Play interactive tour

Edit tour

Analysis Report TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Overview

General Information

Sample Name:	TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
Analysis ID:	343026
MD5:	d40d97b41a353bc42b0e7ebe451886d9
SHA1:	8e416c76489782a32eade1b03bcd26dce3f19a82
SHA256:	23b46a12d6b6a703b8e588d24f3c0018cf749556b021b514b963587e7adaa25b
Tags:	EXENanoCore
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE (PID: 5816 cmdline: 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE' MD5: D40D97B41A353BC42B0E7EBE451886D9)

conhost.exe (PID: 1372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

MSBuild.exe (PID: 2204 cmdline: 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE' MD5: D621FD77BD585874F9686D3A76462EF1)

schtasks.exe (PID: 7024 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6764 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp7609.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

MSBuild.exe (PID: 6908 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 0 MD5: D621FD77BD585874F9686D3A76462EF1)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 6968 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: D621FD77BD585874F9686D3A76462EF1)

conhost.exe (PID: 6796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 2480 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: D621FD77BD585874F9686D3A76462EF1)

conhost.exe (PID: 6080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: NanoCore

{"C2: ": ["91.193.75.155"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x356d:$a: NanoCore 0x35c6:$a: NanoCore 0x3603:$a: NanoCore 0x367c:$a: NanoCore 0x16d27:$a: NanoCore 0x16d3c:$a: NanoCore 0x16d71:$a: NanoCore 0x2fd33:$a: NanoCore 0x2fd48:$a: NanoCore 0x2fd7d:$a: NanoCore 0x35cf:$b: ClientPlugin 0x360c:$b: ClientPlugin 0x3f0a:$b: ClientPlugin 0x3f17:$b: ClientPlugin 0x16ae3:$b: ClientPlugin 0x16afe:$b: ClientPlugin 0x16b2e:$b: ClientPlugin 0x16d45:$b: ClientPlugin 0x16d7a:$b: ClientPlugin 0x2faef:$b: ClientPlugin 0x2fb0a:$b: ClientPlugin
00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
Process Memory Space: MSBuild.exe PID: 2204	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe43ff:$x1: NanoCore.ClientPluginHost 0x159f98:$x1: NanoCore.ClientPluginHost 0x15fb57:$x1: NanoCore.ClientPluginHost 0x170f1d:$x1: NanoCore.ClientPluginHost 0x2d0f44:$x1: NanoCore.ClientPluginHost 0x2d7841:$x1: NanoCore.ClientPluginHost 0x30f8e1:$x1: NanoCore.ClientPluginHost 0xe4444:$x2: IClientNetworkHost 0x159fbe:$x2: IClientNetworkHost 0x15fb9c:$x2: IClientNetworkHost 0x170f62:$x2: IClientNetworkHost 0x2d0f6a:$x2: IClientNetworkHost 0x2d78a2:$x2: IClientNetworkHost 0x30f907:$x2: IClientNetworkHost 0x2dcca7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2eac19:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: MSBuild.exe PID: 2204	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: MSBuild.exe PID: 2204	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x78e11:$a: NanoCore 0x78e79:$a: NanoCore 0x78f66:$a: NanoCore 0xe4379:$a: NanoCore 0xe43a6:$a: NanoCore 0xe43ff:$a: NanoCore 0xebc0e:$a: NanoCore 0xebc21:$a: NanoCore 0xebc53:$a: NanoCore 0x159e8a:$a: NanoCore 0x159f2b:$a: NanoCore 0x159f98:$a: NanoCore 0x15a059:$a: NanoCore 0x15af2a:$a: NanoCore 0x15af7d:$a: NanoCore 0x15afb6:$a: NanoCore 0x15b029:$a: NanoCore 0x15fad1:$a: NanoCore 0x15fafe:$a: NanoCore 0x15fb57:$a: NanoCore 0x167366:$a: NanoCore
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
3.2.MSBuild.exe.6580000.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
3.2.MSBuild.exe.6580000.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
3.2.MSBuild.exe.6580000.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.2.MSBuild.exe.64f0000.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
3.2.MSBuild.exe.64f0000.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
3.2.MSBuild.exe.6580000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
3.2.MSBuild.exe.6580000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
3.2.MSBuild.exe.6580000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.MSBuild.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.2.MSBuild.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.MSBuild.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Click to see the 15 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 2204, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp', CommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp', CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE' , ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 2204, ProcessCommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp', ProcessId: 7024

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: MSBuild.exe.2204.3.memstr

Malware Configuration Extractor: NanoCore {"C2: ": ["91.193.75.155"], "Version: ": "NanoCore Client, Version=1.2.2.0"}

Multi AV Scanner detection for submitted file

Show sources

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Metadefender: Detection: 18%			Perma Link
Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	ReversingLabs: Detection: 59%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Joe Sandbox ML: detected

Source: 3.2.MSBuild.exe.6580000.4.unpack	Avira: Label: TR/NanoCore.fadte
Source: 3.2.MSBuild.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Show sources

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb%0 source: MSBuild.exe, 00000003.00000003.941644723.0000000001268000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: MSBuild.exe, 00000003.00000003.950346541.000000000126D000.00000004.00000001.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: dhcpmon.exe, dhcpmon.exe.3.dr
Source:	Binary string: wntdll.pdbUGP source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE, 00000001.00000003.652861148.000000001BC10000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE, 00000001.00000003.652861148.000000001BC10000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MSBuild.exe, 00000003.00000003.941644723.0000000001268000.00000004.00000001.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: MSBuild.exe, 00000003.00000003.950311338.000000000125D000.00000004.00000001.sdmp
Source:	Binary string: System.pdbU! source: MSBuild.exe, 00000003.00000003.941616893.000000000125D000.00000004.00000001.sdmp
Source:	Binary string: System.pdb source: MSBuild.exe, 00000003.00000003.996753411.0000000006976000.00000004.00000001.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49737 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49738 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49741 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49743 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49744 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49752 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49758 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49762 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49768 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49769 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49770 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49771 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49772 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49775 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49776 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49777 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49778 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49779 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49780 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49781 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49782 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49783 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49784 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49785 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49786 -> 91.193.75.155:5090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49787 -> 91.193.75.155:5090

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

IPs: 91.193.75.155

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: mimi121.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 91.193.75.155:5090

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220
Source: unknown	TCP traffic detected without corresponding DNS query: 92.122.145.220

Source: unknown

DNS traffic detected: queries for: mimi121.duckdns.org

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: MSBuild.exe, 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.MSBuild.exe.64f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A558CB
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A65810
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A64ACF
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A653DB
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A65C45
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A64FC3
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A58F0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0541E471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0541E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0541BBD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_06A70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_006C5CF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_006C18C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_006C2148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_006C4A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_006C2133
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_02E35858
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_02E34580
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_02E32148
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_02E31A40
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_02E32133

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: String function: 00A54E1D appears 36 times
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: String function: 00A554B0 appears 58 times

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE, 00000001.00000003.653347801.000000001BEBF000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.MSBuild.exe.64f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.MSBuild.exe.64f0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: dhcpmon.exe.3.dr, Microsoft.Build/CommandLine/OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: dhcpmon.exe.3.dr, Microsoft.Build/BackEnd/TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: dhcpmon.exe.3.dr, Microsoft.Build/Shared/RegisteredTaskObjectCacheBase.cs	Task registration methods: '.cctor', 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', '.ctor', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: 15.2.dhcpmon.exe.10000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.2.dhcpmon.exe.10000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: dhcpmon.exe.3.dr, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: dhcpmon.exe.3.dr, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: dhcpmon.exe.3.dr, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: dhcpmon.exe.3.dr, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: dhcpmon.exe.3.dr, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 12.0.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 12.0.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.0.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.0.dhcpmon.exe.10000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.0.dhcpmon.exe.10000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 15.0.dhcpmon.exe.10000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 15.2.dhcpmon.exe.10000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.2.dhcpmon.exe.10000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 15.2.dhcpmon.exe.10000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 12.2.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 12.2.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 15.0.dhcpmon.exe.10000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.0.dhcpmon.exe.10000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: dhcpmon.exe, dhcpmon.exe.3.dr	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: dhcpmon.exe, 0000000F.00000002.684375210.0000000002381000.00000004.00000001.sdmp	Binary or memory string: *.slnP#"l
Source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD
Source: dhcpmon.exe, 0000000F.00000002.684375210.0000000002381000.00000004.00000001.sdmp	Binary or memory string: l)C:\Program Files (x86)\DHCP Monitor\*.sln
Source: dhcpmon.exe, dhcpmon.exe.3.dr	Binary or memory string: *.sln
Source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr	Binary or memory string: /ignoreprojectextensions:.sln
Source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal100.troj.evad.winEXE@16/11@26/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{c536defd-5b4b-4102-b411-7da22a027e3a}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6796:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1372:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\tmp731A.tmp

Jump to behavior

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Metadefender: Detection: 18%
Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	ReversingLabs: Detection: 59%

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

File read: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp7609.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 0
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp7609.tmp'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb%0 source: MSBuild.exe, 00000003.00000003.941644723.0000000001268000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: MSBuild.exe, 00000003.00000003.950346541.000000000126D000.00000004.00000001.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: dhcpmon.exe, dhcpmon.exe.3.dr
Source:	Binary string: wntdll.pdbUGP source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE, 00000001.00000003.652861148.000000001BC10000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE, 00000001.00000003.652861148.000000001BC10000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MSBuild.exe, 00000003.00000003.941644723.0000000001268000.00000004.00000001.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: MSBuild.exe, 00000003.00000003.657703157.0000000001222000.00000004.00000001.sdmp, dhcpmon.exe, 0000000C.00000000.664261186.0000000000C72000.00000002.00020000.sdmp, dhcpmon.exe, 0000000F.00000002.683748941.0000000000012000.00000002.00020000.sdmp, dhcpmon.exe.3.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: MSBuild.exe, 00000003.00000003.950311338.000000000125D000.00000004.00000001.sdmp
Source:	Binary string: System.pdbU! source: MSBuild.exe, 00000003.00000003.941616893.000000000125D000.00000004.00000001.sdmp
Source:	Binary string: System.pdb source: MSBuild.exe, 00000003.00000003.996753411.0000000006976000.00000004.00000001.sdmp

Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Code function: 1_2_00A5EAF3 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A554F5 push ecx; ret
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_02E35578 push FFFFFF8Bh; iretd

Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

File created: \tnt shipment awb_image ci_from tnt awb# 167095453_pdf_________.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe:Zone.Identifier read attributes | delete

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 3615
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 5800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: foregroundWindowGot 488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: foregroundWindowGot 1403

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6888	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4612	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 3120	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1172	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: MSBuild.exe, 00000003.00000002.1047891246.00000000070C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: MSBuild.exe, 00000003.00000002.1047891246.00000000070C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: MSBuild.exe, 00000003.00000002.1047891246.00000000070C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: MSBuild.exe, 00000003.00000003.936447868.0000000001230000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000003.00000002.1047891246.00000000070C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Anti Debugging:

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A51E50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_008FEAC5 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_008FF3D4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_008FF334 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_008FF371 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_008FF519 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Code function: 1_2_00A51FD0 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapAlloc,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A54BE6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: 1_2_00A54BC3 SetUnhandledExceptionFilter,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: dhcpmon.exe.3.dr, Microsoft.Build/Shared/NativeMethodsShared.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 3.2.MSBuild.exe.400000.0.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.cs	Reference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
Source: 12.0.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 12.2.dhcpmon.exe.c70000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 15.0.dhcpmon.exe.10000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 15.2.dhcpmon.exe.10000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: execute and read and write

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: DA2008

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp7609.tmp'

Source: MSBuild.exe, 00000003.00000002.1042604643.00000000030E8000.00000004.00000001.sdmp	Binary or memory string: Program ManagerD$\k
Source: MSBuild.exe, 00000003.00000002.1047063541.000000000616D000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000003.00000002.1042222236.00000000018C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000003.00000002.1042222236.00000000018C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: MSBuild.exe, 00000003.00000002.1044112934.000000000355D000.00000004.00000001.sdmp	Binary or memory string: Program ManagerX
Source: MSBuild.exe, 00000003.00000002.1043649373.00000000034A0000.00000004.00000001.sdmp	Binary or memory string: Program Managerx
Source: MSBuild.exe, 00000003.00000002.1042222236.00000000018C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: MSBuild.exe, 00000003.00000002.1043649373.00000000034A0000.00000004.00000001.sdmp	Binary or memory string: Program ManagerHa\k

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Code function: 1_2_00A5BFC2 cpuid

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: GetLocaleInfoEx,__wcsnicmp,_TestDefaultCountry,_TestDefaultCountry,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeW,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: EnumSystemLocalesEx,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: GetLocaleInfoEx,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,
Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation

Source: C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Code function: 1_2_00A5C9C7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter,

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: MSBuild.exe, 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 2204, type: MEMORY
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.ab0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.6580000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job11	Scheduled Task/Job11	Process Injection212	Masquerading2	Input Capture11	System Time Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API11	Boot or Logon Initialization Scripts	Scheduled Task/Job11	Virtualization/Sandbox Evasion2	LSASS Memory	Security Software Discovery31	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection212	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information11	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol22	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery33	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing11	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	24%	Metadefender		Browse
TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	59%	ReversingLabs	Win32.Spyware.Noon
TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE.e30000.2.unpack	100%	Avira	HEUR/AGEN.1110392	Download File
3.2.MSBuild.exe.6580000.4.unpack	100%	Avira	TR/NanoCore.fadte	Download File
3.2.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mimi121.duckdns.org	91.193.75.155	true	true		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.193.75.155	unknown	Serbia		209623	DAVID_CRAIGGG	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	343026
Start date:	22.01.2021
Start time:	07:29:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@16/11@26/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 57.2% (good quality ratio 52.8%) Quality average: 81.9% Quality standard deviation: 30.4%
HCA Information:	Successful, ratio: 96% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .EXE
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 104.43.193.48, 51.11.168.160, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129, 2.20.142.209, 2.20.142.210 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcolcus15.cloudapp.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net Report size exceeded maximum capacity and may have missing behavior information. VT rate limit hit for: /opt/package/joesandbox/database/analysis/343026/sample/TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Simulations

Behavior and APIs

Time	Type	Description
07:30:33	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
07:30:34	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" s>$(Arg0)
07:30:34	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
07:30:34	API Interceptor	1546x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
91.193.75.155	file.exe	Get hash	malicious	Browse
	Enquiry No ANS700_Pdf___.exe	Get hash	malicious	Browse
	Enquiry No ANS700_Pdf___.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mimi121.duckdns.org	file.exe	Get hash	malicious	Browse	91.193.75.155
	Enquiry No ANS700_Pdf___.exe	Get hash	malicious	Browse	91.193.75.155
	Enquiry No ANS700_Pdf___.exe	Get hash	malicious	Browse	91.193.75.155

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	9A87wdxsuh.exe	Get hash	malicious	Browse	91.193.75.204
	PROOF OF PAYMENT.exe	Get hash	malicious	Browse	185.140.53.131
	SecuriteInfo.com.Artemis1A5E2411DEA6.exe	Get hash	malicious	Browse	91.193.75.204
	Payment Invoice PDF.exe	Get hash	malicious	Browse	185.244.30.18
	New Doc 20211401#_our new price.exe	Get hash	malicious	Browse	91.193.75.243
	company profile.exe	Get hash	malicious	Browse	185.140.53.227
	NEWORDERrefno0992883jpg.exe	Get hash	malicious	Browse	185.140.53.253
	richiealvin.exe	Get hash	malicious	Browse	91.193.75.185
	Quotation.exe	Get hash	malicious	Browse	185.140.53.154
	DHL Delivery Shipping Cargo. Pdf.exe	Get hash	malicious	Browse	185.244.30.18
	CompanyLicense.exe	Get hash	malicious	Browse	185.140.53.253
	Purchase Order 2094742424.exe	Get hash	malicious	Browse	185.244.30.132
	PURCHASE OREDER. PRINT. pdf.exe	Get hash	malicious	Browse	91.193.75.45
	PO.exe	Get hash	malicious	Browse	185.140.53.234
	SWIFT.exe	Get hash	malicious	Browse	185.140.53.154
	SecuriteInfo.com.BScope.Trojan-Dropper.Injector.exe	Get hash	malicious	Browse	185.140.53.234
	PROOF OF PAYMENT.exe	Get hash	malicious	Browse	185.140.53.131
	Orden n.#U00ba STL21119, pdf.exe	Get hash	malicious	Browse	185.140.53.129
	Proof of Payment.exe	Get hash	malicious	Browse	185.244.30.51
	DxCHoDnNLn.exe	Get hash	malicious	Browse	185.140.53.202

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	New Order_PO#060317_007_Pdf________________________________________.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	jCLiY7TCmD.exe	Get hash	malicious	Browse
	WkyJ4e1mGH.exe	Get hash	malicious	Browse
	Enquiry No ANS700_Pdf___.exe	Get hash	malicious	Browse
	Enquiry No ANS700_Pdf___.exe	Get hash	malicious	Browse
	P.I - AE-SA-10016 - SIG SHARBTLY INTERNATIONAL GROUP.exe	Get hash	malicious	Browse
	Purchase Order 40,7045.exe	Get hash	malicious	Browse
	PAYMENT ADVICE.exe	Get hash	malicious	Browse
	Swift Copy.exe	Get hash	malicious	Browse
	Quotation Request-RFQ#2020-11-19.exe	Get hash	malicious	Browse
	Api Details.exe	Get hash	malicious	Browse
	BALANCE PAYMENT.exe	Get hash	malicious	Browse
	5dj4XCE86M.exe	Get hash	malicious	Browse
	z865yM9Ehy.exe	Get hash	malicious	Browse
	EXPORT SHIPMENT CERTIFIED 2.exe	Get hash	malicious	Browse
	4IZjnTicql.exe	Get hash	malicious	Browse
	K1Rul7dwGf.exe	Get hash	malicious	Browse
	14RP4w9CuA.exe	Get hash	malicious	Browse
	Bx757nPqML.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	261728
Entropy (8bit):	6.1750840449797675
Encrypted:	false
SSDEEP:	3072:Mao0QHGUQWWimj9q/NLpj/WWqvAw2XpFU4rwOe4ubZSif02RFi/x2uv9FeP:boZTTWxxqVpqWVRXfr802biprVu
MD5:	D621FD77BD585874F9686D3A76462EF1
SHA1:	ABCAE05EE61EE6292003AABD8C80583FA49EDDA2
SHA-256:	2CA7CF7146FB8209CF3C6CECB1C5AA154C61E046DC07AFA05E8158F2C0DDE2F6
SHA-512:	2D85A81D708ECC8AF9A1273143C94DA84E632F1E595E22F54B867225105A1D0A44F918F0FAE6F1EB15ECF69D75B6F4616699776A16A2AA8B5282100FD15CA74C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: New Order_PO#060317_007_Pdf________________________________________.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: jCLiY7TCmD.exe, Detection: malicious, Browse Filename: WkyJ4e1mGH.exe, Detection: malicious, Browse Filename: Enquiry No ANS700_Pdf___.exe, Detection: malicious, Browse Filename: Enquiry No ANS700_Pdf___.exe, Detection: malicious, Browse Filename: P.I - AE-SA-10016 - SIG SHARBTLY INTERNATIONAL GROUP.exe, Detection: malicious, Browse Filename: Purchase Order 40,7045.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE.exe, Detection: malicious, Browse Filename: Swift Copy.exe, Detection: malicious, Browse Filename: Quotation Request-RFQ#2020-11-19.exe, Detection: malicious, Browse Filename: Api Details.exe, Detection: malicious, Browse Filename: BALANCE PAYMENT.exe, Detection: malicious, Browse Filename: 5dj4XCE86M.exe, Detection: malicious, Browse Filename: z865yM9Ehy.exe, Detection: malicious, Browse Filename: EXPORT SHIPMENT CERTIFIED 2.exe, Detection: malicious, Browse Filename: 4IZjnTicql.exe, Detection: malicious, Browse Filename: K1Rul7dwGf.exe, Detection: malicious, Browse Filename: 14RP4w9CuA.exe, Detection: malicious, Browse Filename: Bx757nPqML.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z.........."...0..\|...B......n.... ........@.. ....................................`.....................................O........>..............`>.......................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc....>.......@...~..............@..@.reloc..............................@..B................P.......H.......8)...................\|..........................................{.......v.(=....r...p({...-..+..}........0..%........(....-......(z.....&..}..............................0..5........(....-...-.r+..ps>...z.....i(z.....&..}......................%......>....(?...(....N..(@....oA...(....:...(B...(....:...(C...(....*....(........0..G........(....,....(....-...}......r...p(x...&.(v.....}......&..}....................7.......0..f........-.r7..ps>...z .....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	841
Entropy (8bit):	5.356220854328477
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoIvEE4xDqE4j:MxHKXwYHKhQnoPtHoxHwvEHxDqHj
MD5:	486580834B084C92AE1F3866166C9C34
SHA1:	C8EB7E1CEF55A6C9EB931487E9AA4A2098AACEDF
SHA-256:	65C5B1213E371D449E2A239557A5F250FEA1D3473A1B5C4C5FF7492085F663FB
SHA-512:	2C54B638A52AA87F47CAB50859EFF98F07DA02993A596686B5617BA99E73ABFCD104F0F33209E24AFB32E66B4B8A225D4DB2CC79631540C21E7E8C4573DFD457
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..2,"Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1037
Entropy (8bit):	5.371216502395632
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7KvEE4xDqE4j:MxHKXwYHKhQnoPtHoxHhAHKzvKvEHxD0
MD5:	C7F28B87C2CAD111D929CB9A0FF822F8
SHA1:	C2CF9E7A3F6EFD9000FE76EBE54E4E9AE5754267
SHA-256:	D1B02C20EACF464229AB063FA947A525E2ED7772259A8F70C7205DC13599EAE6
SHA-512:	E0F35874E02AB672CFF0553A0DA0864DAB14C05733D06395E4D0C9CDFC6F445E940310F8D01E3E1B28895F636DFBC1F510E103D1C46818400BA4E7371D8F254D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp731A.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	5.137611098420233
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0moxtn:cbk4oL600QydbQxIYODOLedq3Zoj
MD5:	3E2B26ED8B75AE83A269595180E84EF6
SHA1:	D30A0335FCCE406BCA8BA5764288235E6192F608
SHA-256:	108BE30AEB8EB31C185A39A6726F26DACBC4E4124951C61A29ADE4B7038C71EA
SHA-512:	B6981C68FCB886CC8379A068B96931B9D4F5CC5AA9BDC467E36C4168FE6C5273A2A84D8850B12C11703EC03AC6B1F1950D1E669EFCB59FC2402CE4BBA9DC03D3
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp7609.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	7.024371743172393
Encrypted:	false
SSDEEP:	48:Ik/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrw8:flC0IlC0IlC0IlC0IlC0IlC0IlC08
MD5:	0D79388CEC6619D612C2088173BB6741
SHA1:	8A312E3198009C545D0CF3254572189D29A03EA7
SHA-256:	D7D423B23D932E306F3CCB2F7A984B7036A042C007A43FD655C6B57B960BB8DF
SHA-512:	53BB3E9263DFD746E7E8159466E220E6EC9D81E9D3F0E1D191E09CD511B7EB93B0BA65D13CE0C97C652ECD0F69BB991E6B1840F961BC65003C4DD7AA93EEDA13
Malicious:	false
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:6VQ:6e
MD5:	80AF87D7D4711FE01B9BD93DEA99B562
SHA1:	85CA7BA9B80AEB0AF92FD9B3B394B1D86FE4C76C
SHA-256:	BD368AEEC8818B4106F481C92B7D242B079FAA718AD109E6D8779F613D1AB6FB
SHA-512:	5C55593F43C186EF0992AB60935877EA13EFD11310B98915414E50E2A5955B6ADEE4A79940C46C5CE838D2592BD1524728FB071C062A20BAA3208D8B479E6501
Malicious:	true
Preview:	...8...H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.887726803973036
Encrypted:	false
SSDEEP:	3:oMty8WddSJ8:oMLW6C
MD5:	6ECAFC0490DAB08E4A288E0042B6B613
SHA1:	4A4529907588505FC65CC9933980CFE6E576B3D6
SHA-256:	DC5F76FBF44B3E6CDDC14EA9E5BB9B6BD3A955197FE13F33F7DDA7ECC08E79E0
SHA-512:	7DA2B02627A36C8199814C250A1FBD61A9C18E098F8D691C11D75044E7F51DBD52C31EC2E1EA8CDEE5077ADCCB8CD247266F191292DB661FE7EA1B613FC646F8
Malicious:	false
Preview:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

\Device\ConDrv Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.943030742860529
Encrypted:	false
SSDEEP:	6:zx3M1tFAbQtU1R30qyMstwYVoRRZBXVN+J0fFdCsq2UTiMdH8stCal+n:zK13I30ZMt9BFN+QdCT2UftCM+
MD5:	6A9888952541A41F033EB114C24DC902
SHA1:	41903D7C8F31013C44572E09D97B9AAFBBCE77E6
SHA-256:	41A61D0084CD7884BEA1DF02ED9213CB8C83F4034F5C8156FC5B06D6A3E133CE
SHA-512:	E6AC898E67B4052375FDDFE9894B26D504A7827917BF3E02772CFF45C3FA7CC5E0EFFDC701D208E0DB89F05E42F195B1EC890F316BEE5CB8239AB45444DAA65E
Malicious:	false
Preview:	Microsoft (R) Build Engine version 4.7.3056.0..[Microsoft .NET Framework, version 4.0.30319.42000]..Copyright (C) Microsoft Corporation. All rights reserved.....MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file...

Static File Info

General
File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.925960933213739
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
File size:	542720
MD5:	d40d97b41a353bc42b0e7ebe451886d9
SHA1:	8e416c76489782a32eade1b03bcd26dce3f19a82
SHA256:	23b46a12d6b6a703b8e588d24f3c0018cf749556b021b514b963587e7adaa25b
SHA512:	85d6c292351f8ff836337c9ace1c38e3f65cb15268d160c9f5e5f8f52ee7284834fa1c4a022bc58204664cf35ea348b802ff01d3f0d2b64b56b6bd4eb963c65d
SSDEEP:	6144:qJa6HhHoWXBuRPh6DnN+2gUFKLpGbNLpvlKK01gBxF8uUzeSg2ZDqnB8lRBYc:YlZYRsLN4cKLpGbNTjDF8u8JvKBkTj
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......JH.*.).y.).y.).y..qy.).y..yy/).y..{y.).y..xy.).y.).yr).y.^.y.).y).xy.).y)..y.).y).zy.).yRich.).y................PE..L...tt.`...

File Icon


Icon Hash:	70cccecececcec30

Static PE Info

General
Entrypoint:	0x404ad0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60097474 [Thu Jan 21 12:32:52 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	50cdb1b392e09bc322ca35e8f4935cd6

Entrypoint Preview

Instruction
call 00007FF2448D2107h
jmp 00007FF2448CA056h
and dword ptr [00420D24h], 00000000h
ret
push ebp
mov ebp, esp
push ecx
and dword ptr [ebp-04h], 00000000h
push 0041A29Ch
push 0041A2B0h
call dword ptr [0041A100h]
push eax
call dword ptr [0041A0D4h]
test eax, eax
je 00007FF2448CA224h
push 00000000h
lea ecx, dword ptr [ebp-04h]
push ecx
call eax
cmp eax, 7Ah
jne 00007FF2448CA217h
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call dword ptr [0041A0E4h]
pop ebp
ret
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call dword ptr [0041A0F0h]
pop ebp
ret
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call dword ptr [0041A0E8h]
pop ebp
ret
push ebp
mov ebp, esp
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call dword ptr [0041A0ECh]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 44h
lea eax, dword ptr [ebp-44h]
push eax
call dword ptr [0041A0FCh]
test byte ptr [ebp-18h], 00000001h
je 00007FF2448CA218h
movzx eax, word ptr [ebp-14h]
leave
ret
push 0000000Ah
pop eax
leave
ret
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [0041F368h]
test esi, esi
jns 00007FF2448CA245h
push 0041A29Ch
xor esi, esi
push 0041A2B0h
mov dword ptr [ebp-04h], esi
call dword ptr [00000000h]

Rich Headers

Programming Language:

[LNK] VS2012 build 50727
[RES] VS2012 build 50727
[ C ] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d564	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x327d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x55000	0xfdc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1cd18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x210	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18994	0x18a00	False	0.526233343909	data	6.49084256108	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x418e	0x4200	False	0.352095170455	data	4.70513234879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x2d60	0x1000	False	0.206787109375	data	2.47644845022	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x327d8	0x32800	False	0.384548073948	data	5.23228179627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x55000	0x123c	0x1400	False	0.6751953125	data	5.88808398568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x22280	0x8f02	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	Taiwan
RT_ICON	0x2b188	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	Chinese	Taiwan
RT_ICON	0x3b9b0	0x94a8	data	Chinese	Taiwan
RT_ICON	0x44e58	0x5488	data	Chinese	Taiwan
RT_ICON	0x4a2e0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 15794175, next used block 4294909696	Chinese	Taiwan
RT_ICON	0x4e508	0x25a8	data	Chinese	Taiwan
RT_ICON	0x50ab0	0x10a8	data	Chinese	Taiwan
RT_ICON	0x51b58	0x988	data	Chinese	Taiwan
RT_ICON	0x524e0	0x468	GLS_BINARY_LSB_FIRST	Chinese	Taiwan
RT_RCDATA	0x529d0	0x1e05	data	Chinese	Taiwan
RT_GROUP_ICON	0x52948	0x84	data	Chinese	Taiwan

Imports

DLL	Import
KERNEL32.dll	GetDiskFreeSpaceExA, ReleaseSemaphore, SearchPathW, GlobalGetAtomNameW, GetTickCount, TerminateJobObject, GetProcessHeap, LoadLibraryA, GetConsoleWindow, ReadConsoleInputA, PeekConsoleInputA, HeapAlloc, MoveFileExA, GetNumberOfConsoleInputEvents, SetEndOfFile, SetEnvironmentVariableA, CreateFileW, GetFileAttributesExW, CreateProcessA, GetExitCodeProcess, WaitForSingleObject, GetStringTypeW, EnumSystemLocalesEx, IsValidLocaleName, LCMapStringEx, GetUserDefaultLocaleName, GetLocaleInfoEx, CompareStringEx, GetDateFormatEx, GetTimeFormatEx, HeapSize, LoadLibraryW, OutputDebugStringW, WriteConsoleW, SetFilePointerEx, SetStdHandle, HeapReAlloc, FreeEnvironmentStringsW, GetEnvironmentStringsW, IsDebuggerPresent, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, GetLastError, AreFileApisANSI, MultiByteToWideChar, EncodePointer, DecodePointer, InterlockedDecrement, ExitProcess, GetModuleHandleExW, GetProcAddress, GetCommandLineA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetCurrentProcess, TerminateProcess, GetStartupInfoW, GetModuleHandleW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, FatalAppExitA, HeapFree, Sleep, CloseHandle, FlushFileBuffers, GetStdHandle, WriteFile, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, GetFileType, InitOnceExecuteOnce, RtlUnwind, ReadFile, ReadConsoleW, SetFilePointer, DeleteFileW, MoveFileExW, GetModuleFileNameW, InterlockedExchange, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, InterlockedIncrement, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, GetCurrentThread, GetCurrentThreadId, GetModuleFileNameA, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetTickCount64, SetConsoleMode
wsnmp32.dll
CRYPT32.dll	CertGetEnhancedKeyUsage
ole32.dll	CreateAntiMoniker, OleSetAutoConvert, StringFromIID, HMETAFILE_UserUnmarshal, OleRegGetMiscStatus, RegisterDragDrop, CreateStreamOnHGlobal
SHELL32.dll	ShellExecuteA, FindExecutableA, SHGetFileInfo
pdh.dll	PdhOpenLogW, PdhBrowseCountersW
WINMM.dll	waveOutBreakLoop, midiInPrepareHeader, mmioGetInfo, joyGetPosEx, mixerMessage, waveInUnprepareHeader, mmioAdvance, mmioRenameA
USER32.dll	ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/22/21-07:30:35.963522	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49737	5090	192.168.2.4	91.193.75.155
01/22/21-07:30:43.444799	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49738	5090	192.168.2.4	91.193.75.155
01/22/21-07:30:51.244977	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49741	5090	192.168.2.4	91.193.75.155
01/22/21-07:30:58.286261	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49743	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:05.172412	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49744	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:12.170639	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49752	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:19.876213	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49758	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:26.508386	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49762	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:32.711233	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49768	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:38.673936	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49769	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:45.771730	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49770	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:51.904335	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49771	5090	192.168.2.4	91.193.75.155
01/22/21-07:31:59.176544	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49772	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:05.936635	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49775	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:13.035831	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49776	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:19.932310	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49777	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:26.960210	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49778	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:33.984764	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49779	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:41.028507	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49780	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:48.367382	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49781	5090	192.168.2.4	91.193.75.155
01/22/21-07:32:55.282856	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49782	5090	192.168.2.4	91.193.75.155
01/22/21-07:33:03.415066	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49783	5090	192.168.2.4	91.193.75.155
01/22/21-07:33:10.340730	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49784	5090	192.168.2.4	91.193.75.155
01/22/21-07:33:17.449587	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49785	5090	192.168.2.4	91.193.75.155
01/22/21-07:33:24.254331	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49786	5090	192.168.2.4	91.193.75.155
01/22/21-07:33:31.359828	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49787	5090	192.168.2.4	91.193.75.155

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2021 07:30:20.956803083 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.013168097 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.013232946 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.013360977 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.013421059 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.014260054 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.014326096 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.014359951 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.014389992 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.016556025 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.016612053 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.016670942 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.016699076 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.018930912 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.019045115 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.116935968 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.135690928 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.145804882 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.174531937 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.174561024 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.174685955 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.175635099 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.175720930 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.197650909 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.197694063 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.197871923 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.197925091 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.198873043 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.198899031 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.199003935 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.201628923 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.201677084 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.201725006 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.201759100 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.204328060 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.204370975 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.204435110 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.204461098 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.207010031 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.207043886 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.207102060 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.207128048 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.208759069 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.208794117 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.208839893 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.208884001 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.209450006 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.209716082 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.209759951 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.209803104 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.209829092 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.210047960 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.210091114 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.210115910 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.210144043 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.212443113 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.212486982 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.212543011 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.212560892 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.212590933 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.212629080 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.212651014 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.212696075 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.215147018 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.215195894 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.215233088 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.215244055 CET	443	49720	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.215260029 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.215308905 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.217942953 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.218010902 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.218050957 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.218101025 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.220582962 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.220626116 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.220695972 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.220732927 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.223262072 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.223306894 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.223351002 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.223386049 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.225946903 CET	443	49718	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.226032019 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.227494955 CET	49718	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.237905979 CET	49720	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.270323038 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.270376921 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.270437956 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.270474911 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.270895958 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.270937920 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.270975113 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.270996094 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.273289919 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.273345947 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.273397923 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.273418903 CET	49721	443	192.168.2.4	92.122.145.220
Jan 22, 2021 07:30:21.275707960 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.275753975 CET	443	49721	92.122.145.220	192.168.2.4
Jan 22, 2021 07:30:21.275809050 CET	49721	443	192.168.2.4	92.122.145.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2021 07:30:21.378611088 CET	49257	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:21.437596083 CET	53	49257	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:22.342644930 CET	62389	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:22.393596888 CET	53	62389	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:23.256931067 CET	49910	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:23.304858923 CET	53	49910	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:24.218707085 CET	55854	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:24.266788006 CET	53	55854	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:25.174165010 CET	64549	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:25.222306013 CET	53	64549	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:26.386390924 CET	63153	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:26.434209108 CET	53	63153	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:27.415808916 CET	52991	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:27.463816881 CET	53	52991	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:28.397255898 CET	53700	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:28.447101116 CET	53	53700	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:29.365123987 CET	51726	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:29.423111916 CET	53	51726	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:30.347744942 CET	56794	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:30.395719051 CET	53	56794	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:31.332916021 CET	56534	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:31.380970955 CET	53	56534	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:32.502029896 CET	56627	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:32.554056883 CET	53	56627	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:33.941205978 CET	56621	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:33.991930008 CET	53	56621	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:34.928697109 CET	63116	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:34.977129936 CET	53	63116	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:35.115108013 CET	64078	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:35.336199999 CET	53	64078	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:42.504307985 CET	64801	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:42.758469105 CET	53	64801	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:50.225294113 CET	61721	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:50.273416996 CET	53	61721	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:50.539695024 CET	51255	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:50.770622969 CET	53	51255	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:54.140110970 CET	61522	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:54.203713894 CET	53	61522	8.8.8.8	192.168.2.4
Jan 22, 2021 07:30:57.723223925 CET	52337	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:30:57.780884027 CET	53	52337	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:04.654083014 CET	55046	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:04.710472107 CET	53	55046	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:09.095591068 CET	49612	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:09.143719912 CET	53	49612	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:09.747498989 CET	49285	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:09.803611994 CET	53	49285	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:10.393574953 CET	50601	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:10.452713013 CET	53	50601	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:10.756057978 CET	60875	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:10.824704885 CET	53	60875	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:10.857202053 CET	56448	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:10.895068884 CET	59172	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:10.914729118 CET	53	56448	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:10.955908060 CET	53	59172	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:11.368948936 CET	62420	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:11.417228937 CET	53	62420	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:11.654519081 CET	60579	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:11.713551998 CET	53	60579	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:12.099128962 CET	50183	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:12.156215906 CET	53	50183	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:12.684833050 CET	61531	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:12.735503912 CET	53	61531	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:13.443432093 CET	49228	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:13.502599955 CET	53	49228	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:14.561983109 CET	59794	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:14.609958887 CET	53	59794	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:15.153989077 CET	55916	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:15.201973915 CET	53	55916	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:18.996299028 CET	52752	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:19.047084093 CET	53	52752	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:24.843041897 CET	60542	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:24.893831015 CET	53	60542	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:25.182035923 CET	60689	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:25.255044937 CET	53	60689	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:26.004311085 CET	64206	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:26.060651064 CET	53	64206	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:28.776148081 CET	50904	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:28.833760023 CET	53	50904	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:32.123198986 CET	57525	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:32.181315899 CET	53	57525	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:37.996712923 CET	53814	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:38.216588974 CET	53	53814	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:45.238523006 CET	53418	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:45.294686079 CET	53	53418	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:51.241583109 CET	62833	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:51.462378979 CET	53	62833	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:58.366811991 CET	59260	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:58.591681004 CET	53	59260	8.8.8.8	192.168.2.4
Jan 22, 2021 07:31:59.609966993 CET	49944	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:31:59.658224106 CET	53	49944	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:02.383984089 CET	63300	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:02.454840899 CET	53	63300	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:05.423141956 CET	61449	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:05.481987000 CET	53	61449	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:12.499536037 CET	51275	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:12.555836916 CET	53	51275	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:19.415810108 CET	63492	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:19.474915981 CET	53	63492	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:26.407856941 CET	58945	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:26.464147091 CET	53	58945	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:33.422535896 CET	60779	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:33.478782892 CET	53	60779	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:40.510041952 CET	64014	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:40.569143057 CET	53	64014	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:47.811078072 CET	57091	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:47.867594004 CET	53	57091	8.8.8.8	192.168.2.4
Jan 22, 2021 07:32:54.770771980 CET	55904	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:32:54.821542978 CET	53	55904	8.8.8.8	192.168.2.4
Jan 22, 2021 07:33:02.690608978 CET	52109	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:33:02.911175966 CET	53	52109	8.8.8.8	192.168.2.4
Jan 22, 2021 07:33:09.673223019 CET	54450	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:33:09.891906023 CET	53	54450	8.8.8.8	192.168.2.4
Jan 22, 2021 07:33:16.929156065 CET	49374	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:33:16.988557100 CET	53	49374	8.8.8.8	192.168.2.4
Jan 22, 2021 07:33:23.721820116 CET	50436	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:33:23.778325081 CET	53	50436	8.8.8.8	192.168.2.4
Jan 22, 2021 07:33:30.837969065 CET	62605	53	192.168.2.4	8.8.8.8
Jan 22, 2021 07:33:30.894315004 CET	53	62605	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 22, 2021 07:30:35.115108013 CET	192.168.2.4	8.8.8.8	0x8081	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:30:42.504307985 CET	192.168.2.4	8.8.8.8	0x8b76	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:30:50.539695024 CET	192.168.2.4	8.8.8.8	0x47bf	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:30:57.723223925 CET	192.168.2.4	8.8.8.8	0x18bc	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:04.654083014 CET	192.168.2.4	8.8.8.8	0x52f6	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:11.654519081 CET	192.168.2.4	8.8.8.8	0x98ce	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:18.996299028 CET	192.168.2.4	8.8.8.8	0xc52b	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:26.004311085 CET	192.168.2.4	8.8.8.8	0xb97b	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:32.123198986 CET	192.168.2.4	8.8.8.8	0xbbed	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:37.996712923 CET	192.168.2.4	8.8.8.8	0x2d2a	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:45.238523006 CET	192.168.2.4	8.8.8.8	0x9786	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:51.241583109 CET	192.168.2.4	8.8.8.8	0x7d59	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:58.366811991 CET	192.168.2.4	8.8.8.8	0x8811	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:05.423141956 CET	192.168.2.4	8.8.8.8	0xb1a0	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:12.499536037 CET	192.168.2.4	8.8.8.8	0xeb3e	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:19.415810108 CET	192.168.2.4	8.8.8.8	0x5110	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:26.407856941 CET	192.168.2.4	8.8.8.8	0x3361	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:33.422535896 CET	192.168.2.4	8.8.8.8	0x1b93	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:40.510041952 CET	192.168.2.4	8.8.8.8	0x6233	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:47.811078072 CET	192.168.2.4	8.8.8.8	0x202	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:54.770771980 CET	192.168.2.4	8.8.8.8	0xca19	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:02.690608978 CET	192.168.2.4	8.8.8.8	0xed44	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:09.673223019 CET	192.168.2.4	8.8.8.8	0x24d0	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:16.929156065 CET	192.168.2.4	8.8.8.8	0x74a0	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:23.721820116 CET	192.168.2.4	8.8.8.8	0x8bb5	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:30.837969065 CET	192.168.2.4	8.8.8.8	0x41bd	Standard query (0)	mimi121.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 22, 2021 07:30:35.336199999 CET	8.8.8.8	192.168.2.4	0x8081	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:30:42.758469105 CET	8.8.8.8	192.168.2.4	0x8b76	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:30:50.770622969 CET	8.8.8.8	192.168.2.4	0x47bf	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:30:57.780884027 CET	8.8.8.8	192.168.2.4	0x18bc	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:04.710472107 CET	8.8.8.8	192.168.2.4	0x52f6	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:11.713551998 CET	8.8.8.8	192.168.2.4	0x98ce	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:19.047084093 CET	8.8.8.8	192.168.2.4	0xc52b	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:26.060651064 CET	8.8.8.8	192.168.2.4	0xb97b	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:32.181315899 CET	8.8.8.8	192.168.2.4	0xbbed	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:38.216588974 CET	8.8.8.8	192.168.2.4	0x2d2a	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:45.294686079 CET	8.8.8.8	192.168.2.4	0x9786	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:51.462378979 CET	8.8.8.8	192.168.2.4	0x7d59	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:31:58.591681004 CET	8.8.8.8	192.168.2.4	0x8811	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:05.481987000 CET	8.8.8.8	192.168.2.4	0xb1a0	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:12.555836916 CET	8.8.8.8	192.168.2.4	0xeb3e	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:19.474915981 CET	8.8.8.8	192.168.2.4	0x5110	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:26.464147091 CET	8.8.8.8	192.168.2.4	0x3361	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:33.478782892 CET	8.8.8.8	192.168.2.4	0x1b93	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:40.569143057 CET	8.8.8.8	192.168.2.4	0x6233	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:47.867594004 CET	8.8.8.8	192.168.2.4	0x202	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:32:54.821542978 CET	8.8.8.8	192.168.2.4	0xca19	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:02.911175966 CET	8.8.8.8	192.168.2.4	0xed44	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:09.891906023 CET	8.8.8.8	192.168.2.4	0x24d0	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:16.988557100 CET	8.8.8.8	192.168.2.4	0x74a0	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:23.778325081 CET	8.8.8.8	192.168.2.4	0x8bb5	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)
Jan 22, 2021 07:33:30.894315004 CET	8.8.8.8	192.168.2.4	0x41bd	No error (0)	mimi121.duckdns.org	91.193.75.155	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE PID: 5816 Parent PID: 5956

General

Start time:	07:30:27
Start date:	22/01/2021
Path:	C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE'
Imagebase:	0xa50000
File size:	542720 bytes
MD5 hash:	D40D97B41A353BC42B0E7EBE451886D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.656614146.0000000000AB0000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: conhost.exe PID: 1372 Parent PID: 5816

General

Start time:	07:30:27
Start date:	22/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: MSBuild.exe PID: 2204 Parent PID: 5816

General

Start time:	07:30:29
Start date:	22/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE'
Imagebase:	0xad0000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.1047366764.0000000006580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000002.1044661467.00000000040D9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000003.00000002.1047272619.00000000064F0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000002.1041355870.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	moderate

Analysis Process: schtasks.exe PID: 7024 Parent PID: 2204

General

Start time:	07:30:32
Start date:	22/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp731A.tmp'
Imagebase:	0xc40000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5724 Parent PID: 7024

General

Start time:	07:30:32
Start date:	22/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exe PID: 6764 Parent PID: 2204

General

Start time:	07:30:33
Start date:	22/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp7609.tmp'
Imagebase:	0xc40000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6708 Parent PID: 6764

General

Start time:	07:30:33
Start date:	22/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: MSBuild.exe PID: 6908 Parent PID: 968

General

Start time:	07:30:34
Start date:	22/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 0
Imagebase:	0x10000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Analysis Process: conhost.exe PID: 6964 Parent PID: 6908

General

Start time:	07:30:35
Start date:	22/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: dhcpmon.exe PID: 6968 Parent PID: 968

General

Start time:	07:30:35
Start date:	22/01/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0xc70000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Analysis Process: conhost.exe PID: 6796 Parent PID: 6968

General

Start time:	07:30:35
Start date:	22/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: dhcpmon.exe PID: 2480 Parent PID: 3424

General

Start time:	07:30:41
Start date:	22/01/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x10000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Analysis Process: conhost.exe PID: 6080 Parent PID: 2480

General

Start time:	07:30:42
Start date:	22/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre