Play interactive tour

Edit tour

Analysis Report DHL_file 187652345643476245.exe

Overview

General Information

Sample Name:	DHL_file 187652345643476245.exe
Analysis ID:	336532
MD5:	303e92008ea45abde4fc35d8d176015d
SHA1:	29ff646c7c04a2be614bdbe87f73df87add78dda
SHA256:	c4dbec4c0df381cee21c2ba0d6105b0f7310c8f108e66e078df0ad4803148fb6
Tags:	DHLexeHostwindsNanoCoreRAT
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected AntiVM_3

Yara detected Nanocore RAT

.NET source code contains potential unpacker

Allocates memory in foreign processes

Binary contains a suspicious time stamp

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

DHL_file 187652345643476245.exe (PID: 6652 cmdline: 'C:\Users\user\Desktop\DHL_file 187652345643476245.exe' MD5: 303E92008EA45ABDE4FC35D8D176015D)

demiusda.exe (PID: 1240 cmdline: 'C:\Users\user\AppData\Roaming\demiusda.exe' MD5: 303E92008EA45ABDE4FC35D8D176015D)

AddInProcess32.exe (PID: 1256 cmdline: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)

watchprcss.exe (PID: 5164 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 6304 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 5712 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 5404 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 6660 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 5024 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 4076 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 6508 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 7020 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 476 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 6284 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 1724 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 7040 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 3032 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 7000 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

watchprcss.exe (PID: 6216 cmdline: 'C:\Users\user\AppData\Local\Temp\watchprcss.exe' MD5: 0E362E7005823D0BEC3719B902ED6D62)

cleanup

Malware Configuration

Threatname: NanoCore

{"C2: ": ["185.157.160.233", "105.112.113.90"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.624186822.0000000005610000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000011.00000002.624186822.0000000005610000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2f25:$a: NanoCore 0x2f7e:$a: NanoCore 0x2fbb:$a: NanoCore 0x3034:$a: NanoCore 0x166df:$a: NanoCore 0x166f4:$a: NanoCore 0x16729:$a: NanoCore 0x2f1a3:$a: NanoCore 0x2f1b8:$a: NanoCore 0x2f1ed:$a: NanoCore 0x2f87:$b: ClientPlugin 0x2fc4:$b: ClientPlugin 0x38c2:$b: ClientPlugin 0x38cf:$b: ClientPlugin 0x1649b:$b: ClientPlugin 0x164b6:$b: ClientPlugin 0x164e6:$b: ClientPlugin 0x166fd:$b: ClientPlugin 0x16732:$b: ClientPlugin 0x2ef5f:$b: ClientPlugin 0x2ef7a:$b: ClientPlugin
0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1043d:$x1: NanoCore.ClientPluginHost 0x1047a:$x2: IClientNetworkHost 0x13fad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x101a5:$a: NanoCore 0x101b5:$a: NanoCore 0x103e9:$a: NanoCore 0x103fd:$a: NanoCore 0x1043d:$a: NanoCore 0x10204:$b: ClientPlugin 0x10406:$b: ClientPlugin 0x10446:$b: ClientPlugin 0x1032b:$c: ProjectData 0x10d32:$d: DESCrypto 0x186fe:$e: KeepAlive 0x166ec:$g: LogClientMessage 0x128e7:$i: get_Connected 0x11068:$j: #=q 0x11098:$j: #=q 0x110b4:$j: #=q 0x110e4:$j: #=q 0x11100:$j: #=q 0x1111c:$j: #=q 0x1114c:$j: #=q 0x11168:$j: #=q
0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x105a5:$x1: NanoCore.ClientPluginHost 0x105e2:$x2: IClientNetworkHost 0x14115:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1030d:$a: NanoCore 0x1031d:$a: NanoCore 0x10551:$a: NanoCore 0x10565:$a: NanoCore 0x105a5:$a: NanoCore 0x1036c:$b: ClientPlugin 0x1056e:$b: ClientPlugin 0x105ae:$b: ClientPlugin 0x10493:$c: ProjectData 0x10e9a:$d: DESCrypto 0x18866:$e: KeepAlive 0x16854:$g: LogClientMessage 0x12a4f:$i: get_Connected 0x111d0:$j: #=q 0x11200:$j: #=q 0x1121c:$j: #=q 0x1124c:$j: #=q 0x11268:$j: #=q 0x11284:$j: #=q 0x112b4:$j: #=q 0x112d0:$j: #=q
00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8d585:$x1: NanoCore.ClientPluginHost 0x8d5c2:$x2: IClientNetworkHost 0x910f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8d2ed:$a: NanoCore 0x8d2fd:$a: NanoCore 0x8d531:$a: NanoCore 0x8d545:$a: NanoCore 0x8d585:$a: NanoCore 0x8d34c:$b: ClientPlugin 0x8d54e:$b: ClientPlugin 0x8d58e:$b: ClientPlugin 0x8d473:$c: ProjectData 0x8de7a:$d: DESCrypto 0x6d826:$e: KeepAlive 0x95846:$e: KeepAlive 0x6b814:$g: LogClientMessage 0x93834:$g: LogClientMessage 0x8fa2f:$i: get_Connected 0x6b1f5:$j: #=q 0x6b225:$j: #=q 0x6b241:$j: #=q 0x6b271:$j: #=q 0x6b28d:$j: #=q 0x6b2a9:$j: #=q
00000011.00000002.615389852.0000000002ED1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
Process Memory Space: DHL_file 187652345643476245.exe PID: 6652	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: AddInProcess32.exe PID: 1256	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x36386:$x1: NanoCore.ClientPluginHost 0x3bf45:$x1: NanoCore.ClientPluginHost 0x4cda6:$x1: NanoCore.ClientPluginHost 0x15598f:$x1: NanoCore.ClientPluginHost 0x19f100:$x1: NanoCore.ClientPluginHost 0x363ac:$x2: IClientNetworkHost 0x3bf8a:$x2: IClientNetworkHost 0x4cdeb:$x2: IClientNetworkHost 0x1559b5:$x2: IClientNetworkHost 0x19f161:$x2: IClientNetworkHost 0x1a4566:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b24d8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: AddInProcess32.exe PID: 1256	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: AddInProcess32.exe PID: 1256	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x36278:$a: NanoCore 0x36319:$a: NanoCore 0x36386:$a: NanoCore 0x36447:$a: NanoCore 0x37318:$a: NanoCore 0x3736b:$a: NanoCore 0x373a4:$a: NanoCore 0x37417:$a: NanoCore 0x3bebf:$a: NanoCore 0x3beec:$a: NanoCore 0x3bf45:$a: NanoCore 0x43754:$a: NanoCore 0x43767:$a: NanoCore 0x43799:$a: NanoCore 0x4cd20:$a: NanoCore 0x4cd4d:$a: NanoCore 0x4cda6:$a: NanoCore 0x545b5:$a: NanoCore 0x545c8:$a: NanoCore 0x545fa:$a: NanoCore 0x14663e:$a: NanoCore
Process Memory Space: demiusda.exe PID: 1240	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5ddf1:$x1: NanoCore.ClientPluginHost 0x8cbce:$x1: NanoCore.ClientPluginHost 0x5de52:$x2: IClientNetworkHost 0x8cc2f:$x2: IClientNetworkHost 0x63257:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x711c9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x92034:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x9ffa6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: demiusda.exe PID: 1240	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: demiusda.exe PID: 1240	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x5d8f6:$a: NanoCore 0x5d912:$a: NanoCore 0x5da6d:$a: NanoCore 0x5da7c:$a: NanoCore 0x5dd55:$a: NanoCore 0x5dd81:$a: NanoCore 0x5ddf1:$a: NanoCore 0x6d833:$a: NanoCore 0x6d845:$a: NanoCore 0x6d881:$a: NanoCore 0x8c6d3:$a: NanoCore 0x8c6ef:$a: NanoCore 0x8c84a:$a: NanoCore 0x8c859:$a: NanoCore 0x8cb32:$a: NanoCore 0x8cb5e:$a: NanoCore 0x8cbce:$a: NanoCore 0x9c610:$a: NanoCore 0x9c622:$a: NanoCore 0x9c65e:$a: NanoCore 0x5d99d:$b: ClientPlugin
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.AddInProcess32.exe.5a80000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
17.2.AddInProcess32.exe.5a80000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
17.2.AddInProcess32.exe.5a80000.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.AddInProcess32.exe.5610000.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
17.2.AddInProcess32.exe.5610000.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
17.2.AddInProcess32.exe.5a80000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
17.2.AddInProcess32.exe.5a80000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
17.2.AddInProcess32.exe.5a80000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.AddInProcess32.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.AddInProcess32.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
17.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.AddInProcess32.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Click to see the 7 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe, ProcessId: 1256, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: AddInProcess32.exe.1256.17.memstr

Malware Configuration Extractor: NanoCore {"C2: ": ["185.157.160.233", "105.112.113.90"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\demiusda.exe

ReversingLabs: Detection: 22%

Multi AV Scanner detection for submitted file

Show sources

Source: DHL_file 187652345643476245.exe

ReversingLabs: Detection: 22%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.615389852.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1256, type: MEMORY
Source: Yara match	File source: Process Memory Space: demiusda.exe PID: 1240, type: MEMORY
Source: Yara match	File source: 17.2.AddInProcess32.exe.5a80000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.AddInProcess32.exe.5a80000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Source: 17.2.AddInProcess32.exe.5a80000.6.unpack	Avira: Label: TR/NanoCore.fadte
Source: 17.2.AddInProcess32.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then jmp 02DAF636h	0_2_02DAEE70
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then jmp 02DAF636h	0_2_02DAEE62
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then jmp 02DAF636h	0_2_02DAEE28
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_057AB160
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_057A5D80
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_057A3E0C
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_057ADEB8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_057A4BC8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_057A4BC8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov esp, ebp	0_2_057ACAB0
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_057AB153
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_057A43C5
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_057ADF90
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_057A5E60
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_057ADEA8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_057A48A8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_057A48A8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_057A489D
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_057A489D
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then xor edx, edx	0_2_057A4B00
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_057A6BFC
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_057A4BBD
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_057A4BBD
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then xor edx, edx	0_2_057A4AF4
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 4x nop then mov esp, ebp	0_2_057ACAA1
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 0318F636h	12_2_0318ED7F
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 0318F636h	12_2_0318EE63
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 058891E7h	12_2_058890B8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 0588868Eh	12_2_05888588
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 0588868Eh	12_2_05888598
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 058891E7h	12_2_058890A8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 4x nop then jmp 058891E7h	12_2_0588921B
Source: C:\Users\user\AppData\Local\Temp\watchprcss.exe	Code function: 4x nop then jmp 015E0799h	19_2_015E0560
Source: C:\Users\user\AppData\Local\Temp\watchprcss.exe	Code function: 4x nop then jmp 015E0799h	19_2_015E0553
Source: C:\Users\user\AppData\Local\Temp\watchprcss.exe	Code function: 4x nop then jmp 02700799h	20_2_02700560
Source: C:\Users\user\AppData\Local\Temp\watchprcss.exe	Code function: 4x nop then jmp 02700799h	20_2_02700551
Source: C:\Users\user\AppData\Local\Temp\watchprcss.exe	Code function: 4x nop then jmp 032E0799h	22_2_032E0560
Source: C:\Users\user\AppData\Local\Temp\watchprcss.exe	Code function: 4x nop then jmp 032E0799h	22_2_032E0552

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 185.157.160.233
Source: Malware configuration extractor	IPs: 105.112.113.90

Source: global traffic	TCP traffic: 192.168.2.3:49724 -> 185.157.160.233:2020
Source: global traffic	TCP traffic: 192.168.2.3:49744 -> 105.112.113.90:2020

Source: Joe Sandbox View

IP Address: 185.157.160.233 185.157.160.233

Source: Joe Sandbox View

ASN Name: OBE-EUROPEObenetworkEuropeSE OBE-EUROPEObenetworkEuropeSE

Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.160.233

Source: unknown

DNS traffic detected: queries for: annapro.linkpc.net

Source: demiusda.exe, 0000000C.00000002.615285551.0000000001799000.00000004.00000040.sdmp	String found in binary or memory: http://iptc.tc4xmp
Source: DHL_file 187652345643476245.exe, 00000000.00000002.307699321.0000000001519000.00000004.00000040.sdmp	String found in binary or memory: http://iptc.tc4xmp:
Source: demiusda.exe, 0000000C.00000002.615285551.0000000001799000.00000004.00000040.sdmp	String found in binary or memory: http://ns.ado/Ident

Source: demiusda.exe, 0000000C.00000002.612789504.000000000152A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: AddInProcess32.exe, 00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.615389852.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1256, type: MEMORY
Source: Yara match	File source: Process Memory Space: demiusda.exe PID: 1240, type: MEMORY
Source: Yara match	File source: 17.2.AddInProcess32.exe.5a80000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.AddInProcess32.exe.5a80000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000011.00000002.624186822.0000000005610000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: AddInProcess32.exe PID: 1256, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: AddInProcess32.exe PID: 1256, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: demiusda.exe PID: 1240, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: demiusda.exe PID: 1240, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.AddInProcess32.exe.5a80000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.AddInProcess32.exe.5610000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.AddInProcess32.exe.5a80000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\AppData\Roaming\demiusda.exe

Code function: 12_2_058843A0 CreateProcessAsUserW,

12_2_058843A0

Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_00BC471C	0_2_00BC471C
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DA4098	0_2_02DA4098
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DA4800	0_2_02DA4800
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAA918	0_2_02DAA918
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAEE70	0_2_02DAEE70
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DA9E20	0_2_02DA9E20
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAF768	0_2_02DAF768
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAD700	0_2_02DAD700
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DABC40	0_2_02DABC40
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DA7C20	0_2_02DA7C20
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAA909	0_2_02DAA909
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAD6F0	0_2_02DAD6F0
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAEE62	0_2_02DAEE62
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DA9E10	0_2_02DA9E10
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAEE28	0_2_02DAEE28
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DAF758	0_2_02DAF758
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_02DABC30	0_2_02DABC30
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057A87F8	0_2_057A87F8
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057A5930	0_2_057A5930
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057ABA00	0_2_057ABA00
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057AC520	0_2_057AC520
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057AC510	0_2_057AC510
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057A536F	0_2_057A536F
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057A5380	0_2_057A5380
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057A0380	0_2_057A0380
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057A5923	0_2_057A5923
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057AB9F0	0_2_057AB9F0
Source: C:\Users\user\Desktop\DHL_file 187652345643476245.exe	Code function: 0_2_057AB9B0	0_2_057AB9B0
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_03187BB0	12_2_03187BB0
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318A909	12_2_0318A909
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_03184098	12_2_03184098
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318F768	12_2_0318F768
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_03189E10	12_2_03189E10
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318D6F0	12_2_0318D6F0
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318ED7F	12_2_0318ED7F
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318BC30	12_2_0318BC30
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318F758	12_2_0318F758
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_0318EE63	12_2_0318EE63
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05880CC8	12_2_05880CC8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_058813F8	12_2_058813F8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05885B00	12_2_05885B00
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05883210	12_2_05883210
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_058849A8	12_2_058849A8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_058829C7	12_2_058829C7
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_058829D8	12_2_058829D8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05882550	12_2_05882550
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05882560	12_2_05882560
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05880CB8	12_2_05880CB8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05883C60	12_2_05883C60
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05883C70	12_2_05883C70
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_058813E8	12_2_058813E8
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05886720	12_2_05886720
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05885AF0	12_2_05885AF0
Source: C:\Users\user\AppData\Roaming\demiusda.exe	Code function: 12_2_05883200	12_2_05883200
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_00B12050	17_2_00B12050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_013EE471	17_2_013EE471
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_013EE480	17_2_013EE480
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_013EBBD4	17_2_013EBBD4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_0557F5F8	17_2_0557F5F8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_05579788	17_2_05579788
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 17_2_0557A602	17_2_0557A602

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe 23F4A2CCDCE499C524CF43793FDA8E773D809514B5471C02FA5E68F0CDA7A10B

Source: DHL_file 187652345643476245.exe, 00000000.00000002.310619825.0000000005690000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe, 00000000.00000002.309186882.0000000004F30000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe, 00000000.00000002.309186882.0000000004F30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe, 00000000.00000002.307262138.0000000000C66000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameemekaike.exeL vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe, 00000000.00000002.308442097.0000000003F69000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe, 00000000.00000002.309116173.0000000004ED0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe, 00000000.00000002.312320361.00000000085A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs DHL_file 187652345643476245.exe
Source: DHL_file 187652345643476245.exe	Binary or memory string: OriginalFilenameemekaike.exeL vs DHL_file 187652345643476245.exe

Source: 00000011.00000002.624186822.0000000005610000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.624186822.0000000005610000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000011.00000002.620217311.0000000003F19000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.623749902.0000000004231000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.624626944.0000000004DB7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.624595498.0000000005A80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.624416649.0000000004CEA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.607848743.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: AddInProcess32.exe PID: 1256, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: AddInProcess32.exe PID: 1256, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: demiusda.exe PID: 1240, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: demiusda.exe PID: 1240, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.AddInProcess32.exe.5a80000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.AddInProcess32.exe.5a80000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.AddInProcess32.exe.5610000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.AddInProcess32.exe.5610000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.AddInProcess32.exe.5a80000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.AddInProcess32.exe.5a80000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: DHL_file 187652345643476245.exe, Sg6/Tx6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DHL_file 187652345643476245.exe, g0XP/Aq8w.cs	Cryptographic APIs: 'CreateDecryptor'
Source: demiusda.exe.0.dr, Sg6/Tx6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: demiusda.exe.0.dr, g0XP/Aq8w.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.DHL_file 187652345643476245.exe.bc0000.0.unpack, Sg6/Tx6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.DHL_file 187652345643476245.exe.bc0000.0.unpack, g0XP/Aq8w.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL_file 187652345643476245.exe.bc0000.0.unpack, Sg6/Tx6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_file 187652345643476245.exe.bc0000.0.unpack, g0XP/Aq8w.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.0.demiusda.exe.d50000.0.unpack, Sg6/Tx6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.0.demiusda.exe.d50000.0.unpack, g0XP/Aq8w.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.demiusda.exe.d50000.0.unpack, Sg6/Tx6.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@38/25@3/3