Play interactive tour

Edit tour

Analysis Report LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Overview

General Information

Sample Name:	LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Analysis ID:	355833
MD5:	988bbc4bf9b82be5dfa915ecb1b63c49
SHA1:	c4a75851e915e5072a9ec720139a7693f3819f84
SHA256:	9af6ee7679b5e12c34b0530a2b7639c65b1ff8449930ed9a6156338a2eebbb98
Tags:	exeNanoCoreRAT
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

.NET source code contains potential unpacker

Binary contains a suspicious time stamp

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe (PID: 6336 cmdline: 'C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe' MD5: 988BBC4BF9B82BE5DFA915ECB1B63C49)

schtasks.exe (PID: 6864 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmp9968.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe (PID: 6908 cmdline: {path} MD5: 988BBC4BF9B82BE5DFA915ECB1B63C49)

schtasks.exe (PID: 4552 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp4916.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe (PID: 3132 cmdline: 'C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe' 0 MD5: 988BBC4BF9B82BE5DFA915ECB1B63C49)

schtasks.exe (PID: 2196 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmpA04.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe (PID: 1276 cmdline: {path} MD5: 988BBC4BF9B82BE5DFA915ECB1B63C49)

LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe (PID: 1236 cmdline: {path} MD5: 988BBC4BF9B82BE5DFA915ECB1B63C49)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "c4cca249-81f6-4232-9f14-01569e09f5f0", "Group": "JANUARY", "Domain1": "shahzad73.casacam.net", "Domain2": "shahzad73.ddns.net", "Port": 9036, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000007.00000002.493487439.0000000002DC1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10cf65:$x1: NanoCore.ClientPluginHost 0x10cfa2:$x2: IClientNetworkHost 0x110ad5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10cccd:$a: NanoCore 0x10ccdd:$a: NanoCore 0x10cf11:$a: NanoCore 0x10cf25:$a: NanoCore 0x10cf65:$a: NanoCore 0x10cd2c:$b: ClientPlugin 0x10cf2e:$b: ClientPlugin 0x10cf6e:$b: ClientPlugin 0x10ce53:$c: ProjectData 0x10d85a:$d: DESCrypto 0x115226:$e: KeepAlive 0x113214:$g: LogClientMessage 0x10f40f:$i: get_Connected 0x10db90:$j: #=q 0x10dbc0:$j: #=q 0x10dbdc:$j: #=q 0x10dc0c:$j: #=q 0x10dc28:$j: #=q 0x10dc44:$j: #=q 0x10dc74:$j: #=q 0x10dc90:$j: #=q
00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x430cd:$x1: NanoCore.ClientPluginHost 0x4310a:$x2: IClientNetworkHost 0x46c3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42e35:$a: NanoCore 0x42e45:$a: NanoCore 0x43079:$a: NanoCore 0x4308d:$a: NanoCore 0x430cd:$a: NanoCore 0x42e94:$b: ClientPlugin 0x43096:$b: ClientPlugin 0x430d6:$b: ClientPlugin 0x42fbb:$c: ProjectData 0x439c2:$d: DESCrypto 0x4b38e:$e: KeepAlive 0x4937c:$g: LogClientMessage 0x45577:$i: get_Connected 0x43cf8:$j: #=q 0x43d28:$j: #=q 0x43d44:$j: #=q 0x43d74:$j: #=q 0x43d90:$j: #=q 0x43dac:$j: #=q 0x43ddc:$j: #=q 0x43df8:$j: #=q
00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x435cd:$a: NanoCore 0x43626:$a: NanoCore 0x43663:$a: NanoCore 0x436dc:$a: NanoCore 0x56d87:$a: NanoCore 0x56d9c:$a: NanoCore 0x56dd1:$a: NanoCore 0x6fd7b:$a: NanoCore 0x6fd90:$a: NanoCore 0x6fdc5:$a: NanoCore 0x4362f:$b: ClientPlugin 0x4366c:$b: ClientPlugin 0x43f6a:$b: ClientPlugin 0x43f77:$b: ClientPlugin 0x56b43:$b: ClientPlugin 0x56b5e:$b: ClientPlugin 0x56b8e:$b: ClientPlugin 0x56da5:$b: ClientPlugin 0x56dda:$b: ClientPlugin 0x6fb37:$b: ClientPlugin 0x6fb52:$b: ClientPlugin
0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13fd95:$x1: NanoCore.ClientPluginHost 0x2b97c5:$x1: NanoCore.ClientPluginHost 0x13fdd2:$x2: IClientNetworkHost 0x2b9802:$x2: IClientNetworkHost 0x143905:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2bd335:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x13fafd:$a: NanoCore 0x13fb0d:$a: NanoCore 0x13fd41:$a: NanoCore 0x13fd55:$a: NanoCore 0x13fd95:$a: NanoCore 0x2b952d:$a: NanoCore 0x2b953d:$a: NanoCore 0x2b9771:$a: NanoCore 0x2b9785:$a: NanoCore 0x2b97c5:$a: NanoCore 0x13fb5c:$b: ClientPlugin 0x13fd5e:$b: ClientPlugin 0x13fd9e:$b: ClientPlugin 0x2b958c:$b: ClientPlugin 0x2b978e:$b: ClientPlugin 0x2b97ce:$b: ClientPlugin 0x13fc83:$c: ProjectData 0x26b426:$c: ProjectData 0x2b96b3:$c: ProjectData 0x14068a:$d: DESCrypto 0x2ba0ba:$d: DESCrypto
00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000015.00000002.370366843.0000000002E51000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000015.00000002.370366843.0000000002E51000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x695ff:$a: NanoCore 0x69658:$a: NanoCore 0x69695:$a: NanoCore 0x6970e:$a: NanoCore 0x69661:$b: ClientPlugin 0x6969e:$b: ClientPlugin 0x69f9c:$b: ClientPlugin 0x69fa9:$b: ClientPlugin 0x5f782:$e: KeepAlive 0x69ae9:$g: LogClientMessage 0x69a69:$i: get_Connected 0x59a35:$j: #=q 0x59a65:$j: #=q 0x59aa1:$j: #=q 0x59ac9:$j: #=q 0x59af9:$j: #=q 0x59b29:$j: #=q 0x59b59:$j: #=q 0x59b89:$j: #=q 0x59ba5:$j: #=q 0x59bd5:$j: #=q
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x662e:$x1: NanoCore.ClientPluginHost 0x6246c:$x1: NanoCore.ClientPluginHost 0x6802b:$x1: NanoCore.ClientPluginHost 0x793ef:$x1: NanoCore.ClientPluginHost 0xb51cf:$x1: NanoCore.ClientPluginHost 0x668f:$x2: IClientNetworkHost 0x62492:$x2: IClientNetworkHost 0x68070:$x2: IClientNetworkHost 0x79434:$x2: IClientNetworkHost 0xb51f5:$x2: IClientNetworkHost 0xba94:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x19a06:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6133:$a: NanoCore 0x614f:$a: NanoCore 0x62aa:$a: NanoCore 0x62b9:$a: NanoCore 0x6592:$a: NanoCore 0x65be:$a: NanoCore 0x662e:$a: NanoCore 0x16070:$a: NanoCore 0x16082:$a: NanoCore 0x160be:$a: NanoCore 0x6235e:$a: NanoCore 0x623ff:$a: NanoCore 0x6246c:$a: NanoCore 0x6252d:$a: NanoCore 0x633fe:$a: NanoCore 0x63451:$a: NanoCore 0x6348a:$a: NanoCore 0x634fd:$a: NanoCore 0x67fa5:$a: NanoCore 0x67fd2:$a: NanoCore 0x6802b:$a: NanoCore
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1ac9c4:$x1: NanoCore.ClientPluginHost 0x1aca25:$x2: IClientNetworkHost 0x1b1e2a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1bfd9c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1ac4c9:$a: NanoCore 0x1ac4e5:$a: NanoCore 0x1ac640:$a: NanoCore 0x1ac64f:$a: NanoCore 0x1ac928:$a: NanoCore 0x1ac954:$a: NanoCore 0x1ac9c4:$a: NanoCore 0x1bc406:$a: NanoCore 0x1bc418:$a: NanoCore 0x1bc454:$a: NanoCore 0x1ac570:$b: ClientPlugin 0x1ac699:$b: ClientPlugin 0x1ac95d:$b: ClientPlugin 0x1ac9cd:$b: ClientPlugin 0x1bc421:$b: ClientPlugin 0x1bc45d:$b: ClientPlugin 0x1ac7e6:$c: ProjectData 0x1bc353:$c: ProjectData 0x1e9174:$c: ProjectData 0x1ead97:$c: ProjectData 0x1ad922:$d: DESCrypto
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x11f1b:$x1: NanoCore.ClientPluginHost 0x21aab9:$x1: NanoCore.ClientPluginHost 0x38874c:$x1: NanoCore.ClientPluginHost 0x11f41:$x2: IClientNetworkHost 0x21ab1a:$x2: IClientNetworkHost 0x3887ad:$x2: IClientNetworkHost 0x38dbb2:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x39bb24:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4ae3:$a: NanoCore 0x4b4a:$a: NanoCore 0x4bef:$a: NanoCore 0x11e0d:$a: NanoCore 0x11eae:$a: NanoCore 0x11f1b:$a: NanoCore 0x11fdc:$a: NanoCore 0x12ead:$a: NanoCore 0x12f00:$a: NanoCore 0x12f39:$a: NanoCore 0x12fac:$a: NanoCore 0x21aa4c:$a: NanoCore 0x21aa7c:$a: NanoCore 0x21aab9:$a: NanoCore 0x2212eb:$a: NanoCore 0x221301:$a: NanoCore 0x221324:$a: NanoCore 0x2da875:$a: NanoCore 0x2da898:$a: NanoCore 0x317f05:$a: NanoCore 0x317f25:$a: NanoCore
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5d7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d604:$x2: IClientNetworkHost
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5d7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6b2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5f1:$s5: IClientLoggingHost
7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d58d:$a: NanoCore 0x2d5a2:$a: NanoCore 0x2d5d7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d349:$b: ClientPlugin 0x2d364:$b: ClientPlugin
7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x189bbd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x189bfa:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x18d72d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x189925:$a: NanoCore 0x189935:$a: NanoCore 0x189b69:$a: NanoCore 0x189b7d:$a: NanoCore 0x189bbd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x189984:$b: ClientPlugin 0x189b86:$b: ClientPlugin 0x189bc6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x13b81e:$c: ProjectData 0x189aab:$c: ProjectData 0x10a82:$d: DESCrypto 0x18a4b2:$d: DESCrypto
7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2decaf8.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2decaf8.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287a1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ce:$x2: IClientNetworkHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287a1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2987c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287bb:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24178:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241a5:$x2: IClientNetworkHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24178:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25253:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x24192:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2eb9820.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2eb9820.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd13dd:$x1: NanoCore.ClientPluginHost 0xd141a:$x2: IClientNetworkHost 0xd4f4d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd1145:$a: NanoCore 0xd1155:$a: NanoCore 0xd1389:$a: NanoCore 0xd139d:$a: NanoCore 0xd13dd:$a: NanoCore 0xd11a4:$b: ClientPlugin 0xd13a6:$b: ClientPlugin 0xd13e6:$b: ClientPlugin 0x8303e:$c: ProjectData 0xd12cb:$c: ProjectData 0xd1cd2:$d: DESCrypto 0xd969e:$e: KeepAlive 0xd768c:$g: LogClientMessage 0xd3887:$i: get_Connected 0xd2008:$j: #=q 0xd2038:$j: #=q 0xd2054:$j: #=q 0xd2084:$j: #=q 0xd20a0:$j: #=q 0xd20bc:$j: #=q 0xd20ec:$j: #=q
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Click to see the 38 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, ProcessId: 6908, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmp9968.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmp9968.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe' , ParentImage: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, ParentProcessId: 6336, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmp9968.tmp', ProcessId: 6864

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: {path}, CommandLine: {path}, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, NewProcessName: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, OriginalFileName: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe' , ParentImage: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, ParentProcessId: 6336, ProcessCommandLine: {path}, ProcessId: 6908

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "c4cca249-81f6-4232-9f14-01569e09f5f0", "Group": "JANUARY", "Domain1": "shahzad73.casacam.net", "Domain2": "shahzad73.ddns.net", "Port": 9036, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\FOvTZkul.exe

ReversingLabs: Detection: 12%

Multi AV Scanner detection for submitted file

Show sources

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

ReversingLabs: Detection: 12%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.493487439.0000000002DC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.370366843.0000000002E51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236, type: MEMORY
Source: Yara match	File source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336, type: MEMORY
Source: Yara match	File source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908, type: MEMORY
Source: Yara match	File source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\FOvTZkul.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Joe Sandbox ML: detected

Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Show sources

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49721 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49722 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49723 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49730 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49731 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49732 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49738 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49739 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49740 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49741 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49742 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49744 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49745 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49746 -> 91.212.153.84:9036
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49749 -> 91.212.153.84:9036

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: shahzad73.ddns.net
Source: Malware configuration extractor	URLs: shahzad73.casacam.net

Source: global traffic

TCP traffic: 192.168.2.5:49721 -> 91.212.153.84:9036

Source: Joe Sandbox View

IP Address: 91.212.153.84 91.212.153.84

Source: Joe Sandbox View

ASN Name: MYLOC-ASIPBackboneofmyLocmanagedITAGDE MYLOC-ASIPBackboneofmyLocmanagedITAGDE

Source: unknown

DNS traffic detected: queries for: shahzad73.casacam.net

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.279958013.0000000003201000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.349317167.0000000002851000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.285862518.00000000072A2000.00000004.00000001.sdmp, LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.354228123.0000000005710000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.279627168.000000000147B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.493487439.0000000002DC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.370366843.0000000002E51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236, type: MEMORY
Source: Yara match	File source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336, type: MEMORY
Source: Yara match	File source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908, type: MEMORY
Source: Yara match	File source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.370366843.0000000002E51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2decaf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2eb9820.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 0_2_0172F470	0_2_0172F470
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 0_2_0172F460	0_2_0172F460
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 0_2_0172D4FC	0_2_0172D4FC
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 0_2_056D1535	0_2_056D1535
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 7_2_012FE471	7_2_012FE471
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 7_2_012FE480	7_2_012FE480
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 7_2_012FBBD4	7_2_012FBBD4
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 15_2_068B3EF4	15_2_068B3EF4
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 15_2_068B0200	15_2_068B0200
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 15_2_068B3A70	15_2_068B3A70
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 15_2_068B01F0	15_2_068B01F0
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 15_2_068B6F77	15_2_068B6F77
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 21_2_0130E471	21_2_0130E471
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 21_2_0130E480	21_2_0130E480
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Code function: 21_2_0130BBD4	21_2_0130BBD4

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000002.365342774.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.280044415.0000000004209000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.281405044.00000000046F7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.352145184.0000000003859000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.488637501.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.370366843.0000000002E51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 1236, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6336, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe PID: 6908, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3e9b7ee.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2decaf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2decaf8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea4c4d.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.4729f40.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3988c08.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2eb9820.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.2eb9820.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3a413e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.3ea0624.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FOvTZkul.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 21.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.2.LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@17/10@15/2

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

File created: C:\Users\user\AppData\Roaming\FOvTZkul.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_01
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{c4cca249-81f6-4232-9f14-01569e09f5f0}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5460:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_01
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Mutant created: \Sessions\1\BaseNamedObjects\WjOJCroITQdUbvUa

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9968.tmp

Jump to behavior

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

ReversingLabs: Detection: 12%

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

File read: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe 'C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmp9968.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp4916.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe 'C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe' 0
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmpA04.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe {path}
Source: unknown	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe {path}
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmp9968.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp4916.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOvTZkul' /XML 'C:\Users\user\AppData\Local\Temp\tmpA04.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Process created: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Static PE information: data directory type:<

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.288486730.0000000009030000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.279627168.000000000147B000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.288762334.00000000096F0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000002.288762334.00000000096F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000000.00000000.222149206.0000000000D40000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000007.00000002.493487439.0000000002DC1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000007.00000002.489676838.0000000000A70000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000007.00000003.299491725.00000000065FD000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000000.291317278.0000000000480000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.356753641.0000000008720000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 0000000F.00000002.356277146.0000000006810000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000014.00000002.344932562.00000000000C0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000015.00000000.346222068.00000000009E0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe, 00000015.00000002.370926802.0000000003E59000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe
Source: LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe	Binary or memory string: OriginalFilename vs LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe