Play interactive tour

Edit tour

Analysis Report Paypal Payment Authorization pdf.exe

Overview

General Information

Sample Name:	Paypal Payment Authorization pdf.exe
Analysis ID:	337761
MD5:	43796c264cd5716211cca1333d02c545
SHA1:	cd0af8e864d885c7495a0783a17daa185c7ac224
SHA256:	1d7e3f93b597143dc7762692af6d463b43feac3372d01a1ced3e9e6741205533
Tags:	exeNanoCoreRAT
Most interesting Screenshot:
Errors Sigma syntax error: Has an empty selector, Rule: Abusing Azure Browser SSO

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Executable has a suspicious name (potential lure to open the executable)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Conhost Parent Proces Executions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

Paypal Payment Authorization pdf.exe (PID: 4544 cmdline: 'C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe' MD5: 43796C264CD5716211CCA1333D02C545)

Paypal Payment Authorization pdf.exe (PID: 6136 cmdline: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe MD5: 43796C264CD5716211CCA1333D02C545)

schtasks.exe (PID: 2800 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp2E95.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 788 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: 43796C264CD5716211CCA1333D02C545)

schtasks.exe (PID: 5496 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp3184.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Paypal Payment Authorization pdf.exe (PID: 5444 cmdline: 'C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe' 0 MD5: 43796C264CD5716211CCA1333D02C545)

Paypal Payment Authorization pdf.exe (PID: 4348 cmdline: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe MD5: 43796C264CD5716211CCA1333D02C545)

dhcpmon.exe (PID: 5912 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 43796C264CD5716211CCA1333D02C545)

dhcpmon.exe (PID: 4928 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: 43796C264CD5716211CCA1333D02C545)

dhcpmon.exe (PID: 4352 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 43796C264CD5716211CCA1333D02C545)

cleanup

Malware Configuration

Threatname: NanoCore

{"C2: ": ["185.244.38.210"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x435bd:$a: NanoCore 0x43616:$a: NanoCore 0x43653:$a: NanoCore 0x436cc:$a: NanoCore 0x56d77:$a: NanoCore 0x56d8c:$a: NanoCore 0x56dc1:$a: NanoCore 0x6fd4b:$a: NanoCore 0x6fd60:$a: NanoCore 0x6fd95:$a: NanoCore 0x4361f:$b: ClientPlugin 0x4365c:$b: ClientPlugin 0x43f5a:$b: ClientPlugin 0x43f67:$b: ClientPlugin 0x56b33:$b: ClientPlugin 0x56b4e:$b: ClientPlugin 0x56b7e:$b: ClientPlugin 0x56d95:$b: ClientPlugin 0x56dca:$b: ClientPlugin 0x6fb07:$b: ClientPlugin 0x6fb22:$b: ClientPlugin
00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1b6a:$a: NanoCore 0x1b8f:$a: NanoCore 0x1be8:$a: NanoCore 0x11d85:$a: NanoCore 0x11dab:$a: NanoCore 0x11e07:$a: NanoCore 0x1ec5c:$a: NanoCore 0x1ecb5:$a: NanoCore 0x1ece8:$a: NanoCore 0x1ef14:$a: NanoCore 0x1ef90:$a: NanoCore 0x1f5a9:$a: NanoCore 0x1f6f2:$a: NanoCore 0x1fbc6:$a: NanoCore 0x1fead:$a: NanoCore 0x1fec4:$a: NanoCore 0x25462:$a: NanoCore 0x254dc:$a: NanoCore 0x2a079:$a: NanoCore 0x2b433:$a: NanoCore 0x2b47d:$a: NanoCore
0000000C.00000002.282400561.00000000027E1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.282400561.00000000027E1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6943f:$a: NanoCore 0x69498:$a: NanoCore 0x694d5:$a: NanoCore 0x6954e:$a: NanoCore 0x694a1:$b: ClientPlugin 0x694de:$b: ClientPlugin 0x69ddc:$b: ClientPlugin 0x69de9:$b: ClientPlugin 0x5f5a1:$e: KeepAlive 0x69929:$g: LogClientMessage 0x698a9:$i: get_Connected 0x59875:$j: #=q 0x598a5:$j: #=q 0x598e1:$j: #=q 0x59909:$j: #=q 0x59939:$j: #=q 0x59969:$j: #=q 0x59999:$j: #=q 0x599c9:$j: #=q 0x599e5:$j: #=q 0x59a15:$j: #=q
00000009.00000002.268198186.0000000003809000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.268198186.0000000003809000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x435bd:$a: NanoCore 0x43616:$a: NanoCore 0x43653:$a: NanoCore 0x436cc:$a: NanoCore 0x56d77:$a: NanoCore 0x56d8c:$a: NanoCore 0x56dc1:$a: NanoCore 0x6fd4b:$a: NanoCore 0x6fd60:$a: NanoCore 0x6fd95:$a: NanoCore 0x4361f:$b: ClientPlugin 0x4365c:$b: ClientPlugin 0x43f5a:$b: ClientPlugin 0x43f67:$b: ClientPlugin 0x56b33:$b: ClientPlugin 0x56b4e:$b: ClientPlugin 0x56b7e:$b: ClientPlugin 0x56d95:$b: ClientPlugin 0x56dca:$b: ClientPlugin 0x6fb07:$b: ClientPlugin 0x6fb22:$b: ClientPlugin
00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x432cd:$x1: NanoCore.ClientPluginHost 0x75efd:$x1: NanoCore.ClientPluginHost 0xa891d:$x1: NanoCore.ClientPluginHost 0x4330a:$x2: IClientNetworkHost 0x75f3a:$x2: IClientNetworkHost 0xa895a:$x2: IClientNetworkHost 0x46e3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x79a6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac48d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x43035:$a: NanoCore 0x43045:$a: NanoCore 0x43279:$a: NanoCore 0x4328d:$a: NanoCore 0x432cd:$a: NanoCore 0x75c65:$a: NanoCore 0x75c75:$a: NanoCore 0x75ea9:$a: NanoCore 0x75ebd:$a: NanoCore 0x75efd:$a: NanoCore 0xa8685:$a: NanoCore 0xa8695:$a: NanoCore 0xa88c9:$a: NanoCore 0xa88dd:$a: NanoCore 0xa891d:$a: NanoCore 0x43094:$b: ClientPlugin 0x43296:$b: ClientPlugin 0x432d6:$b: ClientPlugin 0x75cc4:$b: ClientPlugin 0x75ec6:$b: ClientPlugin 0x75f06:$b: ClientPlugin
0000000C.00000002.282484135.00000000037E9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.282484135.00000000037E9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x435bd:$a: NanoCore 0x43616:$a: NanoCore 0x43653:$a: NanoCore 0x436cc:$a: NanoCore 0x56d77:$a: NanoCore 0x56d8c:$a: NanoCore 0x56dc1:$a: NanoCore 0x6fd4b:$a: NanoCore 0x6fd60:$a: NanoCore 0x6fd95:$a: NanoCore 0x4361f:$b: ClientPlugin 0x4365c:$b: ClientPlugin 0x43f5a:$b: ClientPlugin 0x43f67:$b: ClientPlugin 0x56b33:$b: ClientPlugin 0x56b4e:$b: ClientPlugin 0x56b7e:$b: ClientPlugin 0x56d95:$b: ClientPlugin 0x56dca:$b: ClientPlugin 0x6fb07:$b: ClientPlugin 0x6fb22:$b: ClientPlugin
00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x432cd:$x1: NanoCore.ClientPluginHost 0x75efd:$x1: NanoCore.ClientPluginHost 0xa891d:$x1: NanoCore.ClientPluginHost 0x4330a:$x2: IClientNetworkHost 0x75f3a:$x2: IClientNetworkHost 0xa895a:$x2: IClientNetworkHost 0x46e3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x79a6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac48d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x43035:$a: NanoCore 0x43045:$a: NanoCore 0x43279:$a: NanoCore 0x4328d:$a: NanoCore 0x432cd:$a: NanoCore 0x75c65:$a: NanoCore 0x75c75:$a: NanoCore 0x75ea9:$a: NanoCore 0x75ebd:$a: NanoCore 0x75efd:$a: NanoCore 0xa8685:$a: NanoCore 0xa8695:$a: NanoCore 0xa88c9:$a: NanoCore 0xa88dd:$a: NanoCore 0xa891d:$a: NanoCore 0x43094:$b: ClientPlugin 0x43296:$b: ClientPlugin 0x432d6:$b: ClientPlugin 0x75cc4:$b: ClientPlugin 0x75ec6:$b: ClientPlugin 0x75f06:$b: ClientPlugin
00000009.00000002.268089458.0000000002801000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.268089458.0000000002801000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6943f:$a: NanoCore 0x69498:$a: NanoCore 0x694d5:$a: NanoCore 0x6954e:$a: NanoCore 0x694a1:$b: ClientPlugin 0x694de:$b: ClientPlugin 0x69ddc:$b: ClientPlugin 0x69de9:$b: ClientPlugin 0x5f5a1:$e: KeepAlive 0x69929:$g: LogClientMessage 0x698a9:$i: get_Connected 0x59875:$j: #=q 0x598a5:$j: #=q 0x598e1:$j: #=q 0x59909:$j: #=q 0x59939:$j: #=q 0x59969:$j: #=q 0x59999:$j: #=q 0x599c9:$j: #=q 0x599e5:$j: #=q 0x59a15:$j: #=q
00000007.00000002.264137814.0000000002988000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x32587:$a: NanoCore 0x325e0:$a: NanoCore 0x3261d:$a: NanoCore 0x32696:$a: NanoCore 0x325e9:$b: ClientPlugin 0x32626:$b: ClientPlugin 0x32f24:$b: ClientPlugin 0x32f31:$b: ClientPlugin 0x286e9:$e: KeepAlive 0x32a71:$g: LogClientMessage 0x329f1:$i: get_Connected 0x229bd:$j: #=q 0x229ed:$j: #=q 0x22a29:$j: #=q 0x22a51:$j: #=q 0x22a81:$j: #=q 0x22ab1:$j: #=q 0x22ae1:$j: #=q 0x22b11:$j: #=q 0x22b2d:$j: #=q 0x22b5d:$j: #=q
00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x432cd:$x1: NanoCore.ClientPluginHost 0x75efd:$x1: NanoCore.ClientPluginHost 0xa891d:$x1: NanoCore.ClientPluginHost 0x4330a:$x2: IClientNetworkHost 0x75f3a:$x2: IClientNetworkHost 0xa895a:$x2: IClientNetworkHost 0x46e3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x79a6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac48d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x43035:$a: NanoCore 0x43045:$a: NanoCore 0x43279:$a: NanoCore 0x4328d:$a: NanoCore 0x432cd:$a: NanoCore 0x75c65:$a: NanoCore 0x75c75:$a: NanoCore 0x75ea9:$a: NanoCore 0x75ebd:$a: NanoCore 0x75efd:$a: NanoCore 0xa8685:$a: NanoCore 0xa8695:$a: NanoCore 0xa88c9:$a: NanoCore 0xa88dd:$a: NanoCore 0xa891d:$a: NanoCore 0x43094:$b: ClientPlugin 0x43296:$b: ClientPlugin 0x432d6:$b: ClientPlugin 0x75cc4:$b: ClientPlugin 0x75ec6:$b: ClientPlugin 0x75f06:$b: ClientPlugin
0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x432cd:$x1: NanoCore.ClientPluginHost 0x75efd:$x1: NanoCore.ClientPluginHost 0xa891d:$x1: NanoCore.ClientPluginHost 0x4330a:$x2: IClientNetworkHost 0x75f3a:$x2: IClientNetworkHost 0xa895a:$x2: IClientNetworkHost 0x46e3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x79a6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac48d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x43035:$a: NanoCore 0x43045:$a: NanoCore 0x43279:$a: NanoCore 0x4328d:$a: NanoCore 0x432cd:$a: NanoCore 0x75c65:$a: NanoCore 0x75c75:$a: NanoCore 0x75ea9:$a: NanoCore 0x75ebd:$a: NanoCore 0x75efd:$a: NanoCore 0xa8685:$a: NanoCore 0xa8695:$a: NanoCore 0xa88c9:$a: NanoCore 0xa88dd:$a: NanoCore 0xa891d:$a: NanoCore 0x43094:$b: ClientPlugin 0x43296:$b: ClientPlugin 0x432d6:$b: ClientPlugin 0x75cc4:$b: ClientPlugin 0x75ec6:$b: ClientPlugin 0x75f06:$b: ClientPlugin
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x42315:$x1: NanoCore.ClientPluginHost 0x60c94:$x1: NanoCore.ClientPluginHost 0x7f528:$x1: NanoCore.ClientPluginHost 0x42376:$x2: IClientNetworkHost 0x60cf5:$x2: IClientNetworkHost 0x7f589:$x2: IClientNetworkHost 0x4777b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x556ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x660fa:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7406c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x8498e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x92900:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x41e1a:$a: NanoCore 0x41e36:$a: NanoCore 0x41f91:$a: NanoCore 0x41fa0:$a: NanoCore 0x42279:$a: NanoCore 0x422a5:$a: NanoCore 0x42315:$a: NanoCore 0x51d57:$a: NanoCore 0x51d69:$a: NanoCore 0x51da5:$a: NanoCore 0x60799:$a: NanoCore 0x607b5:$a: NanoCore 0x60910:$a: NanoCore 0x6091f:$a: NanoCore 0x60bf8:$a: NanoCore 0x60c24:$a: NanoCore 0x60c94:$a: NanoCore 0x706d6:$a: NanoCore 0x706e8:$a: NanoCore 0x70724:$a: NanoCore 0x7f02d:$a: NanoCore
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x63b0:$x1: NanoCore.ClientPluginHost 0xbf6f:$x1: NanoCore.ClientPluginHost 0x1d2f6:$x1: NanoCore.ClientPluginHost 0x3f4cb:$x1: NanoCore.ClientPluginHost 0x45ab7:$x1: NanoCore.ClientPluginHost 0x763bc:$x1: NanoCore.ClientPluginHost 0x63d6:$x2: IClientNetworkHost 0xbfb4:$x2: IClientNetworkHost 0x1d33b:$x2: IClientNetworkHost 0x3f4f1:$x2: IClientNetworkHost 0x45b18:$x2: IClientNetworkHost 0x763e2:$x2: IClientNetworkHost 0x4af1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x58e8f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x62a2:$a: NanoCore 0x6343:$a: NanoCore 0x63b0:$a: NanoCore 0x6471:$a: NanoCore 0x7342:$a: NanoCore 0x7395:$a: NanoCore 0x73ce:$a: NanoCore 0x7441:$a: NanoCore 0xbee9:$a: NanoCore 0xbf16:$a: NanoCore 0xbf6f:$a: NanoCore 0x1377e:$a: NanoCore 0x13791:$a: NanoCore 0x137c3:$a: NanoCore 0x1d270:$a: NanoCore 0x1d29d:$a: NanoCore 0x1d2f6:$a: NanoCore 0x24b05:$a: NanoCore 0x24b18:$a: NanoCore 0x24b4a:$a: NanoCore 0x31bc8:$a: NanoCore
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3d3b2:$x1: NanoCore.ClientPluginHost 0x5bd31:$x1: NanoCore.ClientPluginHost 0x7a604:$x1: NanoCore.ClientPluginHost 0x3d413:$x2: IClientNetworkHost 0x5bd92:$x2: IClientNetworkHost 0x7a665:$x2: IClientNetworkHost 0x42818:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5078a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x61197:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6f109:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7fa6a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x8d9dc:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3ceb7:$a: NanoCore 0x3ced3:$a: NanoCore 0x3d02e:$a: NanoCore 0x3d03d:$a: NanoCore 0x3d316:$a: NanoCore 0x3d342:$a: NanoCore 0x3d3b2:$a: NanoCore 0x4cdf4:$a: NanoCore 0x4ce06:$a: NanoCore 0x4ce42:$a: NanoCore 0x5b836:$a: NanoCore 0x5b852:$a: NanoCore 0x5b9ad:$a: NanoCore 0x5b9bc:$a: NanoCore 0x5bc95:$a: NanoCore 0x5bcc1:$a: NanoCore 0x5bd31:$a: NanoCore 0x6b773:$a: NanoCore 0x6b785:$a: NanoCore 0x6b7c1:$a: NanoCore 0x7a109:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 4928	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8139:$x1: NanoCore.ClientPluginHost 0xdcf8:$x1: NanoCore.ClientPluginHost 0x1f07f:$x1: NanoCore.ClientPluginHost 0x2ded3:$x1: NanoCore.ClientPluginHost 0x720b0:$x1: NanoCore.ClientPluginHost 0x815f:$x2: IClientNetworkHost 0xdd3d:$x2: IClientNetworkHost 0x1f0c4:$x2: IClientNetworkHost 0x2df34:$x2: IClientNetworkHost 0x720d6:$x2: IClientNetworkHost 0x33339:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x412ab:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 4928	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 4928	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x31e9:$a: NanoCore 0x802b:$a: NanoCore 0x80cc:$a: NanoCore 0x8139:$a: NanoCore 0x81fa:$a: NanoCore 0x90cb:$a: NanoCore 0x911e:$a: NanoCore 0x9157:$a: NanoCore 0x91ca:$a: NanoCore 0xdc72:$a: NanoCore 0xdc9f:$a: NanoCore 0xdcf8:$a: NanoCore 0x15507:$a: NanoCore 0x1551a:$a: NanoCore 0x1554c:$a: NanoCore 0x1eff9:$a: NanoCore 0x1f026:$a: NanoCore 0x1f07f:$a: NanoCore 0x2688e:$a: NanoCore 0x268a1:$a: NanoCore 0x268d3:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 5912	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x38c3d:$x1: NanoCore.ClientPluginHost 0x575bc:$x1: NanoCore.ClientPluginHost 0x75e50:$x1: NanoCore.ClientPluginHost 0x38c9e:$x2: IClientNetworkHost 0x5761d:$x2: IClientNetworkHost 0x75eb1:$x2: IClientNetworkHost 0x3e0a3:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4c015:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5ca22:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6a994:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7b2b6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x89228:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 5912	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 5912	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x38742:$a: NanoCore 0x3875e:$a: NanoCore 0x388b9:$a: NanoCore 0x388c8:$a: NanoCore 0x38ba1:$a: NanoCore 0x38bcd:$a: NanoCore 0x38c3d:$a: NanoCore 0x4867f:$a: NanoCore 0x48691:$a: NanoCore 0x486cd:$a: NanoCore 0x570c1:$a: NanoCore 0x570dd:$a: NanoCore 0x57238:$a: NanoCore 0x57247:$a: NanoCore 0x57520:$a: NanoCore 0x5754c:$a: NanoCore 0x575bc:$a: NanoCore 0x66ffe:$a: NanoCore 0x67010:$a: NanoCore 0x6704c:$a: NanoCore 0x75955:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 788	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x41d0:$x1: NanoCore.ClientPluginHost 0x48363:$x1: NanoCore.ClientPluginHost 0x54e86:$x1: NanoCore.ClientPluginHost 0x5aa45:$x1: NanoCore.ClientPluginHost 0x6bde2:$x1: NanoCore.ClientPluginHost 0x4231:$x2: IClientNetworkHost 0x48389:$x2: IClientNetworkHost 0x54eac:$x2: IClientNetworkHost 0x5aa8a:$x2: IClientNetworkHost 0x6be27:$x2: IClientNetworkHost 0x9636:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x175a8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 788	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 788	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3cd5:$a: NanoCore 0x3cf1:$a: NanoCore 0x3e4c:$a: NanoCore 0x3e5b:$a: NanoCore 0x4134:$a: NanoCore 0x4160:$a: NanoCore 0x41d0:$a: NanoCore 0x13c12:$a: NanoCore 0x13c24:$a: NanoCore 0x13c60:$a: NanoCore 0x206a6:$a: NanoCore 0x2070e:$a: NanoCore 0x207ea:$a: NanoCore 0x48255:$a: NanoCore 0x482f6:$a: NanoCore 0x48363:$a: NanoCore 0x48424:$a: NanoCore 0x492f5:$a: NanoCore 0x49348:$a: NanoCore 0x49381:$a: NanoCore 0x493f4:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 4352	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x34a7d:$x1: NanoCore.ClientPluginHost 0x533fc:$x1: NanoCore.ClientPluginHost 0x71ccf:$x1: NanoCore.ClientPluginHost 0x34ade:$x2: IClientNetworkHost 0x5345d:$x2: IClientNetworkHost 0x71d30:$x2: IClientNetworkHost 0x39ee3:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x47e55:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x58862:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x667d4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x77135:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x850a7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 4352	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 4352	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x34582:$a: NanoCore 0x3459e:$a: NanoCore 0x346f9:$a: NanoCore 0x34708:$a: NanoCore 0x349e1:$a: NanoCore 0x34a0d:$a: NanoCore 0x34a7d:$a: NanoCore 0x444bf:$a: NanoCore 0x444d1:$a: NanoCore 0x4450d:$a: NanoCore 0x52f01:$a: NanoCore 0x52f1d:$a: NanoCore 0x53078:$a: NanoCore 0x53087:$a: NanoCore 0x53360:$a: NanoCore 0x5338c:$a: NanoCore 0x533fc:$a: NanoCore 0x62e3e:$a: NanoCore 0x62e50:$a: NanoCore 0x62e8c:$a: NanoCore 0x717d4:$a: NanoCore
Process Memory Space: Paypal Payment Authorization pdf.exe PID: 6136	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1a354:$a: NanoCore 0x1a391:$a: NanoCore 0x1a41a:$a: NanoCore 0x1f7b2:$a: NanoCore 0x1f7d5:$a: NanoCore 0x1f82a:$a: NanoCore 0x24c6d:$a: NanoCore 0x24cab:$a: NanoCore 0x24d37:$a: NanoCore 0x2f6d4:$a: NanoCore 0x2f6f8:$a: NanoCore 0x2f750:$a: NanoCore 0x3736c:$a: NanoCore 0x3740d:$a: NanoCore 0x37470:$a: NanoCore 0x37826:$a: NanoCore 0x37902:$a: NanoCore 0x3836f:$a: NanoCore 0x38554:$a: NanoCore 0x385a3:$a: NanoCore 0x385f6:$a: NanoCore
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Click to see the 7 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe, ProcessId: 6136, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp2E95.tmp', CommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp2E95.tmp', CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe, ParentImage: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe, ParentProcessId: 6136, ProcessCommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp2E95.tmp', ProcessId: 2800

Sigma detected: Conhost Parent Proces Executions

Show sources

Source: Process started

Author: omkar72: Data: Command: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, CommandLine: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, NewProcessName: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, OriginalFileName: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, ParentCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 4352, ProcessCommandLine: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, ProcessId: 788

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: Paypal Payment Authorization pdf.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Found malware configuration

Show sources

Source: Paypal Payment Authorization pdf.exe.4348.7.memstr

Malware Configuration Extractor: NanoCore {"C2: ": ["185.244.38.210"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Show sources

Source: Paypal Payment Authorization pdf.exe

ReversingLabs: Detection: 52%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.282400561.00000000027E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.268198186.0000000003809000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.282484135.00000000037E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.268089458.0000000002801000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544, type: MEMORY
Source: Yara match	File source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348, type: MEMORY
Source: Yara match	File source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4928, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5912, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 788, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4352, type: MEMORY
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: Paypal Payment Authorization pdf.exe

Joe Sandbox ML: detected

Source: 8.2.dhcpmon.exe.470000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.0.Paypal Payment Authorization pdf.exe.440000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 6.2.Paypal Payment Authorization pdf.exe.930000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 12.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.450000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 8.0.dhcpmon.exe.470000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 6.0.Paypal Payment Authorization pdf.exe.930000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 10.0.dhcpmon.exe.9d0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.2.dhcpmon.exe.450000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 9.0.dhcpmon.exe.450000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 9.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.2.Paypal Payment Authorization pdf.exe.630000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 7.0.Paypal Payment Authorization pdf.exe.630000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 10.2.dhcpmon.exe.9d0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 0.2.Paypal Payment Authorization pdf.exe.440000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 1.0.Paypal Payment Authorization pdf.exe.ab0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 12.2.dhcpmon.exe.450000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen

Source: Paypal Payment Authorization pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Paypal Payment Authorization pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RunPE.pdb source: Paypal Payment Authorization pdf.exe, 00000000.00000002.229334209.0000000002831000.00000004.00000001.sdmp, Paypal Payment Authorization pdf.exe, 00000006.00000002.243331552.0000000002E71000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.248280032.00000000028D1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.267476892.0000000002D01000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp
Source:	Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp
Source:	Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

IPs: 185.244.38.210

Source: global traffic

TCP traffic: 192.168.2.7:49721 -> 185.244.38.210:7008

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210

Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp

String found in binary or memory: http://google.com

Source: Paypal Payment Authorization pdf.exe, 00000000.00000002.229112118.0000000000C4B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Paypal Payment Authorization pdf.exe, 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.282400561.00000000027E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.268198186.0000000003809000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.282484135.00000000037E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.268089458.0000000002801000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544, type: MEMORY
Source: Yara match	File source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348, type: MEMORY
Source: Yara match	File source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4928, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5912, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 788, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4352, type: MEMORY
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.282400561.00000000027E1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.268198186.0000000003809000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.282484135.00000000037E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.268089458.0000000002801000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.264137814.0000000002988000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 4928, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 4928, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5912, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5912, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 788, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 788, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 4352, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 4352, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 6136, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Paypal Payment Authorization pdf.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Paypal Payment Authorization pdf.exe

Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 6_2_012E20A8	6_2_012E20A8
Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 6_2_012E3239	6_2_012E3239
Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 6_2_012E2FE8	6_2_012E2FE8
Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 6_2_012E2FD8	6_2_012E2FD8
Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 7_2_028FE480	7_2_028FE480
Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 7_2_028FE471	7_2_028FE471
Source: C:\Users\user\Desktop\Paypal Payment Authorization pdf.exe	Code function: 7_2_028FBBD4	7_2_028FBBD4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_00E820A8	8_2_00E820A8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_00E83008	8_2_00E83008
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_00E83272	8_2_00E83272
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_04D84A50	9_2_04D84A50
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_04D83E30	9_2_04D83E30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 9_2_04D84B08	9_2_04D84B08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_012820B3	10_2_012820B3
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_01283239	10_2_01283239
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_01283248	10_2_01283248
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_01282FE8	10_2_01282FE8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_01282FDB	10_2_01282FDB
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_0100E471	12_2_0100E471
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_0100E480	12_2_0100E480
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_0100BBD4	12_2_0100BBD4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_04E54A50	12_2_04E54A50
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_04E53E30	12_2_04E53E30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_04E54B08	12_2_04E54B08

Source: Paypal Payment Authorization pdf.exe, 00000000.00000002.229334209.0000000002831000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPE.dll" vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000000.00000002.229112118.0000000000C4B000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNanoCoreBase.dll< vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFileBrowserClient.dllT vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMyClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMyClientPlugin.dll@ vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNAudio.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000006.00000002.243331552.0000000002E71000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPE.dll" vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Paypal Payment Authorization pdf.exe
Source: Paypal Payment Authorization pdf.exe, 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Paypal Payment Authorization pdf.exe

Source: Paypal Payment Authorization pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.281240988.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.264202941.0000000003959000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.248761049.0000000004A77000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.282400561.00000000027E1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.268198186.0000000003809000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.257617015.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.266349011.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.248386256.00000000038D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.282484135.00000000037E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.229389547.0000000003839000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.268089458.0000000002801000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.264137814.0000000002988000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.243400566.0000000003E79000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.267647233.0000000003D09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4544, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 4348, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 5444, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 4928, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 4928, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5912, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5912, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 788, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 788, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 4352, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 4352, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Paypal Payment Authorization pdf.exe PID: 6136, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Paypal Payment Authorization pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Paypal Payment Authorization pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary: