Play interactive tour

Edit tour

Analysis Report 256ec8f8f67b59c5e085b0bb63afcd13.exe

Overview

General Information

Sample Name:	256ec8f8f67b59c5e085b0bb63afcd13.exe
Analysis ID:	355753
MD5:	0bbcc2e64e3edf053ed4af2c0bafb0eb
SHA1:	c006b8d2ec4b92f441815b20f1bdadf98eab1b4d
SHA256:	52d01903f7c366e01359a00ea771ca1f71d4e1bb54731290bc62c3a218f5af80
Tags:	exeNanoCoreRAT
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

256ec8f8f67b59c5e085b0bb63afcd13.exe (PID: 6720 cmdline: 'C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe' MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

256ec8f8f67b59c5e085b0bb63afcd13.exe (PID: 6416 cmdline: {path} MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

schtasks.exe (PID: 6540 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6632 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

256ec8f8f67b59c5e085b0bb63afcd13.exe (PID: 6888 cmdline: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe 0 MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

256ec8f8f67b59c5e085b0bb63afcd13.exe (PID: 6260 cmdline: {path} MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

dhcpmon.exe (PID: 2460 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

dhcpmon.exe (PID: 6500 cmdline: {path} MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

dhcpmon.exe (PID: 7160 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

dhcpmon.exe (PID: 5748 cmdline: {path} MD5: 0BBCC2E64E3EDF053ED4AF2C0BAFB0EB)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "94----", "Group": "V-HASH", "Domain1": "cloudhost.myfirewall.org", "Domain2": "cloudhost.myfirewall.org", "Port": 5654, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "cloudhost.myfirewall.org", "BackupDNSServer": "cloudhost.myfirewall.orgbxpU=", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23877:$a: NanoCore 0x238d0:$a: NanoCore 0x2390d:$a: NanoCore 0x23986:$a: NanoCore 0x238d9:$b: ClientPlugin 0x23916:$b: ClientPlugin 0x24214:$b: ClientPlugin 0x24221:$b: ClientPlugin 0x1b5fe:$e: KeepAlive 0x23d61:$g: LogClientMessage 0x23ce1:$i: get_Connected 0x158a9:$j: #=q 0x158d9:$j: #=q 0x15915:$j: #=q 0x1593d:$j: #=q 0x1596d:$j: #=q 0x1599d:$j: #=q 0x159cd:$j: #=q 0x159fd:$j: #=q 0x15a19:$j: #=q 0x15a49:$j: #=q
00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x23761d:$x1: NanoCore.ClientPluginHost 0x26a03d:$x1: NanoCore.ClientPluginHost 0x23765a:$x2: IClientNetworkHost 0x26a07a:$x2: IClientNetworkHost 0x23b18d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x26dbad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x237385:$a: NanoCore 0x237395:$a: NanoCore 0x2375c9:$a: NanoCore 0x2375dd:$a: NanoCore 0x23761d:$a: NanoCore 0x269da5:$a: NanoCore 0x269db5:$a: NanoCore 0x269fe9:$a: NanoCore 0x269ffd:$a: NanoCore 0x26a03d:$a: NanoCore 0x2373e4:$b: ClientPlugin 0x2375e6:$b: ClientPlugin 0x237626:$b: ClientPlugin 0x269e04:$b: ClientPlugin 0x26a006:$b: ClientPlugin 0x26a046:$b: ClientPlugin 0x1835a1:$c: ProjectData 0x23750b:$c: ProjectData 0x269f2b:$c: ProjectData 0x237f12:$d: DESCrypto 0x26a932:$d: DESCrypto
00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x23761d:$x1: NanoCore.ClientPluginHost 0x26a03d:$x1: NanoCore.ClientPluginHost 0x23765a:$x2: IClientNetworkHost 0x26a07a:$x2: IClientNetworkHost 0x23b18d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x26dbad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x237385:$a: NanoCore 0x237395:$a: NanoCore 0x2375c9:$a: NanoCore 0x2375dd:$a: NanoCore 0x23761d:$a: NanoCore 0x269da5:$a: NanoCore 0x269db5:$a: NanoCore 0x269fe9:$a: NanoCore 0x269ffd:$a: NanoCore 0x26a03d:$a: NanoCore 0x2373e4:$b: ClientPlugin 0x2375e6:$b: ClientPlugin 0x237626:$b: ClientPlugin 0x269e04:$b: ClientPlugin 0x26a006:$b: ClientPlugin 0x26a046:$b: ClientPlugin 0x1835a1:$c: ProjectData 0x23750b:$c: ProjectData 0x269f2b:$c: ProjectData 0x237f12:$d: DESCrypto 0x26a932:$d: DESCrypto
0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a5d:$a: NanoCore 0x49ab6:$a: NanoCore 0x49af3:$a: NanoCore 0x49b6c:$a: NanoCore 0x5d217:$a: NanoCore 0x5d22c:$a: NanoCore 0x5d261:$a: NanoCore 0x76233:$a: NanoCore 0x76248:$a: NanoCore 0x7627d:$a: NanoCore 0x49abf:$b: ClientPlugin 0x49afc:$b: ClientPlugin 0x4a3fa:$b: ClientPlugin 0x4a407:$b: ClientPlugin 0x5cfd3:$b: ClientPlugin 0x5cfee:$b: ClientPlugin 0x5d01e:$b: ClientPlugin 0x5d235:$b: ClientPlugin 0x5d26a:$b: ClientPlugin 0x75fef:$b: ClientPlugin 0x7600a:$b: ClientPlugin
0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x238a7:$a: NanoCore 0x23900:$a: NanoCore 0x2393d:$a: NanoCore 0x239b6:$a: NanoCore 0x23909:$b: ClientPlugin 0x23946:$b: ClientPlugin 0x24244:$b: ClientPlugin 0x24251:$b: ClientPlugin 0x1b62e:$e: KeepAlive 0x23d91:$g: LogClientMessage 0x23d11:$i: get_Connected 0x158d9:$j: #=q 0x15909:$j: #=q 0x15945:$j: #=q 0x1596d:$j: #=q 0x1599d:$j: #=q 0x159cd:$j: #=q 0x159fd:$j: #=q 0x15a2d:$j: #=q 0x15a49:$j: #=q 0x15a79:$j: #=q
00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x23761d:$x1: NanoCore.ClientPluginHost 0x26a03d:$x1: NanoCore.ClientPluginHost 0x23765a:$x2: IClientNetworkHost 0x26a07a:$x2: IClientNetworkHost 0x23b18d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x26dbad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x237385:$a: NanoCore 0x237395:$a: NanoCore 0x2375c9:$a: NanoCore 0x2375dd:$a: NanoCore 0x23761d:$a: NanoCore 0x269da5:$a: NanoCore 0x269db5:$a: NanoCore 0x269fe9:$a: NanoCore 0x269ffd:$a: NanoCore 0x26a03d:$a: NanoCore 0x2373e4:$b: ClientPlugin 0x2375e6:$b: ClientPlugin 0x237626:$b: ClientPlugin 0x269e04:$b: ClientPlugin 0x26a006:$b: ClientPlugin 0x26a046:$b: ClientPlugin 0x1835a1:$c: ProjectData 0x23750b:$c: ProjectData 0x269f2b:$c: ProjectData 0x237f12:$d: DESCrypto 0x26a932:$d: DESCrypto
0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x238a7:$a: NanoCore 0x23900:$a: NanoCore 0x2393d:$a: NanoCore 0x239b6:$a: NanoCore 0x23909:$b: ClientPlugin 0x23946:$b: ClientPlugin 0x24244:$b: ClientPlugin 0x24251:$b: ClientPlugin 0x1b62e:$e: KeepAlive 0x23d91:$g: LogClientMessage 0x23d11:$i: get_Connected 0x158d9:$j: #=q 0x15909:$j: #=q 0x15945:$j: #=q 0x1596d:$j: #=q 0x1599d:$j: #=q 0x159cd:$j: #=q 0x159fd:$j: #=q 0x15a2d:$j: #=q 0x15a49:$j: #=q 0x15a79:$j: #=q
0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a5d:$a: NanoCore 0x49ab6:$a: NanoCore 0x49af3:$a: NanoCore 0x49b6c:$a: NanoCore 0x5d217:$a: NanoCore 0x5d22c:$a: NanoCore 0x5d261:$a: NanoCore 0x76233:$a: NanoCore 0x76248:$a: NanoCore 0x7627d:$a: NanoCore 0x49abf:$b: ClientPlugin 0x49afc:$b: ClientPlugin 0x4a3fa:$b: ClientPlugin 0x4a407:$b: ClientPlugin 0x5cfd3:$b: ClientPlugin 0x5cfee:$b: ClientPlugin 0x5d01e:$b: ClientPlugin 0x5d235:$b: ClientPlugin 0x5d26a:$b: ClientPlugin 0x75fef:$b: ClientPlugin 0x7600a:$b: ClientPlugin
00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3a5d:$a: NanoCore 0x3ab6:$a: NanoCore 0x3af3:$a: NanoCore 0x3b6c:$a: NanoCore 0x17217:$a: NanoCore 0x1722c:$a: NanoCore 0x17261:$a: NanoCore 0x30233:$a: NanoCore 0x30248:$a: NanoCore 0x3027d:$a: NanoCore 0x3abf:$b: ClientPlugin 0x3afc:$b: ClientPlugin 0x43fa:$b: ClientPlugin 0x4407:$b: ClientPlugin 0x16fd3:$b: ClientPlugin 0x16fee:$b: ClientPlugin 0x1701e:$b: ClientPlugin 0x17235:$b: ClientPlugin 0x1726a:$b: ClientPlugin 0x2ffef:$b: ClientPlugin 0x3000a:$b: ClientPlugin
0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x49a5d:$a: NanoCore 0x49ab6:$a: NanoCore 0x49af3:$a: NanoCore 0x49b6c:$a: NanoCore 0x5d217:$a: NanoCore 0x5d22c:$a: NanoCore 0x5d261:$a: NanoCore 0x76233:$a: NanoCore 0x76248:$a: NanoCore 0x7627d:$a: NanoCore 0x49abf:$b: ClientPlugin 0x49afc:$b: ClientPlugin 0x4a3fa:$b: ClientPlugin 0x4a407:$b: ClientPlugin 0x5cfd3:$b: ClientPlugin 0x5cfee:$b: ClientPlugin 0x5d01e:$b: ClientPlugin 0x5d235:$b: ClientPlugin 0x5d26a:$b: ClientPlugin 0x75fef:$b: ClientPlugin 0x7600a:$b: ClientPlugin
00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x23761d:$x1: NanoCore.ClientPluginHost 0x26a03d:$x1: NanoCore.ClientPluginHost 0x23765a:$x2: IClientNetworkHost 0x26a07a:$x2: IClientNetworkHost 0x23b18d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x26dbad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x237385:$a: NanoCore 0x237395:$a: NanoCore 0x2375c9:$a: NanoCore 0x2375dd:$a: NanoCore 0x23761d:$a: NanoCore 0x269da5:$a: NanoCore 0x269db5:$a: NanoCore 0x269fe9:$a: NanoCore 0x269ffd:$a: NanoCore 0x26a03d:$a: NanoCore 0x2373e4:$b: ClientPlugin 0x2375e6:$b: ClientPlugin 0x237626:$b: ClientPlugin 0x269e04:$b: ClientPlugin 0x26a006:$b: ClientPlugin 0x26a046:$b: ClientPlugin 0x1835a1:$c: ProjectData 0x23750b:$c: ProjectData 0x269f2b:$c: ProjectData 0x237f12:$d: DESCrypto 0x26a932:$d: DESCrypto
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x187cb:$x1: NanoCore.ClientPluginHost 0x17e19c:$x1: NanoCore.ClientPluginHost 0x2765e5:$x1: NanoCore.ClientPluginHost 0x3214b3:$x1: NanoCore.ClientPluginHost 0x342094:$x1: NanoCore.ClientPluginHost 0x347c53:$x1: NanoCore.ClientPluginHost 0x35902c:$x1: NanoCore.ClientPluginHost 0x187f1:$x2: IClientNetworkHost 0x17e1c2:$x2: IClientNetworkHost 0x27662a:$x2: IClientNetworkHost 0x321514:$x2: IClientNetworkHost 0x3420ba:$x2: IClientNetworkHost 0x347c98:$x2: IClientNetworkHost 0x359071:$x2: IClientNetworkHost 0x326919:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x33488b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x186bd:$a: NanoCore 0x1875e:$a: NanoCore 0x187cb:$a: NanoCore 0x1888c:$a: NanoCore 0x1975d:$a: NanoCore 0x197b0:$a: NanoCore 0x197e9:$a: NanoCore 0x1985c:$a: NanoCore 0x17e08e:$a: NanoCore 0x17e12f:$a: NanoCore 0x17e19c:$a: NanoCore 0x17e25d:$a: NanoCore 0x17f12e:$a: NanoCore 0x17f181:$a: NanoCore 0x17f1ba:$a: NanoCore 0x17f22d:$a: NanoCore 0x19655a:$a: NanoCore 0x27655f:$a: NanoCore 0x27658c:$a: NanoCore 0x2765e5:$a: NanoCore 0x27ddf4:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 5748	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xa155:$x1: NanoCore.ClientPluginHost 0xfd14:$x1: NanoCore.ClientPluginHost 0x21114:$x1: NanoCore.ClientPluginHost 0x34629:$x1: NanoCore.ClientPluginHost 0x69728:$x1: NanoCore.ClientPluginHost 0xa17b:$x2: IClientNetworkHost 0xfd59:$x2: IClientNetworkHost 0x21159:$x2: IClientNetworkHost 0x3468a:$x2: IClientNetworkHost 0x6974e:$x2: IClientNetworkHost 0x39a8f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x47a01:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 5748	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 5748	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xa047:$a: NanoCore 0xa0e8:$a: NanoCore 0xa155:$a: NanoCore 0xa216:$a: NanoCore 0xb0e7:$a: NanoCore 0xb13a:$a: NanoCore 0xb173:$a: NanoCore 0xb1e6:$a: NanoCore 0xfc8e:$a: NanoCore 0xfcbb:$a: NanoCore 0xfd14:$a: NanoCore 0x17523:$a: NanoCore 0x17536:$a: NanoCore 0x17568:$a: NanoCore 0x2108e:$a: NanoCore 0x210bb:$a: NanoCore 0x21114:$a: NanoCore 0x28923:$a: NanoCore 0x28936:$a: NanoCore 0x28968:$a: NanoCore 0x3412e:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 2460	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x38715:$x1: NanoCore.ClientPluginHost 0x5712d:$x1: NanoCore.ClientPluginHost 0x38776:$x2: IClientNetworkHost 0x5718e:$x2: IClientNetworkHost 0x3db7b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4baed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5c593:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6a505:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 2460	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 2460	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3821a:$a: NanoCore 0x38236:$a: NanoCore 0x38391:$a: NanoCore 0x383a0:$a: NanoCore 0x38679:$a: NanoCore 0x386a5:$a: NanoCore 0x38715:$a: NanoCore 0x48157:$a: NanoCore 0x48169:$a: NanoCore 0x481a5:$a: NanoCore 0x56c32:$a: NanoCore 0x56c4e:$a: NanoCore 0x56da9:$a: NanoCore 0x56db8:$a: NanoCore 0x57091:$a: NanoCore 0x570bd:$a: NanoCore 0x5712d:$a: NanoCore 0x66b6f:$a: NanoCore 0x66b81:$a: NanoCore 0x66bbd:$a: NanoCore 0x382c1:$b: ClientPlugin
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4b0fbe:$x1: NanoCore.ClientPluginHost 0x4cf9d6:$x1: NanoCore.ClientPluginHost 0x4b101f:$x2: IClientNetworkHost 0x4cfa37:$x2: IClientNetworkHost 0x4b6424:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4c4396:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4d4e3c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4e2dae:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b0ac3:$a: NanoCore 0x4b0adf:$a: NanoCore 0x4b0c3a:$a: NanoCore 0x4b0c49:$a: NanoCore 0x4b0f22:$a: NanoCore 0x4b0f4e:$a: NanoCore 0x4b0fbe:$a: NanoCore 0x4c0a00:$a: NanoCore 0x4c0a12:$a: NanoCore 0x4c0a4e:$a: NanoCore 0x4cf4db:$a: NanoCore 0x4cf4f7:$a: NanoCore 0x4cf652:$a: NanoCore 0x4cf661:$a: NanoCore 0x4cf93a:$a: NanoCore 0x4cf966:$a: NanoCore 0x4cf9d6:$a: NanoCore 0x4df418:$a: NanoCore 0x4df42a:$a: NanoCore 0x4df466:$a: NanoCore 0x4b0b6a:$b: ClientPlugin
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1e206a:$x1: NanoCore.ClientPluginHost 0x200ad0:$x1: NanoCore.ClientPluginHost 0x1e20cb:$x2: IClientNetworkHost 0x200b31:$x2: IClientNetworkHost 0x1e74d0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1f5442:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x205f36:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x213ea8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1e1b6f:$a: NanoCore 0x1e1b8b:$a: NanoCore 0x1e1ce6:$a: NanoCore 0x1e1cf5:$a: NanoCore 0x1e1fce:$a: NanoCore 0x1e1ffa:$a: NanoCore 0x1e206a:$a: NanoCore 0x1f1aac:$a: NanoCore 0x1f1abe:$a: NanoCore 0x1f1afa:$a: NanoCore 0x2005d5:$a: NanoCore 0x2005f1:$a: NanoCore 0x20074c:$a: NanoCore 0x20075b:$a: NanoCore 0x200a34:$a: NanoCore 0x200a60:$a: NanoCore 0x200ad0:$a: NanoCore 0x210512:$a: NanoCore 0x210524:$a: NanoCore 0x210560:$a: NanoCore 0x1e1c16:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 7160	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x272349:$x1: NanoCore.ClientPluginHost 0x290d61:$x1: NanoCore.ClientPluginHost 0x2723aa:$x2: IClientNetworkHost 0x290dc2:$x2: IClientNetworkHost 0x2777af:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x285721:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2961c7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2a4139:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 7160	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 7160	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x271e4e:$a: NanoCore 0x271e6a:$a: NanoCore 0x271fc5:$a: NanoCore 0x271fd4:$a: NanoCore 0x2722ad:$a: NanoCore 0x2722d9:$a: NanoCore 0x272349:$a: NanoCore 0x281d8b:$a: NanoCore 0x281d9d:$a: NanoCore 0x281dd9:$a: NanoCore 0x290866:$a: NanoCore 0x290882:$a: NanoCore 0x2909dd:$a: NanoCore 0x2909ec:$a: NanoCore 0x290cc5:$a: NanoCore 0x290cf1:$a: NanoCore 0x290d61:$a: NanoCore 0x2a07a3:$a: NanoCore 0x2a07b5:$a: NanoCore 0x2a07f1:$a: NanoCore 0x271ef5:$b: ClientPlugin
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1089a:$x1: NanoCore.ClientPluginHost 0x238ec:$x1: NanoCore.ClientPluginHost 0x43bdb:$x1: NanoCore.ClientPluginHost 0x4979a:$x1: NanoCore.ClientPluginHost 0x5ab73:$x1: NanoCore.ClientPluginHost 0x108c0:$x2: IClientNetworkHost 0x2394d:$x2: IClientNetworkHost 0x43c01:$x2: IClientNetworkHost 0x497df:$x2: IClientNetworkHost 0x5abb8:$x2: IClientNetworkHost 0x28d52:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x36cc4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42dd:$a: NanoCore 0x4362:$a: NanoCore 0x444d:$a: NanoCore 0x1078c:$a: NanoCore 0x1082d:$a: NanoCore 0x1089a:$a: NanoCore 0x1095b:$a: NanoCore 0x1182c:$a: NanoCore 0x1187f:$a: NanoCore 0x118b8:$a: NanoCore 0x1192b:$a: NanoCore 0x13428:$a: NanoCore 0x1373b:$a: NanoCore 0x13759:$a: NanoCore 0x1379b:$a: NanoCore 0x137d2:$a: NanoCore 0x137f0:$a: NanoCore 0x233f1:$a: NanoCore 0x2340d:$a: NanoCore 0x23568:$a: NanoCore 0x23577:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 6500	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x11f6f:$x1: NanoCore.ClientPluginHost 0x22ca3:$x1: NanoCore.ClientPluginHost 0x44594:$x1: NanoCore.ClientPluginHost 0x4a153:$x1: NanoCore.ClientPluginHost 0x5b52c:$x1: NanoCore.ClientPluginHost 0x11f95:$x2: IClientNetworkHost 0x22d04:$x2: IClientNetworkHost 0x445ba:$x2: IClientNetworkHost 0x4a198:$x2: IClientNetworkHost 0x5b571:$x2: IClientNetworkHost 0x28109:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3607b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6500	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6500	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x59de:$a: NanoCore 0x5a63:$a: NanoCore 0x5b4e:$a: NanoCore 0x11e61:$a: NanoCore 0x11f02:$a: NanoCore 0x11f6f:$a: NanoCore 0x12030:$a: NanoCore 0x12f01:$a: NanoCore 0x12f54:$a: NanoCore 0x12f8d:$a: NanoCore 0x13000:$a: NanoCore 0x14a7c:$a: NanoCore 0x14d20:$a: NanoCore 0x14d3e:$a: NanoCore 0x14d80:$a: NanoCore 0x14db7:$a: NanoCore 0x14dd5:$a: NanoCore 0x227a8:$a: NanoCore 0x227c4:$a: NanoCore 0x2291f:$a: NanoCore 0x2292e:$a: NanoCore
Click to see the 62 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x42a9b:$c: ProjectData 0x10a82:$d: DESCrypto 0x434a2:$d: DESCrypto 0x1844e:$e: KeepAlive
14.2.dhcpmon.exe.2fd3ac8.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
14.2.dhcpmon.exe.2fd3ac8.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3ffeab4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c9:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287f6:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3ffeab4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c9:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x298a4:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287e3:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3ffeab4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3493a98.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3493a98.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c9:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287f6:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c9:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x298a4:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287e3:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10863d:$x1: NanoCore.ClientPluginHost 0x13b05d:$x1: NanoCore.ClientPluginHost 0x10867a:$x2: IClientNetworkHost 0x13b09a:$x2: IClientNetworkHost 0x10c1ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x13ebcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1083a5:$a: NanoCore 0x1083b5:$a: NanoCore 0x1085e9:$a: NanoCore 0x1085fd:$a: NanoCore 0x10863d:$a: NanoCore 0x13adc5:$a: NanoCore 0x13add5:$a: NanoCore 0x13b009:$a: NanoCore 0x13b01d:$a: NanoCore 0x13b05d:$a: NanoCore 0x108404:$b: ClientPlugin 0x108606:$b: ClientPlugin 0x108646:$b: ClientPlugin 0x13ae24:$b: ClientPlugin 0x13b026:$b: ClientPlugin 0x13b066:$b: ClientPlugin 0x545c1:$c: ProjectData 0x10852b:$c: ProjectData 0x13af4b:$c: ProjectData 0x108f32:$d: DESCrypto 0x13b952:$d: DESCrypto
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
10.2.dhcpmon.exe.46f8490.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.46f8490.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.46f8490.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x42a9b:$c: ProjectData 0x10a82:$d: DESCrypto 0x434a2:$d: DESCrypto 0x1844e:$e: KeepAlive
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10863d:$x1: NanoCore.ClientPluginHost 0x13b05d:$x1: NanoCore.ClientPluginHost 0x10867a:$x2: IClientNetworkHost 0x13b09a:$x2: IClientNetworkHost 0x10c1ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x13ebcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1083a5:$a: NanoCore 0x1083b5:$a: NanoCore 0x1085e9:$a: NanoCore 0x1085fd:$a: NanoCore 0x10863d:$a: NanoCore 0x13adc5:$a: NanoCore 0x13add5:$a: NanoCore 0x13b009:$a: NanoCore 0x13b01d:$a: NanoCore 0x13b05d:$a: NanoCore 0x108404:$b: ClientPlugin 0x108606:$b: ClientPlugin 0x108646:$b: ClientPlugin 0x13ae24:$b: ClientPlugin 0x13b026:$b: ClientPlugin 0x13b066:$b: ClientPlugin 0x545c1:$c: ProjectData 0x10852b:$c: ProjectData 0x13af4b:$c: ProjectData 0x108f32:$d: DESCrypto 0x13b952:$d: DESCrypto
8.2.dhcpmon.exe.3d78490.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3d78490.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.3d78490.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3d78490.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.dhcpmon.exe.43beab4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.dhcpmon.exe.43beab4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.43beab4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.45fffe0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10863d:$x1: NanoCore.ClientPluginHost 0x13b05d:$x1: NanoCore.ClientPluginHost 0x10867a:$x2: IClientNetworkHost 0x13b09a:$x2: IClientNetworkHost 0x10c1ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x13ebcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.45fffe0.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.45fffe0.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1083a5:$a: NanoCore 0x1083b5:$a: NanoCore 0x1085e9:$a: NanoCore 0x1085fd:$a: NanoCore 0x10863d:$a: NanoCore 0x13adc5:$a: NanoCore 0x13add5:$a: NanoCore 0x13b009:$a: NanoCore 0x13b01d:$a: NanoCore 0x13b05d:$a: NanoCore 0x108404:$b: ClientPlugin 0x108606:$b: ClientPlugin 0x108646:$b: ClientPlugin 0x13ae24:$b: ClientPlugin 0x13b026:$b: ClientPlugin 0x13b066:$b: ClientPlugin 0x545c1:$c: ProjectData 0x10852b:$c: ProjectData 0x13af4b:$c: ProjectData 0x108f32:$d: DESCrypto 0x13b952:$d: DESCrypto
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5ff:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d62c:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5ff:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6da:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d619:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5b5:$a: NanoCore 0x2d5ca:$a: NanoCore 0x2d5ff:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d371:$b: ClientPlugin 0x2d38c:$b: ClientPlugin
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.dhcpmon.exe.43c30dd.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x241a0:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241cd:$x2: IClientNetworkHost
12.2.dhcpmon.exe.43c30dd.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x241a0:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2527b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241ba:$s5: IClientLoggingHost
12.2.dhcpmon.exe.43c30dd.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5980000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5980000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3ffeab4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3ffeab4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3ffeab4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x241a0:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241cd:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x241a0:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2527b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241ba:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.46f8490.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.dhcpmon.exe.46f8490.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
10.2.dhcpmon.exe.46f8490.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.dhcpmon.exe.46f8490.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.dhcpmon.exe.3393ac8.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3393ac8.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x241a0:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241cd:$x2: IClientNetworkHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x241a0:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2527b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241ba:$s5: IClientLoggingHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5ff:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d62c:$x2: IClientNetworkHost
14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5ff:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6da:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d619:$s5: IClientLoggingHost
14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5b5:$a: NanoCore 0x2d5ca:$a: NanoCore 0x2d5ff:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d371:$b: ClientPlugin 0x2d38c:$b: ClientPlugin
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3021680.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3021680.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3d78490.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3d78490.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3d78490.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x42a9b:$c: ProjectData 0x10a82:$d: DESCrypto 0x434a2:$d: DESCrypto 0x1844e:$e: KeepAlive
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10863d:$x1: NanoCore.ClientPluginHost 0x13b05d:$x1: NanoCore.ClientPluginHost 0x10867a:$x2: IClientNetworkHost 0x13b09a:$x2: IClientNetworkHost 0x10c1ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x13ebcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1083a5:$a: NanoCore 0x1083b5:$a: NanoCore 0x1085e9:$a: NanoCore 0x1085fd:$a: NanoCore 0x10863d:$a: NanoCore 0x13adc5:$a: NanoCore 0x13add5:$a: NanoCore 0x13b009:$a: NanoCore 0x13b01d:$a: NanoCore 0x13b05d:$a: NanoCore 0x108404:$b: ClientPlugin 0x108606:$b: ClientPlugin 0x108646:$b: ClientPlugin 0x13ae24:$b: ClientPlugin 0x13b026:$b: ClientPlugin 0x13b066:$b: ClientPlugin 0x545c1:$c: ProjectData 0x10852b:$c: ProjectData 0x13af4b:$c: ProjectData 0x108f32:$d: DESCrypto 0x13b952:$d: DESCrypto
14.2.dhcpmon.exe.40030dd.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x241a0:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241cd:$x2: IClientNetworkHost
14.2.dhcpmon.exe.40030dd.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x241a0:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2527b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241ba:$s5: IClientLoggingHost
14.2.dhcpmon.exe.40030dd.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c9:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287f6:$x2: IClientNetworkHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c9:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x298a4:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287e3:$s5: IClientLoggingHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.43b9c7e.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5ff:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d62c:$x2: IClientNetworkHost
12.2.dhcpmon.exe.43b9c7e.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5ff:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6da:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d619:$s5: IClientLoggingHost
12.2.dhcpmon.exe.43b9c7e.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.43b9c7e.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5b5:$a: NanoCore 0x2d5ca:$a: NanoCore 0x2d5ff:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d371:$b: ClientPlugin 0x2d38c:$b: ClientPlugin
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5ff:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d62c:$x2: IClientNetworkHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5ff:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6da:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d619:$s5: IClientLoggingHost
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d5b5:$a: NanoCore 0x2d5ca:$a: NanoCore 0x2d5ff:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d371:$b: ClientPlugin 0x2d38c:$b: ClientPlugin
12.2.dhcpmon.exe.43beab4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287c9:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287f6:$x2: IClientNetworkHost
12.2.dhcpmon.exe.43beab4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287c9:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x298a4:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287e3:$s5: IClientLoggingHost
12.2.dhcpmon.exe.43beab4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x42a9b:$c: ProjectData 0x10a82:$d: DESCrypto 0x434a2:$d: DESCrypto 0x1844e:$e: KeepAlive
Click to see the 122 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe, ProcessId: 6416, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp', CommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp', CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe, ParentProcessId: 6416, ProcessCommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp', ProcessId: 6540

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "94----", "Group": "V-HASH", "Domain1": "cloudhost.myfirewall.org", "Domain2": "cloudhost.myfirewall.org", "Port": 5654, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "cloudhost.myfirewall.org", "BackupDNSServer": "cloudhost.myfirewall.orgbxpU=", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Joe Sandbox ML: detected

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack	Avira: Label: TR/NanoCore.fadte
Source: 12.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Show sources

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Show sources

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904860246.0000000002A85000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680575404.0000000008770000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907073740.0000000005920000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.717914840.00000000082E0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.724995186.00000000076E0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.734162357.0000000008310000.00000002.00000001.sdmp

Software Vulnerabilities:

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: cloudhost.myfirewall.org

Source: global traffic

TCP traffic: 192.168.2.4:49743 -> 79.134.225.105:5654

Source: Joe Sandbox View

IP Address: 79.134.225.105 79.134.225.105

Source: Joe Sandbox View

ASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH

Source: unknown

DNS traffic detected: queries for: cloudhost.myfirewall.org

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639797895.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639860700.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comV
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639918482.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comcy5
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639900319.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comgne
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639918482.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comgy
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comint
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comlay
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639797895.00000000056BE000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639991224.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comypo
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.640116720.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comypooo
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642010809.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers&
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642401940.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.htmln
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.641965748.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/k
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642184941.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers=
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642184941.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersQ
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643199147.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersb
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642893460.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersr
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/mzN
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFpz3
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsekz
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676929479.0000000005680000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676929479.0000000005680000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.commzN
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comWh2
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comX
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comc
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comi
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639259634.0000000005684000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639244161.00000000056BD000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639394139.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639244161.00000000056BD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn7
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.644178396.000000000568D000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.637926766.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com;
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.637926766.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma-d
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638866258.0000000005686000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krC
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638866258.0000000005686000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr~y8
Source: dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638355631.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comF
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638389150.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comFalMY~
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638412498.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comalMY~
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.2fd3ac8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3493a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5980000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.3393ac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3021680.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_052516DA NtQuerySystemInformation,
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0525169F NtQuerySystemInformation,

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05479960
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05470878
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_054730D0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05472F1F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05479950
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_054799F6
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05474050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05470868
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_054730C0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05475B17
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05473E08
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05473E18
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_06DA06E5
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_00C42050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_02AC0C8B
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_051289D8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05123850
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05122FA8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0512B238
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_051295D8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0512306F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0512969F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_008F2050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C9960
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C0878
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C30D0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C2F1F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C9950
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C99F6
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C4050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C0868
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C30C0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C5B17
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C3E18
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C3E08
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB06E5
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_00DA2050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02562F30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02560878
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_025630D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02569960
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02563E18
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02563E08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02565B17
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02564050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02564060
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02560868
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_025630C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02569950
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_025699F6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_05EF06E5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_001C2050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F9960
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F0878
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F30D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F2F30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F9950
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F99F6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F0868
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F4060
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F4050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F30C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F5B17
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F3E18
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F3E08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_06B506E5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_00DB2050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_05633850
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_056323A0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_05632FA8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_0563306F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_00E02050

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680775118.0000000008940000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680630357.00000000087D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680575404.0000000008770000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905334352.0000000003011000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907237424.0000000005C10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.906613014.0000000005230000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907073740.0000000005920000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.717914840.00000000082E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.718049286.0000000008340000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.702880837.00000000014FA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.722198116.0000000005750000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename) vs 256ec8f8f67b59c5e085b0bb63afcd13.exe

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.2fd3ac8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.2fd3ac8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3493a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3493a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5980000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5980000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.3393ac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3393ac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3021680.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3021680.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@18/8@20/1

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0525149A AdjustTokenPrivileges,
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05251463 AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\256ec8f8f67b59c5e085b0bb63afcd13.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_01
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6764:120:WilError_01
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{d1470c94-c693-4be3-b7c3-884d57fb2b86}

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File created: C:\Users\user\AppData\Local\Temp\tmp98F0.tmp

Jump to behavior

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File read: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe 'C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe'
Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp'
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904860246.0000000002A85000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680575404.0000000008770000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907073740.0000000005920000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.717914840.00000000082E0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.724995186.00000000076E0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.734162357.0000000008310000.00000002.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05477743 push ds; retf
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C7743 push ds; retf
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB0440 push ss; retf
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB0500 push ss; retf
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB052C push ss; retf
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02567743 push ds; retf
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F7743 push ds; retf

Source: initial sample	Static PE information: section name: .text entropy: 7.95731162888
Source: initial sample	Static PE information: section name: .text entropy: 7.95731162888

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File opened: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Window / User API: foregroundWindowGot 860

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 5936	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6876	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6876	Thread sleep count: 216 > 30
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6876	Thread sleep count: 234 > 30
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6648	Thread sleep count: 204 > 30
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6872	Thread sleep time: -200000s >= -30000s
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 4780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 4864	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7064	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5724	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Code function: 2_2_052511C2 GetSystemInfo,

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000003.890425064.0000000006290000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Process information queried: ProcessInformation

Anti Debugging:

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Memory written: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Memory written: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp'
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905453286.00000000030CF000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904742882.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904742882.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904742882.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905334352.0000000003011000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905334352.0000000003011000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05252906 bind,
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_052528E3 bind,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Access Token Manipulation1	Masquerading2	Input Capture11	Security Software Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Virtualization/Sandbox Evasion2	LSASS Memory	Virtualization/Sandbox Evasion2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Scheduled Task/Job1	Disable or Modify Tools1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	System Information Discovery13	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol11	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Hidden Files and Directories1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Obfuscated Files or Information3	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing13	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
256ec8f8f67b59c5e085b0bb63afcd13.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack	100%	Avira	TR/NanoCore.fadte	Download File
12.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
14.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

Source	Detection	Scanner	Label	Link
cloudhost.myfirewall.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
cloudhost.myfirewall.org	1%	Virustotal		Browse
cloudhost.myfirewall.org	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.comFalMY~	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr~y8	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com;	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.comF	0%	Avira URL Cloud	safe
http://www.carterandcone.comypooo	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.comypo	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.carterandcone.comV	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.carterandcone.comlay	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sandoll.co.krC	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.carterandcone.comgy	0%	Avira URL Cloud	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://www.fonts.comi	0%	Avira URL Cloud	safe
http://www.carterandcone.comcy5	0%	Avira URL Cloud	safe
http://www.fonts.comWh2	0%	Avira URL Cloud	safe
http://www.tiro.comalMY~	0%	Avira URL Cloud	safe
http://www.fonts.comX	0%	Avira URL Cloud	safe
http://www.fontbureau.comFpz3	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.fontbureau.comalsekz	0%	Avira URL Cloud	safe
http://www.carterandcone.comint	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn7	0%	Avira URL Cloud	safe
http://www.fontbureau.commzN	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.sajatypeworks.coma-d	0%	Avira URL Cloud	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.carterandcone.comgne	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cloudhost.myfirewall.org	79.134.225.105	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
cloudhost.myfirewall.org	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.comFalMY~	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638389150.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers?	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr~y8	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638866258.0000000005686000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.com;	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.637926766.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.tiro.comF	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638355631.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comypooo	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.640116720.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639797895.00000000056BE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersQ	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642184941.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comypo	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639797895.00000000056BE000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639991224.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/mzN	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersb	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643199147.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comV	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comlay	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sandoll.co.krC	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638866258.0000000005686000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersr	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642893460.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.galapagosdesign.com/	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.644178396.000000000568D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comc	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comgy	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639918482.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comTC	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639860700.00000000056BE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comi	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.htmln	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642401940.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comcy5	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639918482.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comWh2	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comalMY~	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638412498.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fonts.comX	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comFpz3	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639394139.0000000005684000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comalsekz	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comint	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers&	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642010809.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639259634.0000000005684000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639244161.00000000056BD000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn7	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639244161.00000000056BD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.commzN	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676929479.0000000005680000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676929479.0000000005680000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.coma-d	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.637926766.000000000569B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/k	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.641965748.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers8	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers=	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642184941.00000000056B5000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comals	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comgne	256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639900319.00000000056BE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.134.225.105	unknown	Switzerland		6775	FINK-TELECOM-SERVICESCH	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	355753
Start date:	21.02.2021
Start time:	19:09:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 58s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	256ec8f8f67b59c5e085b0bb63afcd13.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@18/8@20/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.3% (good quality ratio 1.3%) Quality average: 88.6% Quality standard deviation: 6.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 168.61.161.212, 52.147.198.201, 40.126.31.137, 40.126.31.6, 20.190.159.138, 20.190.159.134, 40.126.31.8, 20.190.159.136, 40.126.31.1, 40.126.31.143, 93.184.220.29, 51.104.144.132, 13.107.4.50, 52.155.217.156, 20.54.26.129, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, arc.msn.com.nsatc.net, Edge-Prod-FRA.env.au.au-msedge.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ocsp.digicert.com, login.live.com, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, elasticShed.au.au-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, afdap.au.au-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, au.au-msedge.net, blobcollector.events.data.trafficmanager.net, au.c-0001.c-msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:09:59	API Interceptor	852x Sleep call for process: 256ec8f8f67b59c5e085b0bb63afcd13.exe modified
19:10:12	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
19:10:14	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe" s>$(Arg0)
19:10:14	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
19:10:15	API Interceptor	2x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
79.134.225.105	d88e07467ddcf9e3b19fa972b9f000d1.exe	Get hash	malicious	Browse
	73a4f40d0affe5eea89174f8917bba73.exe	Get hash	malicious	Browse
	9a08c8a2b49d6348f2ef35f85a1c6351.exe	Get hash	malicious	Browse
	7eec14e7cec4dc93fbf53e08998b2340.exe	Get hash	malicious	Browse
	f2a22415c1b108ce91fd76e3320431d0.exe	Get hash	malicious	Browse
	1d8eff2bc76e46dc186fa501e24f5cb1.exe	Get hash	malicious	Browse
	1464bbe24dac1f403f15b3c3860f37ca.exe	Get hash	malicious	Browse
	1d78424ce6944359d546dbcbc030f19e.exe	Get hash	malicious	Browse
	84ab43f7eda35ae038b199d3a3586b77.exe	Get hash	malicious	Browse
	Require_Quote_20200128 SSG.pdf ind.exe	Get hash	malicious	Browse
	DHL FILE 987634732.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	NKF20205 LIST.exe	Get hash	malicious	Browse
	URGENT PO.exe	Get hash	malicious	Browse
	scan002947779488.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cloudhost.myfirewall.org	9a08c8a2b49d6348f2ef35f85a1c6351.exe	Get hash	malicious	Browse	79.134.225.105
	zSDBuG8gDl.exe	Get hash	malicious	Browse	185.229.243.67
	65d1beae1fc7eb126cd4a9b277afb942.exe	Get hash	malicious	Browse	79.134.225.96
	f2a22415c1b108ce91fd76e3320431d0.exe	Get hash	malicious	Browse	79.134.225.105
	1d8eff2bc76e46dc186fa501e24f5cb1.exe	Get hash	malicious	Browse	79.134.225.105
	5134b758f8eb77424254ce67f4697ffe.exe	Get hash	malicious	Browse	79.134.225.96
	1d8eff2bc76e46dc186fa501e24f5cb1.exe	Get hash	malicious	Browse	79.134.225.96
	460f7e6048ed3ca91f1573a7410fedd6.exe	Get hash	malicious	Browse	79.134.225.96
	1d78424ce6944359d546dbcbc030f19e.exe	Get hash	malicious	Browse	79.134.225.105

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FINK-TELECOM-SERVICESCH	JOIN.exe	Get hash	malicious	Browse	79.134.225.30
	Delivery pdf.exe	Get hash	malicious	Browse	79.134.225.25
	d88e07467ddcf9e3b19fa972b9f000d1.exe	Get hash	malicious	Browse	79.134.225.105
	fnfqzfwC44.exe	Get hash	malicious	Browse	79.134.225.25
	Solicitud de oferta 6100003768.exe	Get hash	malicious	Browse	79.134.225.96
	Nrfgylra.exe	Get hash	malicious	Browse	79.134.225.96
	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	Get hash	malicious	Browse	79.134.225.62
	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	Get hash	malicious	Browse	79.134.225.62
	HTQ19-P0401-Q0539 NE-Q22940 GR2P5 TYPBLDG-NASER AL FERDAN.exe	Get hash	malicious	Browse	79.134.225.62
	Form pdf.exe	Get hash	malicious	Browse	79.134.225.25
	Quotation 3342688.exe	Get hash	malicious	Browse	79.134.225.120
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	79.134.225.76
	Orden.exe	Get hash	malicious	Browse	79.134.225.6
	Ordine.exe	Get hash	malicious	Browse	79.134.225.11
	73a4f40d0affe5eea89174f8917bba73.exe	Get hash	malicious	Browse	79.134.225.105
	ToolNcatalogpri00088756564162021.exe	Get hash	malicious	Browse	79.134.225.45
	INV WJD000030036000137675999, xlsx.exe	Get hash	malicious	Browse	79.134.225.69
	Kreuzmayr_PO_22656_65564345565643ETD,pdf.exe	Get hash	malicious	Browse	79.134.225.73
	jYHhaKx7OH.exe	Get hash	malicious	Browse	79.134.225.96
	request.doc	Get hash	malicious	Browse	79.134.225.69

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	412672
Entropy (8bit):	7.944378053087377
Encrypted:	false
SSDEEP:	6144:x/7jHNyWI+b1m3N2teCoTpkB/Bm8V/7bLf8q2/MQo1m1dupfmndJLvG:fEaE3N20CBTHU/Noydupf2
MD5:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
SHA1:	C006B8D2EC4B92F441815B20F1BDADF98EAB1B4D
SHA-256:	52D01903F7C366E01359A00EA771CA1F71D4E1BB54731290BC62C3A218F5AF80
SHA-512:	0BED9AC8299A16BA8F9DEFA6160A97654B08C86BF038367FC5508A90240C5801320955DCA4D452FD7E41F16CC1A71A20AC0A946D80101DC65E9495C15F98EF3C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._h2`..............0..@..........j^... ...`....@.. ....................................@..................................^..O....`.. ............................................................................ ............... ..H............text...p>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc...............J..............@..B................L^......H.......LQ..$>......\...p................................................0...........r...p.+....0...........r...p.+..".(.....^..}.....(.......(......0...........s....%.{....o....o......+.....0..+.........,..{.......+....,...{....o........(.....*..0............s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....{....o......{....o......(......{....o.....{....o......{....o.....{....o......{........s ...o!.....{....r...po".....{.... .....#s#...o$.....{.....o%.

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\256ec8f8f67b59c5e085b0bb63afcd13.exe.log Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9tv:MLF20NaL329hJ5g522rWz2T
MD5:	61CCF53571C9ABA6511D696CB0D32E45
SHA1:	A13A42A20EC14942F52DB20FB16A0A520F8183CE
SHA-256:	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
SHA-512:	90E180D9A681F82C010C326456AC88EBB89256CC769E900BFB4B2DF92E69CA69726863B45DFE4627FC1EE8C281F2AF86A6A1E2EF1710094CCD3F4E092872F06F
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9tv:MLF20NaL329hJ5g522rWz2T
MD5:	61CCF53571C9ABA6511D696CB0D32E45
SHA1:	A13A42A20EC14942F52DB20FB16A0A520F8183CE
SHA-256:	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
SHA-512:	90E180D9A681F82C010C326456AC88EBB89256CC769E900BFB4B2DF92E69CA69726863B45DFE4627FC1EE8C281F2AF86A6A1E2EF1710094CCD3F4E092872F06F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmp98F0.tmp Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.162258309875531
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0YbGPxtn:cbk4oL600QydbQxIYODOLedq3uj
MD5:	B78304EA0D7AFCCEFC8CFF617158D17C
SHA1:	76DD98BBFE885893DC19059C139EDCB829DFA21E
SHA-256:	B80490FC583697FD68F2B7D0986C9F3BA3944BDB9AEA7F17C826E26BF1749C7F
SHA-512:	44682D75002B56551B4075616110FF4887DD298D7B9B96A312BDDAB6AB94A7E42AFADF690CED378FF403337185DD74C77D2B4DABE3BB60B9642C24079AC51067
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpA082.tmp Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:JPn:JPn
MD5:	5BF06D5C11AE13FC9970936540EB0703
SHA1:	54B778FC0BA984A04D47CB1E5C6E8252E9BE3FF9
SHA-256:	39974C521C78E35079501265DF5A694586DAB94A7EE52F6E923756C5AFE5F3F0
SHA-512:	C0CF94EB89C82DD4D0B9F798D1C30D02F93C8A02C526F5605356F649259F23ED47820D99F10B94A34929EC144835D9F389121AEF98E55EB5CB30CCBFF6B0FC30
Malicious:	true
Preview:	.>....H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.5831339906659565
Encrypted:	false
SSDEEP:	3:oNt+WfWXQj0I/sPDWsC:oNwvAj0Gs7lC
MD5:	90C08D85024FAD583545EC9562AA4A7E
SHA1:	FB6483F47BEC7ED49479D276986B4B789D9725AD
SHA-256:	28D29127F67EA98D32833FAC5491366FEC57805EAFF2B15A8AB9AF2555EADCA3
SHA-512:	EEC099998337F7294CFA0C273BFC1D31CDBA555935163CC483E00D7451A529ECF71131EAB74549B031EA9F6A15531F68D5CA1A4070D3EB7B97E5CC13D1701C73
Malicious:	false
Preview:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.944378053087377
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	256ec8f8f67b59c5e085b0bb63afcd13.exe
File size:	412672
MD5:	0bbcc2e64e3edf053ed4af2c0bafb0eb
SHA1:	c006b8d2ec4b92f441815b20f1bdadf98eab1b4d
SHA256:	52d01903f7c366e01359a00ea771ca1f71d4e1bb54731290bc62c3a218f5af80
SHA512:	0bed9ac8299a16ba8f9defa6160a97654b08c86bf038367fc5508a90240c5801320955dca4d452fd7e41f16cc1a71a20ac0a946d80101dc65e9495c15f98ef3c
SSDEEP:	6144:x/7jHNyWI+b1m3N2teCoTpkB/Bm8V/7bLf8q2/MQo1m1dupfmndJLvG:fEaE3N20CBTHU/Noydupf2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._h2`..............0..@..........j^... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x465e6a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6032685F [Sun Feb 21 14:04:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x65e18	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0x620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x68000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x63e70	0x64000	False	0.948125	data	7.95731162888	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x66000	0x620	0x800	False	0.3427734375	data	3.56974614095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x68000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x66090	0x390	data
RT_MANIFEST	0x66430	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	2013-2021 (C) Blackboard Learn
Assembly Version	16.60.0.4
InternalName	0FDM.exe
FileVersion	16.69.0.4
CompanyName	Blackboard Learn
LegalTrademarks
Comments	Moodle
ProductName	Student Studio
ProductVersion	16.69.0.4
FileDescription	Student Studio
OriginalFilename	0FDM.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2021 19:10:14.481653929 CET	49743	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:14.565690994 CET	5654	49743	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:15.072868109 CET	49743	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:15.159531116 CET	5654	49743	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:15.664880037 CET	49743	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:15.747469902 CET	5654	49743	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:19.969670057 CET	49744	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:20.058454990 CET	5654	49744	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:20.618283033 CET	49744	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:20.703840017 CET	5654	49744	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:21.212810993 CET	49744	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:21.301839113 CET	5654	49744	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:25.510416985 CET	49745	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:25.595660925 CET	5654	49745	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:26.196866989 CET	49745	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:26.282290936 CET	5654	49745	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:26.884773016 CET	49745	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:26.970243931 CET	5654	49745	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:31.217709064 CET	49746	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:31.301038027 CET	5654	49746	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:31.816807032 CET	49746	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:31.899502993 CET	5654	49746	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:32.416230917 CET	49746	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:32.501424074 CET	5654	49746	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:36.666985035 CET	49751	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:36.751816034 CET	5654	49751	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:37.307209015 CET	49751	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:37.393260002 CET	5654	49751	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:37.916681051 CET	49751	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:38.001872063 CET	5654	49751	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:42.088305950 CET	49752	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:42.175749063 CET	5654	49752	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:42.682614088 CET	49752	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:42.768296957 CET	5654	49752	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:43.276427984 CET	49752	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:43.364061117 CET	5654	49752	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:48.494093895 CET	49754	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:48.576904058 CET	5654	49754	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:49.089562893 CET	49754	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:49.172209024 CET	5654	49754	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:49.683207989 CET	49754	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:49.765983105 CET	5654	49754	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:53.863328934 CET	49755	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:53.950566053 CET	5654	49755	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:54.464886904 CET	49755	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:54.550196886 CET	5654	49755	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:55.058656931 CET	49755	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:55.144181013 CET	5654	49755	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:59.228866100 CET	49764	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:59.318568945 CET	5654	49764	79.134.225.105	192.168.2.4
Feb 21, 2021 19:10:59.825444937 CET	49764	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:10:59.908130884 CET	5654	49764	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:00.418479919 CET	49764	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:00.504683018 CET	5654	49764	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:04.667921066 CET	49768	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:04.753856897 CET	5654	49768	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:05.262670040 CET	49768	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:05.377309084 CET	5654	49768	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:05.887820959 CET	49768	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:05.970722914 CET	5654	49768	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:10.697511911 CET	49772	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:10.784476042 CET	5654	49772	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:11.294397116 CET	49772	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:11.388797998 CET	5654	49772	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:11.904058933 CET	49772	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:11.988487959 CET	5654	49772	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:16.086658955 CET	49775	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:16.169102907 CET	5654	49775	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:16.669847012 CET	49775	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:16.762417078 CET	5654	49775	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:17.263628960 CET	49775	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:17.346447945 CET	5654	49775	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:21.496545076 CET	49776	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:21.582596064 CET	5654	49776	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:22.092253923 CET	49776	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:22.179691076 CET	5654	49776	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:22.685975075 CET	49776	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:22.773654938 CET	5654	49776	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:26.892983913 CET	49777	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:26.977591991 CET	5654	49777	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:27.483406067 CET	49777	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:27.567987919 CET	5654	49777	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:28.077723980 CET	49777	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:28.160851002 CET	5654	49777	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:32.253349066 CET	49778	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:32.341033936 CET	5654	49778	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:32.843106031 CET	49778	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:32.946002960 CET	5654	49778	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:33.452650070 CET	49778	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:33.540216923 CET	5654	49778	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:37.963520050 CET	49779	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:38.048171043 CET	5654	49779	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:38.577904940 CET	49779	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:38.662389040 CET	5654	49779	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:39.171739101 CET	49779	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:39.258052111 CET	5654	49779	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:43.969376087 CET	49780	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:44.054805994 CET	5654	49780	79.134.225.105	192.168.2.4
Feb 21, 2021 19:11:44.562824965 CET	49780	5654	192.168.2.4	79.134.225.105
Feb 21, 2021 19:11:44.648353100 CET	5654	49780	79.134.225.105	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2021 19:09:48.930857897 CET	54531	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:48.982146978 CET	53	54531	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:49.823251963 CET	49714	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:49.871979952 CET	53	49714	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:51.212296963 CET	58028	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:51.260798931 CET	53	58028	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:52.114397049 CET	53097	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:52.168731928 CET	53	53097	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:53.199487925 CET	49257	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:53.249475002 CET	53	49257	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:54.438493967 CET	62389	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:54.491493940 CET	53	62389	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:55.249241114 CET	49910	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:55.298619032 CET	53	49910	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:56.177673101 CET	55854	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:56.229222059 CET	53	55854	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:57.144870043 CET	64549	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:57.196521044 CET	53	64549	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:58.704134941 CET	63153	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:58.752796888 CET	53	63153	8.8.8.8	192.168.2.4
Feb 21, 2021 19:09:59.582113028 CET	52991	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:09:59.631140947 CET	53	52991	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:00.345346928 CET	53700	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:00.396811008 CET	53	53700	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:01.173523903 CET	51726	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:01.225342989 CET	53	51726	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:02.044966936 CET	56794	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:02.093724966 CET	53	56794	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:03.014596939 CET	56534	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:03.064789057 CET	53	56534	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:03.832214117 CET	56627	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:03.884660959 CET	53	56627	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:04.691565037 CET	56621	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:04.742393970 CET	53	56621	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:05.521996021 CET	63116	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:05.571896076 CET	53	63116	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:14.237704992 CET	64078	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:14.307945013 CET	53	64078	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:19.900085926 CET	64801	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:19.956199884 CET	53	64801	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:25.420279980 CET	61721	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:25.490183115 CET	53	61721	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:31.005204916 CET	51255	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:31.065110922 CET	53	51255	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:32.919872046 CET	61522	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:32.982388973 CET	53	61522	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:33.138350964 CET	52337	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:33.191318989 CET	53	52337	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:33.450341940 CET	55046	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:33.501333952 CET	53	55046	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:36.605760098 CET	49612	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:36.665493011 CET	53	49612	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:42.038508892 CET	49285	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:42.087125063 CET	53	49285	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:43.471916914 CET	50601	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:43.520714045 CET	53	50601	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:48.389977932 CET	60875	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:48.440829992 CET	53	60875	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:53.801810980 CET	56448	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:53.860038996 CET	53	56448	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:54.833420992 CET	59172	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:54.928378105 CET	53	59172	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:55.452928066 CET	62420	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:55.510045052 CET	53	62420	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:56.095340014 CET	60579	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:56.144824028 CET	53	60579	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:56.231909037 CET	50183	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:56.306546926 CET	53	50183	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:56.870721102 CET	61531	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:56.919975996 CET	53	61531	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:57.407344103 CET	49228	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:57.497565031 CET	53	49228	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:58.045015097 CET	59794	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:58.133251905 CET	53	59794	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:58.729538918 CET	55916	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:58.795614958 CET	53	55916	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:59.175395966 CET	52752	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:59.227727890 CET	53	52752	8.8.8.8	192.168.2.4
Feb 21, 2021 19:10:59.520904064 CET	60542	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:10:59.570298910 CET	53	60542	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:00.651365995 CET	60689	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:00.708756924 CET	53	60689	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:01.183861017 CET	64206	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:01.243877888 CET	53	64206	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:04.595330954 CET	50904	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:04.662915945 CET	53	50904	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:09.863444090 CET	57525	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:09.914339066 CET	53	57525	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:09.970029116 CET	53814	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:10.047624111 CET	53	53814	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:10.646823883 CET	53418	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:10.696320057 CET	53	53418	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:11.946039915 CET	62833	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:12.011301041 CET	53	62833	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:16.027312040 CET	59260	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:16.085422993 CET	53	59260	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:21.439564943 CET	49944	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:21.494040966 CET	53	49944	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:26.815378904 CET	63300	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:26.889494896 CET	53	63300	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:32.201236010 CET	61449	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:32.251133919 CET	53	61449	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:37.896838903 CET	51275	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:37.962276936 CET	53	51275	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:43.917714119 CET	63492	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:43.968136072 CET	53	63492	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:45.245934963 CET	58945	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:45.295686960 CET	53	58945	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:49.000189066 CET	60779	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:49.059232950 CET	53	60779	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:49.281303883 CET	64014	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:49.329972982 CET	53	64014	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:54.650861025 CET	57091	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:11:54.702620029 CET	53	57091	8.8.8.8	192.168.2.4
Feb 21, 2021 19:11:59.986953974 CET	55904	53	192.168.2.4	8.8.8.8
Feb 21, 2021 19:12:00.047180891 CET	53	55904	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 21, 2021 19:10:14.237704992 CET	192.168.2.4	8.8.8.8	0x58b3	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:19.900085926 CET	192.168.2.4	8.8.8.8	0x2e69	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:25.420279980 CET	192.168.2.4	8.8.8.8	0xc51	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:31.005204916 CET	192.168.2.4	8.8.8.8	0x9380	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:36.605760098 CET	192.168.2.4	8.8.8.8	0x18db	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:42.038508892 CET	192.168.2.4	8.8.8.8	0xbe86	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:48.389977932 CET	192.168.2.4	8.8.8.8	0x5bdf	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:53.801810980 CET	192.168.2.4	8.8.8.8	0x5d7e	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:59.175395966 CET	192.168.2.4	8.8.8.8	0x964c	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:04.595330954 CET	192.168.2.4	8.8.8.8	0xce78	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:10.646823883 CET	192.168.2.4	8.8.8.8	0x80ee	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:16.027312040 CET	192.168.2.4	8.8.8.8	0x831c	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:21.439564943 CET	192.168.2.4	8.8.8.8	0xdff9	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:26.815378904 CET	192.168.2.4	8.8.8.8	0x9982	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:32.201236010 CET	192.168.2.4	8.8.8.8	0x54b7	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:37.896838903 CET	192.168.2.4	8.8.8.8	0x429e	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:43.917714119 CET	192.168.2.4	8.8.8.8	0xcd9d	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:49.281303883 CET	192.168.2.4	8.8.8.8	0x2942	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:54.650861025 CET	192.168.2.4	8.8.8.8	0x7fae	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:59.986953974 CET	192.168.2.4	8.8.8.8	0x3e30	Standard query (0)	cloudhost.myfirewall.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 21, 2021 19:10:14.307945013 CET	8.8.8.8	192.168.2.4	0x58b3	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:19.956199884 CET	8.8.8.8	192.168.2.4	0x2e69	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:25.490183115 CET	8.8.8.8	192.168.2.4	0xc51	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:31.065110922 CET	8.8.8.8	192.168.2.4	0x9380	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:32.982388973 CET	8.8.8.8	192.168.2.4	0x73f3	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Feb 21, 2021 19:10:36.665493011 CET	8.8.8.8	192.168.2.4	0x18db	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:42.087125063 CET	8.8.8.8	192.168.2.4	0xbe86	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:48.440829992 CET	8.8.8.8	192.168.2.4	0x5bdf	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:53.860038996 CET	8.8.8.8	192.168.2.4	0x5d7e	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:10:59.227727890 CET	8.8.8.8	192.168.2.4	0x964c	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:04.662915945 CET	8.8.8.8	192.168.2.4	0xce78	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:10.696320057 CET	8.8.8.8	192.168.2.4	0x80ee	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:16.085422993 CET	8.8.8.8	192.168.2.4	0x831c	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:21.494040966 CET	8.8.8.8	192.168.2.4	0xdff9	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:26.889494896 CET	8.8.8.8	192.168.2.4	0x9982	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:32.251133919 CET	8.8.8.8	192.168.2.4	0x54b7	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:37.962276936 CET	8.8.8.8	192.168.2.4	0x429e	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:43.968136072 CET	8.8.8.8	192.168.2.4	0xcd9d	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:49.329972982 CET	8.8.8.8	192.168.2.4	0x2942	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:11:54.702620029 CET	8.8.8.8	192.168.2.4	0x7fae	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)
Feb 21, 2021 19:12:00.047180891 CET	8.8.8.8	192.168.2.4	0x3e30	No error (0)	cloudhost.myfirewall.org		79.134.225.105	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720 Parent PID: 6088

General

Start time:	19:09:54
Start date:	21/02/2021
Path:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe'
Imagebase:	0xc40000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416 Parent PID: 6720

General

Start time:	19:10:08
Start date:	21/02/2021
Path:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x8f0000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: schtasks.exe PID: 6540 Parent PID: 6416

General

Start time:	19:10:10
Start date:	21/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'
Imagebase:	0xc00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6744 Parent PID: 6540

General

Start time:	19:10:12
Start date:	21/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exe PID: 6632 Parent PID: 6416

General

Start time:	19:10:12
Start date:	21/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp'
Imagebase:	0xc00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6764 Parent PID: 6632

General

Start time:	19:10:13
Start date:	21/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888 Parent PID: 968

General

Start time:	19:10:14
Start date:	21/02/2021
Path:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe 0
Imagebase:	0xda0000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 2460 Parent PID: 968

General

Start time:	19:10:14
Start date:	21/02/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0x1c0000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: dhcpmon.exe PID: 7160 Parent PID: 3424

General

Start time:	19:10:20
Start date:	21/02/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0xdb0000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260 Parent PID: 6888

General

Start time:	19:10:24
Start date:	21/02/2021
Path:	C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xe00000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 6500 Parent PID: 2460

General

Start time:	19:10:25
Start date:	21/02/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xb90000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 5748 Parent PID: 7160

General

Start time:	19:10:36
Start date:	21/02/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x810000
File size:	412672 bytes
MD5 hash:	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 256ec8f8f67b59c5e085b0bb63afcd13.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets