.3px.ps1
 very short file (no magic)
 #