Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * ID: 425
- * MalFamily: "Nanocore"
- * MalScore: 10.0
- * File Name: "Exes_f9e4df96d5429c0f8f734bec2fb3c93c.ace?download&psid=1"
- * File Size: 1495552
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "4f6cfec86efe21b246e0e589def2c30f801d2a81197dd6d77b336587aa057002"
- * MD5: "f9e4df96d5429c0f8f734bec2fb3c93c"
- * SHA1: "75099fb0aba58999d3dd70f628fd0961c78428f3"
- * SHA512: "3e660cd2ae7ada2f1a5a8e91cdf5281d4f904a080c5a506b78696ae436454c4f3f0d09a8fc0631db5e9b94f1317c869b0e5f4c5fb06950a61eefbab8d8d7f4ad"
- * CRC32: "5A77D2A6"
- * SSDEEP: "24576:5AHnh+eWsN3skA4RV1Hom2KXMmHa06oR0/y6Og6hlmKXRHCswhuIJiWAA701d/5:Ah+ZkldoPK8YajaIOg6h0KXx4h1RR7k"
- * Process Execution:
- "Nr0pWsiny9.exe",
- "RegAsm.exe",
- "schtasks.exe",
- "schtasks.exe",
- "svchost.exe"
- * Executed Commands:
- "\"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp6AD0.tmp\"",
- "\"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7522.tmp\""
- * Signatures Detected:
- "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
- "Details":
- "Description": "Behavioural detection: Executable code extraction",
- "Details":
- "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
- "Details":
- "IP": "194.5.98.30:17345 (France)"
- "Description": "Guard pages use detected - possible anti-debugging.",
- "Details":
- "Description": "A process attempted to delay the analysis task.",
- "Details":
- "Process": "RegAsm.exe tried to sleep 1351 seconds, actually delayed analysis time by 0 seconds"
- "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
- "Details":
- "ioc": "v2.0.50727"
- "Description": "Expresses interest in specific running processes",
- "Details":
- "process": "csrss.exe"
- "process": "RegAsm.exe"
- "Description": "Reads data out of its own binary image",
- "Details":
- "self_read": "process: Nr0pWsiny9.exe, pid: 2944, offset: 0x00000000, length: 0x0016d200"
- "self_read": "process: RegAsm.exe, pid: 2152, offset: 0x00000000, length: 0x00001000"
- "self_read": "process: RegAsm.exe, pid: 2152, offset: 0x00000080, length: 0x00000200"
- "self_read": "process: RegAsm.exe, pid: 2152, offset: 0x00000178, length: 0x00000200"
- "self_read": "process: RegAsm.exe, pid: 2152, offset: 0x0000a720, length: 0x00000200"
- "self_read": "process: RegAsm.exe, pid: 2152, offset: 0x0000a73c, length: 0x00000200"
- "Description": "A process created a hidden window",
- "Details":
- "Process": "RegAsm.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp6AD0.tmp\""
- "Process": "RegAsm.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7522.tmp\""
- "Description": "The binary likely contains encrypted or compressed data.",
- "Details":
- "section": "name: .rsrc, entropy: 7.78, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x000a2c00, virtual_size: 0x000a2b24"
- "Description": "Uses Windows utilities for basic functionality",
- "Details":
- "command": "\"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp6AD0.tmp\""
- "command": "\"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7522.tmp\""
- "Description": "Behavioural detection: Injection (Process Hollowing)",
- "Details":
- "Injection": "Nr0pWsiny9.exe(2944) -> RegAsm.exe(2152)"
- "Description": "Executed a process and injected code into it, probably while unpacking",
- "Details":
- "Injection": "Nr0pWsiny9.exe(2944) -> RegAsm.exe(2152)"
- "Description": "Attempts to remove evidence of file being downloaded from the Internet",
- "Details":
- "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe:Zone.Identifier"
- "Description": "Behavioural detection: Injection (inter-process)",
- "Details":
- "Description": "Behavioural detection: Injection with CreateRemoteThread in a remote process",
- "Details":
- "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
- "Details":
- "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
- "Description": "Installs itself for autorun at Windows startup",
- "Details":
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\dlccixwyiyawbweqxneq"
- "data": "C:\\Users\\Public\\dlccixwyiyawbweqxneq.vbs"
- "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DSL Subsystem"
- "data": "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe"
- "Description": "Exhibits behavior characteristic of Nanocore RAT",
- "Details":
- "Description": "CAPE detected the NanoCore malware family",
- "Details":
- "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
- "Details":
- "MicroWorld-eScan": "AIT:Trojan.Nymeria.2395"
- "FireEye": "AIT:Trojan.Nymeria.2389"
- "CrowdStrike": "win/malicious_confidence_80% (D)"
- "Cyren": "W32/AutoIt.IJ.gen!Eldorado"
- "Symantec": "ML.Attribute.HighConfidence"
- "APEX": "Malicious"
- "BitDefender": "AIT:Trojan.Nymeria.2389"
- "Endgame": "malicious (high confidence)"
- "Emsisoft": "AIT:Trojan.Nymeria.2389 (B)"
- "F-Secure": "Heuristic.HEUR/AGEN.1042871"
- "Invincea": "heuristic"
- "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.tc"
- "F-Prot": "W32/AutoIt.IJ.gen!Eldorado"
- "Avira": "HEUR/AGEN.1042871"
- "MAX": "malware (ai score=80)"
- "Microsoft": "Trojan:Win32/Wacatac.B!ml"
- "Arcabit": "AIT:Trojan.Nymeria.D955"
- "AhnLab-V3": "Trojan/Win32.RL_AutoInj.R272810"
- "GData": "AIT:Trojan.Nymeria.2389 (2x)"
- "Acronis": "suspicious"
- "ALYac": "AIT:Trojan.Nymeria.2389"
- "Ad-Aware": "AIT:Trojan.Nymeria.2389"
- "Cylance": "Unsafe"
- "Rising": "Trojan.Injector/Autoit!1.BB8C (CLASSIC)"
- "Fortinet": "AutoIt/Injector.ECS!tr"
- "Qihoo-360": "HEUR/QVM10.1.865E.Malware.Gen"
- "Description": "Creates a slightly modified copy of itself",
- "Details":
- "file": "C:\\AppData\\Local\\Temp\\winrshost\\systemreset.bat"
- "percent_match": 100
- "Description": "Collects information to fingerprint the system",
- "Details":
- "Description": "Anomalous binary characteristics",
- "Details":
- "anomaly": "Actual checksum does not match that reported in PE header"
- "Description": "Created network traffic indicative of malicious activity",
- "Details":
- "signature": "ET TROJAN Possible NanoCore C2 60B"
- * Started Service:
- * Mutexes:
- "Global\\CLR_PerfMon_WrapMutex",
- "Global\\CLR_CASOFF_MUTEX",
- "Global\\a1a9c08b-87e8-4702-8fba-aad316e86c16",
- "Global\\.net clr networking"
- * Modified Files:
- "C:\\AppData\\Local\\Temp\\winrshost\\systemreset.bat",
- "C:\\Users\\Public\\dlccixwyiyawbweqxneq.vbs",
- "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat",
- "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe",
- "C:\\Users\\user\\AppData\\Local\\Temp\\tmp6AD0.tmp",
- "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\task.dat",
- "C:\\Users\\user\\AppData\\Local\\Temp\\tmp7522.tmp",
- "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
- "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk"
- * Deleted Files:
- "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe",
- "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\DSL Subsystem\\dslss.exe",
- "C:\\Users\\user\\AppData\\Local\\Temp\\tmp6AD0.tmp",
- "C:\\Users\\user\\AppData\\Local\\Temp\\tmp7522.tmp",
- "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe:Zone.Identifier",
- "C:\\Windows\\Tasks\\DSL Subsystem.job",
- "C:\\Windows\\Tasks\\DSL Subsystem Task.job",
- "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"
- * Modified Registry Keys:
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\dlccixwyiyawbweqxneq",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DSL Subsystem",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\D4AC88D2-7778-46EF-B497-923C2BF340FE\\Path",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\D4AC88D2-7778-46EF-B497-923C2BF340FE\\Hash",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Id",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Index",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\D4AC88D2-7778-46EF-B497-923C2BF340FE\\Triggers",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B340FAEB-2E15-48C3-89FE-AB1CD5DB886F\\Path",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B340FAEB-2E15-48C3-89FE-AB1CD5DB886F\\Hash",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem Task\\Id",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem Task\\Index",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B340FAEB-2E15-48C3-89FE-AB1CD5DB886F\\Triggers"
- * Deleted Registry Keys:
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job.fp",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem Task.job",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem Task.job.fp"
- * DNS Communications:
- "type": "A",
- "request": "ariascopetrading.hopto.org",
- "answers":
- "data": "194.5.98.30",
- "type": "A"
- * Domains:
- "ip": "194.5.98.30",
- "domain": "ariascopetrading.hopto.org"
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- "country_name": "France",
- "ip": "194.5.98.30",
- "inaddrarpa": "",
- "hostname": "ariascopetrading.hopto.org"
- * Network Communication - IRC:
Add Comment
Please, Sign In to add comment