Play interactive tour

Edit tour

Analysis Report cpIaMuv3PV.exe

Overview

General Information

Sample Name:	cpIaMuv3PV.exe
Analysis ID:	358139
MD5:	a8911878f9c096c7bfe665b8076a8704
SHA1:	1dffaac5e83c62a0478095c68684bc4974f559db
SHA256:	498df02f7263a2b524603cb58cd01c45115645f7586147fd39b19e930dffc667
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM_3

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

cpIaMuv3PV.exe (PID: 6364 cmdline: 'C:\Users\user\Desktop\cpIaMuv3PV.exe' MD5: A8911878F9C096C7BFE665B8076A8704)

schtasks.exe (PID: 6476 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cpIaMuv3PV.exe (PID: 6552 cmdline: C:\Users\user\Desktop\cpIaMuv3PV.exe MD5: A8911878F9C096C7BFE665B8076A8704)

dhcpmon.exe (PID: 7060 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: A8911878F9C096C7BFE665B8076A8704)

schtasks.exe (PID: 6388 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp7E79.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 6232 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: A8911878F9C096C7BFE665B8076A8704)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8807-1300-00", "Group": "worker", "Domain1": "", "Domain2": "hailongfvt.zapto.org", "Port": 3365, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2ef5:$a: NanoCore 0x2f4e:$a: NanoCore 0x2f8b:$a: NanoCore 0x3004:$a: NanoCore 0x166af:$a: NanoCore 0x166c4:$a: NanoCore 0x166f9:$a: NanoCore 0x2f16b:$a: NanoCore 0x2f180:$a: NanoCore 0x2f1b5:$a: NanoCore 0x2f57:$b: ClientPlugin 0x2f94:$b: ClientPlugin 0x3892:$b: ClientPlugin 0x389f:$b: ClientPlugin 0x1646b:$b: ClientPlugin 0x16486:$b: ClientPlugin 0x164b6:$b: ClientPlugin 0x166cd:$b: ClientPlugin 0x16702:$b: ClientPlugin 0x2ef27:$b: ClientPlugin 0x2ef42:$b: ClientPlugin
00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe110d:$x1: NanoCore.ClientPluginHost 0xe114a:$x2: IClientNetworkHost 0xe4c7d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0e75:$a: NanoCore 0xe0e85:$a: NanoCore 0xe10b9:$a: NanoCore 0xe10cd:$a: NanoCore 0xe110d:$a: NanoCore 0xe0ed4:$b: ClientPlugin 0xe10d6:$b: ClientPlugin 0xe1116:$b: ClientPlugin 0xe0ffb:$c: ProjectData 0xe1a02:$d: DESCrypto 0xe93ce:$e: KeepAlive 0xe73bc:$g: LogClientMessage 0xe35b7:$i: get_Connected 0xe1d38:$j: #=q 0xe1d68:$j: #=q 0xe1d84:$j: #=q 0xe1db4:$j: #=q 0xe1dd0:$j: #=q 0xe1dec:$j: #=q 0xe1e1c:$j: #=q 0xe1e38:$j: #=q
00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42ef5:$a: NanoCore 0x42f4e:$a: NanoCore 0x42f8b:$a: NanoCore 0x43004:$a: NanoCore 0x566af:$a: NanoCore 0x566c4:$a: NanoCore 0x566f9:$a: NanoCore 0x6f16b:$a: NanoCore 0x6f180:$a: NanoCore 0x6f1b5:$a: NanoCore 0x42f57:$b: ClientPlugin 0x42f94:$b: ClientPlugin 0x43892:$b: ClientPlugin 0x4389f:$b: ClientPlugin 0x5646b:$b: ClientPlugin 0x56486:$b: ClientPlugin 0x564b6:$b: ClientPlugin 0x566cd:$b: ClientPlugin 0x56702:$b: ClientPlugin 0x6ef27:$b: ClientPlugin 0x6ef42:$b: ClientPlugin
00000004.00000002.501066810.0000000002951000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6943f:$a: NanoCore 0x69498:$a: NanoCore 0x694d5:$a: NanoCore 0x6954e:$a: NanoCore 0x694a1:$b: ClientPlugin 0x694de:$b: ClientPlugin 0x69ddc:$b: ClientPlugin 0x69de9:$b: ClientPlugin 0x5f08d:$e: KeepAlive 0x69929:$g: LogClientMessage 0x698a9:$i: get_Connected 0x59875:$j: #=q 0x598a5:$j: #=q 0x598e1:$j: #=q 0x59909:$j: #=q 0x59939:$j: #=q 0x59969:$j: #=q 0x59999:$j: #=q 0x599c9:$j: #=q 0x599e5:$j: #=q 0x59a15:$j: #=q
00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1069dd:$x1: NanoCore.ClientPluginHost 0x106a1a:$x2: IClientNetworkHost 0x10a54d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x106745:$a: NanoCore 0x106755:$a: NanoCore 0x106989:$a: NanoCore 0x10699d:$a: NanoCore 0x1069dd:$a: NanoCore 0x1067a4:$b: ClientPlugin 0x1069a6:$b: ClientPlugin 0x1069e6:$b: ClientPlugin 0x236f5:$c: ProjectData 0x1068cb:$c: ProjectData 0x1072d2:$d: DESCrypto 0x10ec9e:$e: KeepAlive 0x10cc8c:$g: LogClientMessage 0x108e87:$i: get_Connected 0x107608:$j: #=q 0x107638:$j: #=q 0x107654:$j: #=q 0x107684:$j: #=q 0x1076a0:$j: #=q 0x1076bc:$j: #=q 0x1076ec:$j: #=q
00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2ae9dd:$x1: NanoCore.ClientPluginHost 0x2e11fd:$x1: NanoCore.ClientPluginHost 0x2aea1a:$x2: IClientNetworkHost 0x2e123a:$x2: IClientNetworkHost 0x2b254d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2e4d6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2ae745:$a: NanoCore 0x2ae755:$a: NanoCore 0x2ae989:$a: NanoCore 0x2ae99d:$a: NanoCore 0x2ae9dd:$a: NanoCore 0x2e0f65:$a: NanoCore 0x2e0f75:$a: NanoCore 0x2e11a9:$a: NanoCore 0x2e11bd:$a: NanoCore 0x2e11fd:$a: NanoCore 0x2ae7a4:$b: ClientPlugin 0x2ae9a6:$b: ClientPlugin 0x2ae9e6:$b: ClientPlugin 0x2e0fc4:$b: ClientPlugin 0x2e11c6:$b: ClientPlugin 0x2e1206:$b: ClientPlugin 0x1732d5:$c: ProjectData 0x1cb6f5:$c: ProjectData 0x2ae8cb:$c: ProjectData 0x2e10eb:$c: ProjectData 0x2af2d2:$d: DESCrypto
00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.247304436.0000000002FBC000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000008.00000002.300490631.0000000003359000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: cpIaMuv3PV.exe PID: 6364	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xc2bf8:$x1: NanoCore.ClientPluginHost 0x19c7b3:$x1: NanoCore.ClientPluginHost 0xc2c59:$x2: IClientNetworkHost 0x19c814:$x2: IClientNetworkHost 0xc805e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xd5fd0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1a1c19:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1afb8b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: cpIaMuv3PV.exe PID: 6364	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: cpIaMuv3PV.exe PID: 6364	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: cpIaMuv3PV.exe PID: 6364	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xc26fd:$a: NanoCore 0xc2719:$a: NanoCore 0xc2874:$a: NanoCore 0xc2883:$a: NanoCore 0xc2b5c:$a: NanoCore 0xc2b88:$a: NanoCore 0xc2bf8:$a: NanoCore 0xd263a:$a: NanoCore 0xd264c:$a: NanoCore 0xd2688:$a: NanoCore 0x19c2b8:$a: NanoCore 0x19c2d4:$a: NanoCore 0x19c42f:$a: NanoCore 0x19c43e:$a: NanoCore 0x19c717:$a: NanoCore 0x19c743:$a: NanoCore 0x19c7b3:$a: NanoCore 0x1ac1f5:$a: NanoCore 0x1ac207:$a: NanoCore 0x1ac243:$a: NanoCore 0xc27a4:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 6232	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2e1d7:$x1: NanoCore.ClientPluginHost 0x33d96:$x1: NanoCore.ClientPluginHost 0x44bf0:$x1: NanoCore.ClientPluginHost 0xc50f8:$x1: NanoCore.ClientPluginHost 0x1037a9:$x1: NanoCore.ClientPluginHost 0x2e1fd:$x2: IClientNetworkHost 0x33ddb:$x2: IClientNetworkHost 0x44c35:$x2: IClientNetworkHost 0xc511e:$x2: IClientNetworkHost 0x10380a:$x2: IClientNetworkHost 0x108c0f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x116b81:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6232	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6232	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2e0c9:$a: NanoCore 0x2e16a:$a: NanoCore 0x2e1d7:$a: NanoCore 0x2e298:$a: NanoCore 0x2f169:$a: NanoCore 0x2f1bc:$a: NanoCore 0x2f1f5:$a: NanoCore 0x2f268:$a: NanoCore 0x33d10:$a: NanoCore 0x33d3d:$a: NanoCore 0x33d96:$a: NanoCore 0x3b5a5:$a: NanoCore 0x3b5b8:$a: NanoCore 0x3b5ea:$a: NanoCore 0x44b6a:$a: NanoCore 0x44b97:$a: NanoCore 0x44bf0:$a: NanoCore 0x4c3ff:$a: NanoCore 0x4c412:$a: NanoCore 0x4c444:$a: NanoCore 0x9c726:$a: NanoCore
Process Memory Space: cpIaMuv3PV.exe PID: 6552	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xbfc10:$x1: NanoCore.ClientPluginHost 0xc57cf:$x1: NanoCore.ClientPluginHost 0xd663f:$x1: NanoCore.ClientPluginHost 0x147fac:$x1: NanoCore.ClientPluginHost 0x1c0608:$x1: NanoCore.ClientPluginHost 0xbfc36:$x2: IClientNetworkHost 0xc5814:$x2: IClientNetworkHost 0xd6684:$x2: IClientNetworkHost 0x147fd2:$x2: IClientNetworkHost 0x1c0669:$x2: IClientNetworkHost 0x1c5a6e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d39e0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: cpIaMuv3PV.exe PID: 6552	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: cpIaMuv3PV.exe PID: 6552	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xbfb02:$a: NanoCore 0xbfba3:$a: NanoCore 0xbfc10:$a: NanoCore 0xbfcd1:$a: NanoCore 0xc0ba2:$a: NanoCore 0xc0bf5:$a: NanoCore 0xc0c2e:$a: NanoCore 0xc0ca1:$a: NanoCore 0xc5749:$a: NanoCore 0xc5776:$a: NanoCore 0xc57cf:$a: NanoCore 0xccfde:$a: NanoCore 0xccff1:$a: NanoCore 0xcd023:$a: NanoCore 0xd65b9:$a: NanoCore 0xd65e6:$a: NanoCore 0xd663f:$a: NanoCore 0xdde4e:$a: NanoCore 0xdde61:$a: NanoCore 0xdde93:$a: NanoCore 0x13a77d:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 7060	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.dhcpmon.exe.45b6850.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.45b6850.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.45b6850.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.45b6850.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
4.2.cpIaMuv3PV.exe.5190000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.5190000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28269:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x28296:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28269:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29344:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28283:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.430b116.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d09f:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0cc:$x2: IClientNetworkHost
18.2.dhcpmon.exe.430b116.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d09f:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e17a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0b9:$s5: IClientLoggingHost
18.2.dhcpmon.exe.430b116.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.430b116.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d055:$a: NanoCore 0x2d06a:$a: NanoCore 0x2d09f:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce11:$b: ClientPlugin 0x2ce2c:$b: ClientPlugin
4.2.cpIaMuv3PV.exe.5270000.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.5270000.9.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.5270000.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.cpIaMuv3PV.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.cpIaMuv3PV.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.cpIaMuv3PV.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.cpIaMuv3PV.exe.41e6850.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.cpIaMuv3PV.exe.41e6850.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.cpIaMuv3PV.exe.41e6850.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.cpIaMuv3PV.exe.41e6850.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
8.2.dhcpmon.exe.45b6850.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x429ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x429ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.45b6850.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x42725:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x429ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x43fe6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x43fda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x44e8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ac42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x429d7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.45b6850.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.45b6850.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42715:$a: NanoCore 0x42725:$a: NanoCore 0x42959:$a: NanoCore 0x4296d:$a: NanoCore 0x429ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42774:$b: ClientPlugin 0x42976:$b: ClientPlugin 0x429b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4289b:$c: ProjectData 0x10a82:$d: DESCrypto 0x432a2:$d: DESCrypto 0x1844e:$e: KeepAlive
4.2.cpIaMuv3PV.exe.399ff4c.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.399ff4c.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.399ff4c.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.4314575.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c40:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c6d:$x2: IClientNetworkHost
18.2.dhcpmon.exe.4314575.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c40:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d1b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c5a:$s5: IClientLoggingHost
18.2.dhcpmon.exe.4314575.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.cpIaMuv3PV.exe.297ca00.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.297ca00.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
18.2.dhcpmon.exe.430ff4c.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28269:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x28296:$x2: IClientNetworkHost
18.2.dhcpmon.exe.430ff4c.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28269:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29344:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28283:$s5: IClientLoggingHost
18.2.dhcpmon.exe.430ff4c.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.2.dhcpmon.exe.3329660.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3329660.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
18.2.dhcpmon.exe.430ff4c.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
18.2.dhcpmon.exe.430ff4c.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
18.2.dhcpmon.exe.430ff4c.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.446e180.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x15885d:$x1: NanoCore.ClientPluginHost 0x18b07d:$x1: NanoCore.ClientPluginHost 0x15889a:$x2: IClientNetworkHost 0x18b0ba:$x2: IClientNetworkHost 0x15c3cd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x18ebed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.446e180.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.446e180.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1585c5:$a: NanoCore 0x1585d5:$a: NanoCore 0x158809:$a: NanoCore 0x15881d:$a: NanoCore 0x15885d:$a: NanoCore 0x18ade5:$a: NanoCore 0x18adf5:$a: NanoCore 0x18b029:$a: NanoCore 0x18b03d:$a: NanoCore 0x18b07d:$a: NanoCore 0x158624:$b: ClientPlugin 0x158826:$b: ClientPlugin 0x158866:$b: ClientPlugin 0x18ae44:$b: ClientPlugin 0x18b046:$b: ClientPlugin 0x18b086:$b: ClientPlugin 0x1d155:$c: ProjectData 0x75575:$c: ProjectData 0x15874b:$c: ProjectData 0x18af6b:$c: ProjectData 0x159152:$d: DESCrypto
8.2.dhcpmon.exe.44c65a0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10043d:$x1: NanoCore.ClientPluginHost 0x132c5d:$x1: NanoCore.ClientPluginHost 0x10047a:$x2: IClientNetworkHost 0x132c9a:$x2: IClientNetworkHost 0x103fad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1367cd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.44c65a0.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.44c65a0.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1001a5:$a: NanoCore 0x1001b5:$a: NanoCore 0x1003e9:$a: NanoCore 0x1003fd:$a: NanoCore 0x10043d:$a: NanoCore 0x1329c5:$a: NanoCore 0x1329d5:$a: NanoCore 0x132c09:$a: NanoCore 0x132c1d:$a: NanoCore 0x132c5d:$a: NanoCore 0x100204:$b: ClientPlugin 0x100406:$b: ClientPlugin 0x100446:$b: ClientPlugin 0x132a24:$b: ClientPlugin 0x132c26:$b: ClientPlugin 0x132c66:$b: ClientPlugin 0x1d155:$c: ProjectData 0x10032b:$c: ProjectData 0x132b4b:$c: ProjectData 0x100d32:$d: DESCrypto 0x133552:$d: DESCrypto
4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10043d:$x1: NanoCore.ClientPluginHost 0x10047a:$x2: IClientNetworkHost 0x103fad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1001a5:$a: NanoCore 0x1001b5:$a: NanoCore 0x1003e9:$a: NanoCore 0x1003fd:$a: NanoCore 0x10043d:$a: NanoCore 0x100204:$b: ClientPlugin 0x100406:$b: ClientPlugin 0x100446:$b: ClientPlugin 0x1d155:$c: ProjectData 0x10032b:$c: ProjectData 0x100d32:$d: DESCrypto 0x1086fe:$e: KeepAlive 0x1066ec:$g: LogClientMessage 0x1028e7:$i: get_Connected 0x101068:$j: #=q 0x101098:$j: #=q 0x1010b4:$j: #=q 0x1010e4:$j: #=q 0x101100:$j: #=q 0x10111c:$j: #=q 0x10114c:$j: #=q
4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c40:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c6d:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c40:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d1b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c5a:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d09f:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0cc:$x2: IClientNetworkHost
4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d09f:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e17a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0b9:$s5: IClientLoggingHost
4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d055:$a: NanoCore 0x2d06a:$a: NanoCore 0x2d09f:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce11:$b: ClientPlugin 0x2ce2c:$b: ClientPlugin
18.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Click to see the 69 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\cpIaMuv3PV.exe, ProcessId: 6552, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\cpIaMuv3PV.exe' , ParentImage: C:\Users\user\Desktop\cpIaMuv3PV.exe, ParentProcessId: 6364, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp', ProcessId: 6476

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8807-1300-00", "Group": "worker", "Domain1": "", "Domain2": "hailongfvt.zapto.org", "Port": 3365, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Metadefender: Detection: 13%	Perma Link
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe	Metadefender: Detection: 13%	Perma Link
Source: C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe	ReversingLabs: Detection: 37%

Multi AV Scanner detection for submitted file

Show sources

Source: cpIaMuv3PV.exe	Virustotal: Detection: 30%	Perma Link
Source: cpIaMuv3PV.exe	Metadefender: Detection: 13%	Perma Link
Source: cpIaMuv3PV.exe	ReversingLabs: Detection: 37%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.501066810.0000000002951000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: cpIaMuv3PV.exe

Joe Sandbox ML: detected

Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack	Avira: Label: TR/NanoCore.fadte
Source: 18.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Show sources

Source: cpIaMuv3PV.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: cpIaMuv3PV.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: hailongfvt.zapto.org

Source: global traffic

TCP traffic: 192.168.2.7:49716 -> 185.140.53.139:3365

Source: Joe Sandbox View

IP Address: 185.140.53.139 185.140.53.139

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: unknown

DNS traffic detected: queries for: hailongfvt.zapto.org

Source: cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: dhcpmon.exe	String found in binary or memory: http://tempuri.org/DS_All_Student_Bill.xsd
Source: cpIaMuv3PV.exe	String found in binary or memory: http://tempuri.org/DS_All_Student_Bill.xsd;stbl_Product_Purchase_DetailsUhttp://tempuri.org/DS_Produ
Source: dhcpmon.exe	String found in binary or memory: http://tempuri.org/DS_Product_Purchase.xsd
Source: dhcpmon.exe, dhcpmon.exe, 00000012.00000002.321328745.0000000000B52000.00000002.00020000.sdmp, cpIaMuv3PV.exe	String found in binary or memory: http://tempuri.org/DS_Stock.xsd
Source: dhcpmon.exe	String found in binary or memory: http://tempuri.org/DS_Student_Fees.xsd
Source: cpIaMuv3PV.exe	String found in binary or memory: http://tempuri.org/DS_Student_Fees.xsd;stbl_Student_Purchase_Details7DS_Student_Purchase_Detailsehtt
Source: dhcpmon.exe	String found in binary or memory: http://tempuri.org/DS_Student_Purchase_Details.xsd
Source: dhcpmon.exe, dhcpmon.exe, 00000012.00000002.321328745.0000000000B52000.00000002.00020000.sdmp, cpIaMuv3PV.exe	String found in binary or memory: http://tempuri.org/aLL_STUDENT_DATA.xsd
Source: cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: cpIaMuv3PV.exe, 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.501066810.0000000002951000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.cpIaMuv3PV.exe.5190000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.297ca00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.3329660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 0_2_02DFEA34	0_2_02DFEA34
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 0_2_02DFEF5A	0_2_02DFEF5A
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 0_2_02DFB488	0_2_02DFB488
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 4_2_0280E480	4_2_0280E480
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 4_2_0280E471	4_2_0280E471
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 4_2_0280BBD4	4_2_0280BBD4
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Code function: 4_2_05F10040	4_2_05F10040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_032DA1E8	8_2_032DA1E8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_032DB488	8_2_032DB488
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_0307E471	18_2_0307E471
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_0307E480	18_2_0307E480
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_0307BBD4	18_2_0307BBD4

Source: cpIaMuv3PV.exe	Binary or memory string: OriginalFilename vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000000.00000002.251842701.000000000E780000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLegacyPathHandling.dllN vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000000.00000002.246511790.0000000000B32000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMdConstant.exe4 vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000000.00000002.252985323.000000000EF30000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000000.00000002.251317454.000000000A4D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAsyncState.dllF vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000000.00000002.253841541.000000000F030000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000000.00000002.253841541.000000000F030000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe	Binary or memory string: OriginalFilename vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000004.00000002.509373713.0000000005890000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000004.00000000.245536469.00000000004B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMdConstant.exe4 vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe, 00000004.00000002.509848240.00000000067A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs cpIaMuv3PV.exe
Source: cpIaMuv3PV.exe	Binary or memory string: OriginalFilenameMdConstant.exe4 vs cpIaMuv3PV.exe

Source: cpIaMuv3PV.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.cpIaMuv3PV.exe.5190000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.5190000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.297ca00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.297ca00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.3329660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3329660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/9@23/2

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File created: C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:976:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_01
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Mutant created: \Sessions\1\BaseNamedObjects\lehXhqdzGLyhWFuvf
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{06dcc34e-fccc-45c0-ab04-0a28b66d80f2}

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2685.tmp

Jump to behavior

Source: cpIaMuv3PV.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cpIaMuv3PV.exe, 00000000.00000002.246511790.0000000000B32000.00000002.00020000.sdmp, cpIaMuv3PV.exe, 00000004.00000000.245536469.00000000004B2000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000000.272258650.0000000000D72000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000002.321328745.0000000000B52000.00000002.00020000.sdmp	Binary or memory string: select * from stbl_Product_Purchase_Details where Product_ID = 9Single Students Bill Reports-crv_Single_student_fee;uc_single_Student_Bill_Reportkselect * from tbl_Stud_Fee_Master where Student_ID = cselect * from tbl_Stud_Master where Student_ID = 3Big Dreams Come True Here#frm_Splash_Screen
Source: cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);

Source: cpIaMuv3PV.exe	Virustotal: Detection: 30%
Source: cpIaMuv3PV.exe	Metadefender: Detection: 13%
Source: cpIaMuv3PV.exe	ReversingLabs: Detection: 37%

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File read: C:\Users\user\Desktop\cpIaMuv3PV.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cpIaMuv3PV.exe 'C:\Users\user\Desktop\cpIaMuv3PV.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\cpIaMuv3PV.exe C:\Users\user\Desktop\cpIaMuv3PV.exe
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp7E79.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process created: C:\Users\user\Desktop\cpIaMuv3PV.exe C:\Users\user\Desktop\cpIaMuv3PV.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp7E79.tmp'	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: cpIaMuv3PV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: cpIaMuv3PV.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: cpIaMuv3PV.exe

Static file information: File size 1272320 > 1048576

Source: cpIaMuv3PV.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x131c00

Source: cpIaMuv3PV.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Code function: 18_2_0307D413 push 0000005Dh; retn 0004h

18_2_0307D485

Source: initial sample	Static PE information: section name: .text entropy: 6.81640542834
Source: initial sample	Static PE information: section name: .text entropy: 6.81640542834
Source: initial sample	Static PE information: section name: .text entropy: 6.81640542834

Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	File created: C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe			Jump to dropped file
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

File opened: C:\Users\user\Desktop\cpIaMuv3PV.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.247304436.0000000002FBC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.300490631.0000000003359000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7060, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Window / User API: threadDelayed 4205	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Window / User API: threadDelayed 5276	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Window / User API: foregroundWindowGot 834	Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe TID: 6368	Thread sleep time: -102832s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe TID: 6396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe TID: 6620	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7064	Thread sleep time: -103155s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7092	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 2160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: cpIaMuv3PV.exe, 00000004.00000002.509848240.00000000067A0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: cpIaMuv3PV.exe, 00000004.00000002.509848240.00000000067A0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: cpIaMuv3PV.exe, 00000004.00000002.509848240.00000000067A0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: cpIaMuv3PV.exe, 00000004.00000002.509848240.00000000067A0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Process created: C:\Users\user\Desktop\cpIaMuv3PV.exe C:\Users\user\Desktop\cpIaMuv3PV.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp7E79.tmp'	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior

Source: cpIaMuv3PV.exe, 00000004.00000002.500574254.0000000001250000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: cpIaMuv3PV.exe, 00000004.00000002.501784469.0000000002A78000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: cpIaMuv3PV.exe, 00000004.00000002.500574254.0000000001250000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: cpIaMuv3PV.exe, 00000004.00000002.500574254.0000000001250000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: cpIaMuv3PV.exe, 00000004.00000002.500574254.0000000001250000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: cpIaMuv3PV.exe, 00000004.00000002.501784469.0000000002A78000.00000004.00000001.sdmp	Binary or memory string: Program ManagerHf

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Users\user\Desktop\cpIaMuv3PV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Users\user\Desktop\cpIaMuv3PV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cpIaMuv3PV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\cpIaMuv3PV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.501066810.0000000002951000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: cpIaMuv3PV.exe, 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: cpIaMuv3PV.exe, 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: cpIaMuv3PV.exe, 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.501066810.0000000002951000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6364, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6232, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpIaMuv3PV.exe PID: 6552, type: MEMORY
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430b116.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.45b6850.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399ff4c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4314575.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.41e6850.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.430ff4c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.446e180.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.44c65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5270000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.5274629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cpIaMuv3PV.exe.40f65a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.39a4575.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cpIaMuv3PV.exe.399b116.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection12	Masquerading2	Input Capture11	Security Software Discovery211	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Virtualization/Sandbox Evasion3	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol11	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing12	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cpIaMuv3PV.exe	31%	Virustotal		Browse
cpIaMuv3PV.exe	19%	Metadefender		Browse
cpIaMuv3PV.exe	38%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
cpIaMuv3PV.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	19%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	38%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe	19%	Metadefender		Browse
C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe	38%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.2.cpIaMuv3PV.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
4.2.cpIaMuv3PV.exe.5270000.9.unpack	100%	Avira	TR/NanoCore.fadte	Download File
18.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
	0%	Avira URL Cloud	safe
http://tempuri.org/DS_Student_Fees.xsd	0%	Avira URL Cloud	safe
http://tempuri.org/aLL_STUDENT_DATA.xsd	0%	Avira URL Cloud	safe
http://tempuri.org/DS_Student_Fees.xsd;stbl_Student_Purchase_Details7DS_Student_Purchase_Detailsehtt	0%	Avira URL Cloud	safe
http://tempuri.org/DS_All_Student_Bill.xsd;stbl_Product_Purchase_DetailsUhttp://tempuri.org/DS_Produ	0%	Avira URL Cloud	safe
http://tempuri.org/DS_All_Student_Bill.xsd	0%	Avira URL Cloud	safe
hailongfvt.zapto.org	0%	Avira URL Cloud	safe
http://tempuri.org/DS_Stock.xsd	0%	Avira URL Cloud	safe
http://tempuri.org/DS_Product_Purchase.xsd	0%	Avira URL Cloud	safe
http://tempuri.org/DS_Student_Purchase_Details.xsd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hailongfvt.zapto.org	185.140.53.139	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
hailongfvt.zapto.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DS_Student_Fees.xsd	dhcpmon.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/aLL_STUDENT_DATA.xsd	dhcpmon.exe, dhcpmon.exe, 00000012.00000002.321328745.0000000000B52000.00000002.00020000.sdmp, cpIaMuv3PV.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DS_Student_Fees.xsd;stbl_Student_Purchase_Details7DS_Student_Purchase_Detailsehtt	cpIaMuv3PV.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DS_All_Student_Bill.xsd;stbl_Product_Purchase_DetailsUhttp://tempuri.org/DS_Produ	cpIaMuv3PV.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	false		high
http://tempuri.org/DS_All_Student_Bill.xsd	dhcpmon.exe	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	cpIaMuv3PV.exe, 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp	false		high
http://tempuri.org/DS_Stock.xsd	dhcpmon.exe, dhcpmon.exe, 00000012.00000002.321328745.0000000000B52000.00000002.00020000.sdmp, cpIaMuv3PV.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DS_Product_Purchase.xsd	dhcpmon.exe	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DS_Student_Purchase_Details.xsd	dhcpmon.exe	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.140.53.139	unknown	Sweden		209623	DAVID_CRAIGGG	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358139
Start date:	25.02.2021
Start time:	04:01:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	cpIaMuv3PV.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/9@23/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.8% (good quality ratio 1.4%) Quality average: 61.1% Quality standard deviation: 39.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 74 Number of non-executed functions: 1
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 51.103.5.159, 13.88.21.125, 204.79.197.200, 13.107.21.200, 51.11.168.160, 92.122.145.220, 104.43.193.48, 52.255.188.83, 23.218.208.56, 51.104.139.180, 2.20.142.209, 2.20.142.210, 93.184.221.240, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, vip1-par02p.wns.notify.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu.ec.azureedge.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:02:18	API Interceptor	969x Sleep call for process: cpIaMuv3PV.exe modified
04:02:25	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
04:02:39	API Interceptor	1x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.140.53.139	COMPANY PROFILE AND DOCUMENTED OFFER.exe	Get hash	malicious	Browse
	Quotation ATB-PR28500KINH.exe	Get hash	malicious	Browse
	Quotation ATB-PR28500KINH.exe	Get hash	malicious	Browse
	RFQ-BOHB-SS-FD6L4.exe	Get hash	malicious	Browse
	PURCHASE_FABRICS_APPAREL_100%_COOTON.exe	Get hash	malicious	Browse
	GT-082568-HSO-280820.DOCX.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
hailongfvt.zapto.org	COMPANY PROFILE AND DOCUMENTED OFFER.exe	Get hash	malicious	Browse	185.140.53.139

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	35dbds3GQG.exe	Get hash	malicious	Browse	185.140.53.138
	QXJGE2LOdP.exe	Get hash	malicious	Browse	185.140.53.138
	TxvR Order.exe	Get hash	malicious	Browse	185.140.53.43
	COMPANY PROFILE AND DOCUMENTED OFFER.exe	Get hash	malicious	Browse	185.140.53.139
	Attached file.exe	Get hash	malicious	Browse	185.244.30.113
	UNiOOhIN3e.exe	Get hash	malicious	Browse	185.244.30.241
	BzRmS2LLnB.exe	Get hash	malicious	Browse	91.193.75.94
	bDbA5Bf1k2.exe	Get hash	malicious	Browse	91.193.75.94
	SecuriteInfo.com.BehavesLike.Win32.Generic.dc.exe	Get hash	malicious	Browse	91.193.75.197
	Recibo del env#U00c3o.exe	Get hash	malicious	Browse	91.193.75.17
	Revised Order 193-002.doc	Get hash	malicious	Browse	91.193.75.197
	ynS1BQTyzO.exe	Get hash	malicious	Browse	91.193.75.252
	Quote RF-E79-STD-2021-087.xlsx	Get hash	malicious	Browse	91.193.75.252
	PO57891255564GYH11192643-2152021,pdf.exe	Get hash	malicious	Browse	185.140.53.136
	Attachment.exe	Get hash	malicious	Browse	185.244.30.113
	Query_Ref_CSQ5429996-dtd_0202102021-pdf.jar	Get hash	malicious	Browse	185.244.30.187
	Query_Ref_CSQ5429996-dtd_0202102021-pdf.jar	Get hash	malicious	Browse	185.244.30.187
	DHL_6368638172 receipt document,pdf.exe	Get hash	malicious	Browse	185.140.53.130
	47432000083600.xlsx	Get hash	malicious	Browse	185.244.30.21
	Belegbeleg DHL_119040, pdf.exe	Get hash	malicious	Browse	185.140.53.133

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1272320
Entropy (8bit):	6.785801085900234
Encrypted:	false
SSDEEP:	12288:WeDlsV8+pn+BMQI6wUq0yGArEln20Em3ojpiOJ8UPm4wYHWW7xsbASBCt6e54qXo:ZLNgpRLrHz7xEBBCYe54qXAm3RBjA1
MD5:	A8911878F9C096C7BFE665B8076A8704
SHA1:	1DFFAAC5E83C62A0478095C68684BC4974F559DB
SHA-256:	498DF02F7263A2B524603CB58CD01C45115645F7586147FD39B19E930DFFC667
SHA-512:	B401F30A85FAB432401668863A34D63989BB6745D36331BA78EAAC5FCA16BA56E5212670CF2A596216A60BF329F642042B1BC8C4244998ABEE7319A7CA9ADD86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 19%, Browse Antivirus: ReversingLabs, Detection: 38%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5`..............P......L.......;... ........@.. ....................................@.................................p;..K....@...J........................................................................... ............... ..H............text........ ...................... ..`.rsrc....J...@...J..................@..@.reloc...............h..............@..B.................;......H............?...............O...........................................0..#.......+.&...(....(..........(.....o.......................0..........+.&..8......8.....+p..aa.+...na...mXE............K...X....g(.....+......&...+...eXE........ .../...>...M...h...q...z..............+..m(........+.8~.......8u.....(.......8f.....(.......8W.....(.......8H.....(....+.(....82......8-.......8$.......8.......8.........&+..8.......8.....0..........+.&...+8..ga.+...aa8x.....hY+D...+...gXE

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cpIaMuv3PV.exe.log Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1400
Entropy (8bit):	5.344635889251176
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4bE4K5AE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4sH:MgvjHK5HKXE1qHbHK5AHKzvRYHKhQnoR
MD5:	CB0A771DADBDC62238A0AB0D40CC3382
SHA1:	38A48365315A474D6E7117AC72A354935052051C
SHA-256:	BBB2C37AFB091B8A3E18FC1D8B2A35707D0B64B373CDBA5A147BBAAEABD24C2E
SHA-512:	6518C09AECF15B58D74B9E09A911ADB17CCB43B1508BEBAEEA9C1B563B766FBDA6B585E149AB16793DD2AD8761F7F6D68A18724369CF47FA023839C74F5549F0
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Co

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	5.344635889251176
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4bE4K5AE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4sH:MgvjHK5HKXE1qHbHK5AHKzvRYHKhQnoR
MD5:	CB0A771DADBDC62238A0AB0D40CC3382
SHA1:	38A48365315A474D6E7117AC72A354935052051C
SHA-256:	BBB2C37AFB091B8A3E18FC1D8B2A35707D0B64B373CDBA5A147BBAAEABD24C2E
SHA-512:	6518C09AECF15B58D74B9E09A911ADB17CCB43B1508BEBAEEA9C1B563B766FBDA6B585E149AB16793DD2AD8761F7F6D68A18724369CF47FA023839C74F5549F0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Co

C:\Users\user\AppData\Local\Temp\tmp2685.tmp Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	5.186428793191548
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBAYtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3ue
MD5:	3C48812341687AA2F8C0ABD00611CCF8
SHA1:	5BF2AECFA0748C282DD2AC5A8AFF35622EB8C6C7
SHA-256:	B3BFE0ED81C4107CEC70B9503371D2F6E013BA046018E7A912F825F25EF45804
SHA-512:	06AD1F5C6D296A0D37368B3811488BF4D1220137D134AFD22C85D9230DCD8DA6F621BA52A3AEE0C953793A9507837257E2329DAEE2469A093ABA076B080A5D7D
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAv

C:\Users\user\AppData\Local\Temp\tmp7E79.tmp Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	5.186428793191548
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBAYtn:cbhH7MlNQ8/rydbz9I3YODOLNdq3ue
MD5:	3C48812341687AA2F8C0ABD00611CCF8
SHA1:	5BF2AECFA0748C282DD2AC5A8AFF35622EB8C6C7
SHA-256:	B3BFE0ED81C4107CEC70B9503371D2F6E013BA046018E7A912F825F25EF45804
SHA-512:	06AD1F5C6D296A0D37368B3811488BF4D1220137D134AFD22C85D9230DCD8DA6F621BA52A3AEE0C953793A9507837257E2329DAEE2469A093ABA076B080A5D7D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAv

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	ISO-8859 text, with NEL line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:sst:sst
MD5:	5A86F30FF0CEF5D88164B253F6B691F1
SHA1:	CFC30B4C368FAF9CECD6158AD98921760783FA49
SHA-256:	26C1FDB652FA78AD690EA97E65C2C318D76438BA3D69D896001422D7D47F7DB9
SHA-512:	1205329F6FBEB6B6E07E698F69438C9B7B264FFE61B8946F2C0856C8194AB274B20E89DE772D302B80ED36B43E3D1F30341E950372F7B4D6FB03A9A6E20D13C8
Malicious:	true
Reputation:	low
Preview:	Q..6...H

C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1272320
Entropy (8bit):	6.785801085900234
Encrypted:	false
SSDEEP:	12288:WeDlsV8+pn+BMQI6wUq0yGArEln20Em3ojpiOJ8UPm4wYHWW7xsbASBCt6e54qXo:ZLNgpRLrHz7xEBBCYe54qXAm3RBjA1
MD5:	A8911878F9C096C7BFE665B8076A8704
SHA1:	1DFFAAC5E83C62A0478095C68684BC4974F559DB
SHA-256:	498DF02F7263A2B524603CB58CD01C45115645F7586147FD39B19E930DFFC667
SHA-512:	B401F30A85FAB432401668863A34D63989BB6745D36331BA78EAAC5FCA16BA56E5212670CF2A596216A60BF329F642042B1BC8C4244998ABEE7319A7CA9ADD86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 19%, Browse Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5`..............P......L.......;... ........@.. ....................................@.................................p;..K....@...J........................................................................... ............... ..H............text........ ...................... ..`.rsrc....J...@...J..................@..@.reloc...............h..............@..B.................;......H............?...............O...........................................0..#.......+.&...(....(..........(.....o.......................0..........+.&..8......8.....+p..aa.+...na...mXE............K...X....g(.....+......&...+...eXE........ .../...>...M...h...q...z..............+..m(........+.8~.......8u.....(.......8f.....(.......8W.....(.......8H.....(....+.(....82......8-.......8$.......8.......8.........&+..8.......8.....0..........+.&...+8..ga.+...aa8x.....hY+D...+...gXE

C:\Users\user\AppData\Roaming\OUCEGOEkZUvjuG.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\cpIaMuv3PV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.785801085900234
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	cpIaMuv3PV.exe
File size:	1272320
MD5:	a8911878f9c096c7bfe665b8076a8704
SHA1:	1dffaac5e83c62a0478095c68684bc4974f559db
SHA256:	498df02f7263a2b524603cb58cd01c45115645f7586147fd39b19e930dffc667
SHA512:	b401f30a85fab432401668863a34d63989bb6745d36331ba78eaac5fca16ba56e5212670cf2a596216a60bf329f642042b1bc8c4244998abee7319a7ca9add86
SSDEEP:	12288:WeDlsV8+pn+BMQI6wUq0yGArEln20Em3ojpiOJ8UPm4wYHWW7xsbASBCt6e54qXo:ZLNgpRLrHz7xEBBCYe54qXAm3RBjA1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5`..............P......L.......;... ........@.. ....................................@................................

File Icon


Icon Hash:	c870f0f0d8fc7c03

Static PE Info

General
Entrypoint:	0x533bbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6035C6C3 [Wed Feb 24 03:23:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x133b70	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x134000	0x4a00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x131bc4	0x131c00	False	0.531282738399	data	6.81640542834	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x134000	0x4a00	0x4a00	False	0.273807010135	data	3.78141625052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x13a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x134100	0x4228	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x138338	0x14	data
RT_VERSION	0x13835c	0x366	data
RT_MANIFEST	0x1386d4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright D S Damat Online
Assembly Version	1.1.8.14
InternalName	MdConstant.exe
FileVersion	1.1.8.14
CompanyName	D S Damat Online
LegalTrademarks
Comments
ProductName	D'S Damat
ProductVersion	1.1.8.14
FileDescription	D'S Damat
OriginalFilename	MdConstant.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 04:02:26.473370075 CET	49716	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:26.518624067 CET	3365	49716	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:27.120229959 CET	49716	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:27.165539980 CET	3365	49716	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:27.823421001 CET	49716	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:27.868802071 CET	3365	49716	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:33.288084030 CET	49723	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:33.335201025 CET	3365	49723	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:33.964596033 CET	49723	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:34.009816885 CET	3365	49723	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:34.574018955 CET	49723	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:34.620681047 CET	3365	49723	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:38.758946896 CET	49730	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:38.803987026 CET	3365	49730	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:39.464996099 CET	49730	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:39.511528969 CET	3365	49730	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:40.074441910 CET	49730	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:40.120079041 CET	3365	49730	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:44.696266890 CET	49732	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:44.741364956 CET	3365	49732	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:45.278019905 CET	49732	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:45.323188066 CET	3365	49732	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:45.966013908 CET	49732	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:46.011109114 CET	3365	49732	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:50.501729965 CET	49733	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:50.546786070 CET	3365	49733	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:51.122309923 CET	49733	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:51.167396069 CET	3365	49733	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:51.825455904 CET	49733	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:51.870436907 CET	3365	49733	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:56.027457952 CET	49736	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:56.074837923 CET	3365	49736	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:56.622755051 CET	49736	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:56.667952061 CET	3365	49736	185.140.53.139	192.168.2.7
Feb 25, 2021 04:02:57.326021910 CET	49736	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:02:57.371155977 CET	3365	49736	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:01.943954945 CET	49737	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:01.989780903 CET	3365	49737	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:02.498291969 CET	49737	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:02.543540001 CET	3365	49737	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:03.045150042 CET	49737	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:03.090298891 CET	3365	49737	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:07.180772066 CET	49744	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:07.225883007 CET	3365	49744	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:07.733062029 CET	49744	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:07.780318022 CET	3365	49744	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:08.295571089 CET	49744	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:08.340837955 CET	3365	49744	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:12.445955038 CET	49745	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:12.491339922 CET	3365	49745	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:13.092895031 CET	49745	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:13.138628960 CET	3365	49745	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:13.796041012 CET	49745	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:13.841634035 CET	3365	49745	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:17.944457054 CET	49751	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:17.989474058 CET	3365	49751	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:18.586312056 CET	49751	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:18.631408930 CET	3365	49751	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:19.187109947 CET	49751	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:19.234419107 CET	3365	49751	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:23.361229897 CET	49752	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:23.406435013 CET	3365	49752	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:24.094458103 CET	49752	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:24.139643908 CET	3365	49752	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:24.703216076 CET	49752	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:24.748512030 CET	3365	49752	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:29.927272081 CET	49753	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:29.973731995 CET	3365	49753	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:30.578682899 CET	49753	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:30.623743057 CET	3365	49753	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:31.284149885 CET	49753	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:31.329207897 CET	3365	49753	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:35.457288027 CET	49754	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:35.502422094 CET	3365	49754	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:36.079209089 CET	49754	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:36.126812935 CET	3365	49754	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:36.782363892 CET	49754	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:36.829159975 CET	3365	49754	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:40.945180893 CET	49760	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:40.990593910 CET	3365	49760	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:41.501486063 CET	49760	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:41.546868086 CET	3365	49760	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:42.048398972 CET	49760	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:42.093969107 CET	3365	49760	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:46.222960949 CET	49767	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:46.268110991 CET	3365	49767	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:46.767564058 CET	49767	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:46.813080072 CET	3365	49767	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:47.330116034 CET	49767	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:47.376920938 CET	3365	49767	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:51.506802082 CET	49768	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:51.554889917 CET	3365	49768	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:52.065949917 CET	49768	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:52.111140013 CET	3365	49768	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:52.611891985 CET	49768	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:52.657094955 CET	3365	49768	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:56.751504898 CET	49769	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:56.796696901 CET	3365	49769	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:57.299932003 CET	49769	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:57.344906092 CET	3365	49769	185.140.53.139	192.168.2.7
Feb 25, 2021 04:03:57.846683025 CET	49769	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:03:57.893270016 CET	3365	49769	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:01.997193098 CET	49770	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:02.042678118 CET	3365	49770	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:02.550335884 CET	49770	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:02.595520973 CET	3365	49770	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:03.097105026 CET	49770	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:03.144711018 CET	3365	49770	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:07.275775909 CET	49771	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:07.323055029 CET	3365	49771	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:07.831933975 CET	49771	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:07.879686117 CET	3365	49771	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:08.394496918 CET	49771	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:08.439744949 CET	3365	49771	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:12.528439045 CET	49773	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:12.573503971 CET	3365	49773	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:13.082477093 CET	49773	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:13.127970934 CET	3365	49773	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:13.629709005 CET	49773	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:13.675120115 CET	3365	49773	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:17.783926010 CET	49774	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:17.829197884 CET	3365	49774	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:18.332849979 CET	49774	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:18.378093004 CET	3365	49774	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:18.879679918 CET	49774	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:18.924948931 CET	3365	49774	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:22.994703054 CET	49775	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:23.039895058 CET	3365	49775	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:23.567531109 CET	49775	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:23.612678051 CET	3365	49775	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:24.130060911 CET	49775	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:24.175403118 CET	3365	49775	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:28.236217976 CET	49776	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:28.281243086 CET	3365	49776	185.140.53.139	192.168.2.7
Feb 25, 2021 04:04:28.786741972 CET	49776	3365	192.168.2.7	185.140.53.139
Feb 25, 2021 04:04:28.831885099 CET	3365	49776	185.140.53.139	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 25, 2021 04:02:08.444654942 CET	61242	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:08.465351105 CET	58562	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:08.511763096 CET	53	61242	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:08.522351980 CET	53	58562	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:08.842672110 CET	56590	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:08.901761055 CET	53	56590	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:08.909348965 CET	60501	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:08.960756063 CET	53	60501	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:09.798820972 CET	53775	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:09.861493111 CET	53	53775	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:11.026640892 CET	51837	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:11.088948011 CET	53	51837	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:12.339931965 CET	55411	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:12.388650894 CET	53	55411	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:13.068850040 CET	63668	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:13.165524006 CET	53	63668	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:13.600414991 CET	54640	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:13.649146080 CET	53	54640	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:14.637718916 CET	58739	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:14.686374903 CET	53	58739	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:15.707830906 CET	60338	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:15.756501913 CET	53	60338	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:16.648066998 CET	58717	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:16.701535940 CET	53	58717	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:17.861438036 CET	59762	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:17.920944929 CET	53	59762	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:19.219341993 CET	54329	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:19.270757914 CET	53	54329	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:20.650923967 CET	58052	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:20.708071947 CET	53	58052	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:25.123212099 CET	54008	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:25.171848059 CET	53	54008	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:26.390512943 CET	59451	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:26.452054977 CET	53	59451	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:26.535105944 CET	52914	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:26.586486101 CET	53	52914	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:27.798062086 CET	64569	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:27.846755981 CET	53	64569	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:28.979156017 CET	52816	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:29.027985096 CET	53	52816	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:30.647952080 CET	50781	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:30.696743965 CET	53	50781	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:33.225302935 CET	54230	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:33.286288023 CET	53	54230	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:33.478563070 CET	54911	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:33.535832882 CET	49958	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:33.542650938 CET	53	54911	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:33.584554911 CET	53	49958	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:34.656936884 CET	50860	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:34.708436966 CET	53	50860	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:35.782387018 CET	50452	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:35.841712952 CET	53	50452	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:37.101480961 CET	59730	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:37.159876108 CET	53	59730	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:38.307773113 CET	59310	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:38.359249115 CET	53	59310	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:38.668920040 CET	51919	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:38.728554010 CET	53	51919	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:40.096520901 CET	64296	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:40.156225920 CET	53	64296	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:44.633652925 CET	56680	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:44.694955111 CET	53	56680	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:50.443129063 CET	58820	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:50.500276089 CET	53	58820	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:52.572180986 CET	60983	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:52.622535944 CET	53	60983	8.8.8.8	192.168.2.7
Feb 25, 2021 04:02:55.967534065 CET	49247	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:02:56.026488066 CET	53	49247	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:01.889230967 CET	52286	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:01.942831039 CET	53	52286	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:03.192819118 CET	56064	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:03.260288000 CET	53	56064	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:03.364636898 CET	63744	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:03.424544096 CET	53	63744	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:04.012682915 CET	61457	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:04.074146032 CET	53	61457	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:06.568280935 CET	58367	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:06.622641087 CET	53	58367	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:07.117599964 CET	60599	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:07.179799080 CET	53	60599	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:12.384613991 CET	59571	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:12.444648027 CET	53	59571	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:16.889359951 CET	52689	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:16.946671963 CET	53	52689	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:17.883157015 CET	50290	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:17.943077087 CET	53	50290	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:23.301930904 CET	60427	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:23.359168053 CET	53	60427	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:29.730482101 CET	56209	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:29.791511059 CET	53	56209	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:35.393599033 CET	59582	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:35.455698013 CET	53	59582	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:38.899404049 CET	60949	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:38.948132992 CET	53	60949	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:39.571975946 CET	58542	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:39.640474081 CET	53	58542	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:39.889245987 CET	59179	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:39.963926077 CET	53	59179	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:40.236311913 CET	60927	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:40.293179035 CET	53	60927	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:40.766766071 CET	57854	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:40.823815107 CET	53	57854	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:40.886550903 CET	62026	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:40.943595886 CET	53	62026	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:41.343502045 CET	59453	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:41.392199993 CET	53	59453	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:41.951112032 CET	62468	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:42.010968924 CET	53	62468	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:42.612159014 CET	52563	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:42.664016008 CET	53	52563	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:43.485431910 CET	54721	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:43.545458078 CET	53	54721	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:44.444976091 CET	62826	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:44.496613026 CET	53	62826	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:45.043754101 CET	62046	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:45.100975037 CET	53	62046	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:46.162457943 CET	51223	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:46.219542980 CET	53	51223	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:51.447653055 CET	63908	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:51.504779100 CET	53	63908	8.8.8.8	192.168.2.7
Feb 25, 2021 04:03:56.687129021 CET	49226	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:03:56.749474049 CET	53	49226	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:01.934845924 CET	60212	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:01.995347977 CET	53	60212	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:07.202697992 CET	58867	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:07.262625933 CET	53	58867	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:09.710293055 CET	50864	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:09.758932114 CET	53	50864	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:12.467452049 CET	61504	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:12.527344942 CET	53	61504	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:17.715581894 CET	60231	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:17.781374931 CET	53	60231	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:22.932643890 CET	50095	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:22.994004011 CET	53	50095	8.8.8.8	192.168.2.7
Feb 25, 2021 04:04:28.178107023 CET	59654	53	192.168.2.7	8.8.8.8
Feb 25, 2021 04:04:28.235445976 CET	53	59654	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 25, 2021 04:02:26.390512943 CET	192.168.2.7	8.8.8.8	0xed11	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:33.225302935 CET	192.168.2.7	8.8.8.8	0xbae1	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:38.668920040 CET	192.168.2.7	8.8.8.8	0x12e8	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:44.633652925 CET	192.168.2.7	8.8.8.8	0x6a05	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:50.443129063 CET	192.168.2.7	8.8.8.8	0xd3d0	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:55.967534065 CET	192.168.2.7	8.8.8.8	0x179a	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:01.889230967 CET	192.168.2.7	8.8.8.8	0x68b5	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:07.117599964 CET	192.168.2.7	8.8.8.8	0x2214	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:12.384613991 CET	192.168.2.7	8.8.8.8	0xef78	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:17.883157015 CET	192.168.2.7	8.8.8.8	0x63c2	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:23.301930904 CET	192.168.2.7	8.8.8.8	0x4ab5	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:29.730482101 CET	192.168.2.7	8.8.8.8	0x7ae5	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:35.393599033 CET	192.168.2.7	8.8.8.8	0x3d6e	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:40.886550903 CET	192.168.2.7	8.8.8.8	0x30dd	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:46.162457943 CET	192.168.2.7	8.8.8.8	0x47c8	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:51.447653055 CET	192.168.2.7	8.8.8.8	0x1e58	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:56.687129021 CET	192.168.2.7	8.8.8.8	0x535	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:01.934845924 CET	192.168.2.7	8.8.8.8	0x524a	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:07.202697992 CET	192.168.2.7	8.8.8.8	0xedd9	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:12.467452049 CET	192.168.2.7	8.8.8.8	0x6a27	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:17.715581894 CET	192.168.2.7	8.8.8.8	0x76b0	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:22.932643890 CET	192.168.2.7	8.8.8.8	0x731a	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:28.178107023 CET	192.168.2.7	8.8.8.8	0xfe23	Standard query (0)	hailongfvt.zapto.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 25, 2021 04:02:26.452054977 CET	8.8.8.8	192.168.2.7	0xed11	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:33.286288023 CET	8.8.8.8	192.168.2.7	0xbae1	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:38.728554010 CET	8.8.8.8	192.168.2.7	0x12e8	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:44.694955111 CET	8.8.8.8	192.168.2.7	0x6a05	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:50.500276089 CET	8.8.8.8	192.168.2.7	0xd3d0	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:02:56.026488066 CET	8.8.8.8	192.168.2.7	0x179a	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:01.942831039 CET	8.8.8.8	192.168.2.7	0x68b5	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:07.179799080 CET	8.8.8.8	192.168.2.7	0x2214	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:12.444648027 CET	8.8.8.8	192.168.2.7	0xef78	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:17.943077087 CET	8.8.8.8	192.168.2.7	0x63c2	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:23.359168053 CET	8.8.8.8	192.168.2.7	0x4ab5	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:29.791511059 CET	8.8.8.8	192.168.2.7	0x7ae5	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:35.455698013 CET	8.8.8.8	192.168.2.7	0x3d6e	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:40.943595886 CET	8.8.8.8	192.168.2.7	0x30dd	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:46.219542980 CET	8.8.8.8	192.168.2.7	0x47c8	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:51.504779100 CET	8.8.8.8	192.168.2.7	0x1e58	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:03:56.749474049 CET	8.8.8.8	192.168.2.7	0x535	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:01.995347977 CET	8.8.8.8	192.168.2.7	0x524a	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:07.262625933 CET	8.8.8.8	192.168.2.7	0xedd9	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:12.527344942 CET	8.8.8.8	192.168.2.7	0x6a27	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:17.781374931 CET	8.8.8.8	192.168.2.7	0x76b0	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:22.994004011 CET	8.8.8.8	192.168.2.7	0x731a	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)
Feb 25, 2021 04:04:28.235445976 CET	8.8.8.8	192.168.2.7	0xfe23	No error (0)	hailongfvt.zapto.org	185.140.53.139	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cpIaMuv3PV.exe PID: 6364 Parent PID: 5680

General

Start time:	04:02:15
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\cpIaMuv3PV.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\cpIaMuv3PV.exe'
Imagebase:	0xb30000
File size:	1272320 bytes
MD5 hash:	A8911878F9C096C7BFE665B8076A8704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.247716186.0000000003FCD000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.247240720.0000000002F41000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.248243542.00000000040F0000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.247304436.0000000002FBC000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6476 Parent PID: 6364

General

Start time:	04:02:20
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp2685.tmp'
Imagebase:	0x2b0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6492 Parent PID: 6476

General

Start time:	04:02:21
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cpIaMuv3PV.exe PID: 6552 Parent PID: 6364

General

Start time:	04:02:22
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\cpIaMuv3PV.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\cpIaMuv3PV.exe
Imagebase:	0x4b0000
File size:	1272320 bytes
MD5 hash:	A8911878F9C096C7BFE665B8076A8704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.509285336.0000000005190000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.508238274.0000000003999000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.501066810.0000000002951000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.509339734.0000000005270000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.498104256.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 7060 Parent PID: 3292

General

Start time:	04:02:34
Start date:	25/02/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x7ff6e70f0000
File size:	1272320 bytes
MD5 hash:	A8911878F9C096C7BFE665B8076A8704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.300425603.0000000003311000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000008.00000002.302116757.0000000004318000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.300490631.0000000003359000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 19%, Metadefender, Browse Detection: 38%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6388 Parent PID: 7060

General

Start time:	04:02:43
Start date:	25/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\OUCEGOEkZUvjuG' /XML 'C:\Users\user\AppData\Local\Temp\tmp7E79.tmp'
Imagebase:	0x1070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 976 Parent PID: 6388

General

Start time:	04:02:44
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 6232 Parent PID: 7060

General

Start time:	04:02:45
Start date:	25/02/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0xb50000
File size:	1272320 bytes
MD5 hash:	A8911878F9C096C7BFE665B8076A8704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.322544364.00000000042C9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.322397159.00000000032C1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.321286560.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: cpIaMuv3PV.exe PID: 6364 Parent PID: 5680 cpIaMuv3PV.exeCOMMON

Executed Functions

Function 02DFEA34, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79a70d51acac00e304cfb6777531ff1213e5ab8707eadb30b0f7057b6d2b247
Instruction ID: e2047921a1c1e96445bbd36affb553cd8f138fbe2712d76da25d0cffe0667a0b
Opcode Fuzzy Hash: b79a70d51acac00e304cfb6777531ff1213e5ab8707eadb30b0f7057b6d2b247
Instruction Fuzzy Hash: 4C919D35E003198FCB00DFA5D8949DDBBBAFF89304F558619E505AB7A0EB30A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DFEF5A, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87813699018a9c200f7ae81628c42c3717609c65c248cb89c5c935bac9de76bc
Instruction ID: ca2c2dcd420d6fed47d8439ddbcea65e4db707e9cf3609cbe9f6a93dffe9555d
Opcode Fuzzy Hash: 87813699018a9c200f7ae81628c42c3717609c65c248cb89c5c935bac9de76bc
Instruction Fuzzy Hash: B781AC35E003199FCB00DFA1D8948DDBBBAFF89304F558625E515AB7A4EB30A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DFB787, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DFE96A

Strings

3dj^, xrefs: 02DFB811

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 3dj^
API String ID: 716092398-2680493169
Opcode ID: aaaa0ee042a537e5d8a66a6a3c0611db8f4916ad97935e83e040e799ebd5becb
Instruction ID: 70ac854f62d0ee7b4338d5ccffeaf2e3dd833a877624c98dd9195e79d57221cb
Opcode Fuzzy Hash: aaaa0ee042a537e5d8a66a6a3c0611db8f4916ad97935e83e040e799ebd5becb
Instruction Fuzzy Hash: 957179B1D043489FDB11CFA9C881ADEBBB1FF89314F15816AE944AB351D7749842CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DFC790, Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02DFC9E6

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a369b1b8cfe01e5987635076ab7981886af6e397cb354f71fb354209778f2434
Instruction ID: 1297a4e206d27a5a96cdd73ea8caa423161824c4c2a17f5e8faf775472c09b61
Opcode Fuzzy Hash: a369b1b8cfe01e5987635076ab7981886af6e397cb354f71fb354209778f2434
Instruction Fuzzy Hash: 1E812370A10B098FD764DF2AD044B5ABBF1FF88204F05892ED58ADBB50DB34E855CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02DFE7C2, Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a14fce292034ded24fe1fa422b41abd8878569c981a2ef2b3e54f921ba7f09
Instruction ID: a45f0afcd9a18badb0e5d42c79b28be1c353a0ed2a8b232183261e15ea5133f1
Opcode Fuzzy Hash: 74a14fce292034ded24fe1fa422b41abd8878569c981a2ef2b3e54f921ba7f09
Instruction Fuzzy Hash: 2A51FFB1C00249AFDF51CF99C880ADDBFB1BF88314F19826AE919AB221D7759945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DFE7F8, Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DFE96A

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0c539715f026a00925683bc09bcb06a2027b7039758d8131b947f81a1c5c6f4b
Instruction ID: 0ea40a76e10ad8aa6a1bbeb0154a1a9a8189d8292e355eaf81f7fb8d8d2ecd81
Opcode Fuzzy Hash: 0c539715f026a00925683bc09bcb06a2027b7039758d8131b947f81a1c5c6f4b
Instruction Fuzzy Hash: B451DDB2D00249EFDF51DF99C880ADDBBB6FF48314F15812AE919AB220D7719985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DFE84C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DFE96A

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 221919b9ff432d7944a875578f7c0327c5c7fa10eb557443a052b9c7f4c1c746
Instruction ID: 543d1ee273732606e5094deca4683e18f341c3cb0383bdfddb4098d3481a24d8
Opcode Fuzzy Hash: 221919b9ff432d7944a875578f7c0327c5c7fa10eb557443a052b9c7f4c1c746
Instruction Fuzzy Hash: C251E0B1D00308DFDB54CF99C880ADDBBB1BF48314F25862AE919AB320D7709985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DFB804, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DFE96A

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b7275631521993694f854246882a456e5ff83b0e6bcd06eeaa22fff4e3a7d0d4
Instruction ID: a55f9b978ff06792d8484023d5026760be0389eba627150ee045a64e4d1595ff
Opcode Fuzzy Hash: b7275631521993694f854246882a456e5ff83b0e6bcd06eeaa22fff4e3a7d0d4
Instruction Fuzzy Hash: A151C1B1D00349DFDB54CF99C884ADEBBB5BF48314F25862AE919AB310D7709985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DFE7E2, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DFE96A

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2dd23c9dfd6dfce47de3327d69b77bd3dfa7e688864b5b754fa64346a9e24fe5
Instruction ID: 83f229438ba9489d414fbaa8010d531ca4e7fc8faf6c345935be439b560327be
Opcode Fuzzy Hash: 2dd23c9dfd6dfce47de3327d69b77bd3dfa7e688864b5b754fa64346a9e24fe5
Instruction Fuzzy Hash: 5741FFB1D003489FDF54CF99D880ADDBBB1BF88314F25861AE919AB320D775A885CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02DF7DA2, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02DF7E2F

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f334de781669e0733931a9e066323da20d18bc0b03cb0aba0b7281cb0154e8b7
Instruction ID: 607bc048b24ddc2515ed295b7835907fcd637f5c531ca1a15bb543fecfc71502
Opcode Fuzzy Hash: f334de781669e0733931a9e066323da20d18bc0b03cb0aba0b7281cb0154e8b7
Instruction Fuzzy Hash: 0D21E4B59002499FDB50CFAAD984ADEFBF8FB48324F15841AE914A7310D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DF7DA8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02DF7E2F

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a6ec5aa35cbed9688290b2098ff807a6e5cab3a3038c1d5399790465f471b931
Instruction ID: 8392b3d73fc2965ec66d23beee89e6c639bce435eeb2f8c933bc45cb6e564e94
Opcode Fuzzy Hash: a6ec5aa35cbed9688290b2098ff807a6e5cab3a3038c1d5399790465f471b931
Instruction Fuzzy Hash: 9D21F3B59003499FDB50CFAAD984ADEFBF8FB48324F14841AE914A7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DFCC00, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02DFCA61,00000800,00000000,00000000), ref: 02DFCC72

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4701ecca26c1538699fb8c8b8586e3d122fa6481acf517a6027c8a42f599f21f
Instruction ID: 4011945bb8b0a5cfc5074d05c73520276531887eb34353f2499e57be6343c1a9
Opcode Fuzzy Hash: 4701ecca26c1538699fb8c8b8586e3d122fa6481acf517a6027c8a42f599f21f
Instruction Fuzzy Hash: 0911FFB69002498FDB10CFAAC544ADEFBF4AB48314F15852ED569A7610C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DFB6C8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02DFCA61,00000800,00000000,00000000), ref: 02DFCC72

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08529a8a71f6def1bf49b0f9d8e4d4a10b1f1eb3f32a0694143586c463ba46e7
Instruction ID: fbd103f99203b7528ac2e75ed1010f6cb5f9b520cf12091c749e1ee0d4721f51
Opcode Fuzzy Hash: 08529a8a71f6def1bf49b0f9d8e4d4a10b1f1eb3f32a0694143586c463ba46e7
Instruction Fuzzy Hash: 061100B29003488FDB10CF9AD444B9EBBF4EB88324F05842EE919A7710C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DFC980, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02DFC9E6

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2bffc079253606f932e5bca98f6a2dc1534529677b68e6494714e93678c7688a
Instruction ID: ef15ab3d7e9ccf89af5ca7ad3c35525c6a2ee343067cc36d18c814a03796dcd1
Opcode Fuzzy Hash: 2bffc079253606f932e5bca98f6a2dc1534529677b68e6494714e93678c7688a
Instruction Fuzzy Hash: BD1110B2D003498FCB20CF9AD444BDEFBF4AB88224F15841AD869B7300C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DFEEA2, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02DFEF05

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b1588b13f01cf922c903215765b8b423d3dc70a4cbfa3bef6721fa18dad1fdc4
Instruction ID: 977e5f4341957602565e8648d54af9dd570cd97a146410023ca0062614aaa051
Opcode Fuzzy Hash: b1588b13f01cf922c903215765b8b423d3dc70a4cbfa3bef6721fa18dad1fdc4
Instruction Fuzzy Hash: EE1133B1900348DFDB10DF89D489BDEBBF8EB48324F15840AE915A3740C378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DFEEA8, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02DFEF05

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: cc37dace1f3a49fdb157ac0447b77b35065bdaaaca611673b119865b3c038c91
Instruction ID: 8b3cecb89ba3087477349fe285a495e425a12a30814b3ab3b38a0012064e326a
Opcode Fuzzy Hash: cc37dace1f3a49fdb157ac0447b77b35065bdaaaca611673b119865b3c038c91
Instruction Fuzzy Hash: 291112B5900348DFDB10DF9AC488BDEBBF8EB48324F15841AE959A3340C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247096472.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd173f48eb4d9260188911d19c1038d7afd74213a106f4c06ecf8bc173aae04
Instruction ID: a4d333da26ee168c0dbc68252edd0f7fd77c54d435e3571e2975d98350bb5b04
Opcode Fuzzy Hash: 6dd173f48eb4d9260188911d19c1038d7afd74213a106f4c06ecf8bc173aae04
Instruction Fuzzy Hash: 402128B1904240DFDB05DF54D9C0B27BB65FB88328F24856AE9054B326C376D8C6CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0143D09C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247105925.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a3a434f9307ff05a139216a0cd41c93d36781e48ae1ae7e9eba281ef051800
Instruction ID: 0175aef7c3a6ced7f02a63f1ecdc096738c61ebb80f80198ce4b7e755c645597
Opcode Fuzzy Hash: d2a3a434f9307ff05a139216a0cd41c93d36781e48ae1ae7e9eba281ef051800
Instruction Fuzzy Hash: CC2100B1A08240DFDF05CF58D8C0B26BB65FBC8218F64C56EE9094B366C33AD806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0143D085, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247105925.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c6633a0d09f4bd9561be9f8c780fabfcaf85bf83240bb73421b131812da8b6
Instruction ID: f92675b3fb7605c3f83f87e7badce4c3a5ba745f77b56a261497334631faa004
Opcode Fuzzy Hash: 97c6633a0d09f4bd9561be9f8c780fabfcaf85bf83240bb73421b131812da8b6
Instruction Fuzzy Hash: AC2192759083809FDB02CF54D980B12BFB1EB89214F24C5EAD8498B367C33AD856CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142D4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247096472.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction ID: edbba089abe4554edaf39b134c271143b21fc8ec9b2c77caee5dfeb27ab2b28a
Opcode Fuzzy Hash: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction Fuzzy Hash: 8311B176904280CFDB16CF54D5C4B16BF71FB84324F2486AAD8054B72BC33AD496CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D799, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247096472.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c3d8183661f883df6e896fc139564d1cbd33aa14fd3ab12c6cfa6f9da9b4dd
Instruction ID: 93fe8f677fadf3813c3dad79b00409b8fbfcaa3dbd7b51ff1577275db1f2432d
Opcode Fuzzy Hash: a2c3d8183661f883df6e896fc139564d1cbd33aa14fd3ab12c6cfa6f9da9b4dd
Instruction Fuzzy Hash: D501FC719093E09EE7209A5ACCC4B67FB98EF81234F48851BEE054B296C37C9C84C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D798, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247096472.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2daab5aadbfb40a31a32fa08b899cd3bd140b1e4e77ea0cca9665e07052753bc
Instruction ID: f4ccb2e9245bfcd889b38dce5f0cecb6c3f822d69fdfc589a945695110ed1b91
Opcode Fuzzy Hash: 2daab5aadbfb40a31a32fa08b899cd3bd140b1e4e77ea0cca9665e07052753bc
Instruction Fuzzy Hash: D9F068715053949EE7258A1ADC84B63FFA8EB81634F18C45BED085B256C3795884CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02DFB488, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.247186797.0000000002DF0000.00000040.00000001.sdmp, Offset: 02DF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c4f35314f00633dcf7d9589c1f5b1b57aa2e28be77daca9d55c2468daebc95
Instruction ID: 968d6806687b652168ed24b9fc7c808072de84b9fc2a653a1f5925418f64c6c3
Opcode Fuzzy Hash: 38c4f35314f00633dcf7d9589c1f5b1b57aa2e28be77daca9d55c2468daebc95
Instruction Fuzzy Hash: 30A16B32E106098FCF05DFA5C84459EBBB2FF89304B16856AE905AB360EB35ED55CF90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cpIaMuv3PV.exe PID: 6552 Parent PID: 6364 cpIaMuv3PV.exeCOMMON

Executed Functions

Function 0280B6C0, Relevance: 6.1, APIs: 4, Instructions: 127threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0280B730
GetCurrentThread.KERNEL32 ref: 0280B76D
GetCurrentProcess.KERNEL32 ref: 0280B7AA
GetCurrentThreadId.KERNEL32 ref: 0280B803

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 58d8f527cdf280ed9e9850b33d86756144900363f0d024b500dc09d8d8eca376
Instruction ID: e002ca2952472f9164d4719db641de16a29337e2ab6fd058a69a1a97215b9165
Opcode Fuzzy Hash: 58d8f527cdf280ed9e9850b33d86756144900363f0d024b500dc09d8d8eca376
Instruction Fuzzy Hash: CD516AB89043488FDB54CFA9D588BDEBBF1EF48318F248459E449A7290C7746845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0280B6D0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0280B730
GetCurrentThread.KERNEL32 ref: 0280B76D
GetCurrentProcess.KERNEL32 ref: 0280B7AA
GetCurrentThreadId.KERNEL32 ref: 0280B803

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a4ac1a3f7fd88b098caf129ff2478e24864f934e0b476afe630f42570a2c82ed
Instruction ID: 089b96e3dded4834331e78a8b0d6ac3638c4d31dc211bf46190cca6532c1685c
Opcode Fuzzy Hash: a4ac1a3f7fd88b098caf129ff2478e24864f934e0b476afe630f42570a2c82ed
Instruction Fuzzy Hash: 855168B8E002488FDB54CFA9D588BDEBBF1EF48318F248459E049A3390C7746845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0280FAA0, Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1da3ca932a3c3e2aba86c3f8889b3f411aacfc15c2159a93634e92bb2254daf
Instruction ID: 6b5b1667ead710bab6b4f36a65e31e9ba44a9b77d9710ac8e51a5431eeb4e969
Opcode Fuzzy Hash: b1da3ca932a3c3e2aba86c3f8889b3f411aacfc15c2159a93634e92bb2254daf
Instruction Fuzzy Hash: F4919D75C083899FDB12CFA4C8919CDBFB0FF0A314F15819AE894AB1A2D7345946DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05F13178, Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509644127.0000000005F10000.00000040.00000001.sdmp, Offset: 05F10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c2ae432e8971b4655129272bf37f51efc493bfe18c8a2cc69026ffbb72397b
Instruction ID: c7e2cc17a30875fe579de877bb8b6d3d5db39909e53bd700925762202ce44cce
Opcode Fuzzy Hash: 72c2ae432e8971b4655129272bf37f51efc493bfe18c8a2cc69026ffbb72397b
Instruction Fuzzy Hash: 07818A71D04359CFDB10DFA9C880ADEBBB2FF49314F10852AE815AB290DB74A949CF95

Uniqueness

Uniqueness Score: -1.00%

Function 028093E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0280962E

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5212f0660b5aeeb645c564aeab606ff959f8cdcae3f29a468c244d655066989b
Instruction ID: 37a15c482d799682ea5cd5019b0c5862d63101630b97af5952b1cb23a52cf8ec
Opcode Fuzzy Hash: 5212f0660b5aeeb645c564aeab606ff959f8cdcae3f29a468c244d655066989b
Instruction Fuzzy Hash: EC712478A00B058FD764DF2AD48175ABBF2FF88614F008A2DD58AD7A91D734E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05F1150A, Relevance: 1.7, APIs: 1, Instructions: 153networkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 05F13358

Memory Dump Source

Source File: 00000004.00000002.509644127.0000000005F10000.00000040.00000001.sdmp, Offset: 05F10000, based on PE: false

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: e4fd1aab46ed5417801083a06a31877a45a9497e54efb000071475b5d20762c8
Instruction ID: a4fc98337ef3e7ee597be2902d1da112d38040aab5455e4a39708f2c0384e71f
Opcode Fuzzy Hash: e4fd1aab46ed5417801083a06a31877a45a9497e54efb000071475b5d20762c8
Instruction Fuzzy Hash: 3E515771D04358DFDB10CFA9C881ADEBBB1FF48314F24842AE805AB290DB74A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05F13224, Relevance: 1.6, APIs: 1, Instructions: 141networkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 05F13358

Memory Dump Source

Source File: 00000004.00000002.509644127.0000000005F10000.00000040.00000001.sdmp, Offset: 05F10000, based on PE: false

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: 147d019c09a9af705dc36fa9c42910a195f0c039a6163a34ff08c6050dae25ea
Instruction ID: 01675699849cbb69e5fe926c6530acfe474e34ba546407f62845eb3d42fb085d
Opcode Fuzzy Hash: 147d019c09a9af705dc36fa9c42910a195f0c039a6163a34ff08c6050dae25ea
Instruction Fuzzy Hash: 0A513771D04258CFDB10CFA9C880BDDBBB1FF48314F24842AE815AB290DB74A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05F1151C, Relevance: 1.6, APIs: 1, Instructions: 140networkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 05F13358

Memory Dump Source

Source File: 00000004.00000002.509644127.0000000005F10000.00000040.00000001.sdmp, Offset: 05F10000, based on PE: false

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: 58535962d11c3dc96b79075e3a73e0b7dca7fc7c5d0d4acaa488592467793e7b
Instruction ID: 0c0dc8707bccb0ac286af6ffe55f75247bd8718d47cfe3490c754a1987475bb5
Opcode Fuzzy Hash: 58535962d11c3dc96b79075e3a73e0b7dca7fc7c5d0d4acaa488592467793e7b
Instruction Fuzzy Hash: C5513571D04258DFDB10DFA9C880BDEBBB5FF48314F14842AE819AB290DB74A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0280FBF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0280FD0A

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c8b8fe7a03b0a32a6e891d44bc4877687e5fe261f74ef3755baa850973e9dfcd
Instruction ID: 8950f4e92fa837d6d20d97d33ffa7b23ad8334f38236f04d625f4ba804f4d568
Opcode Fuzzy Hash: c8b8fe7a03b0a32a6e891d44bc4877687e5fe261f74ef3755baa850973e9dfcd
Instruction Fuzzy Hash: 2341C0B5D003589FDF14CF99C884ADEBBB5FF88314F24822AE919AB250D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0280BDC1, Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0280BD87

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8cb496635b66806aed1b4195ed59194e7d8c1d6c5b1ac62c8a038ab57e0757c8
Instruction ID: 9786c62ab38a74b6934bb4162b5940965365909762ad4de9de14ecc08cb6e36d
Opcode Fuzzy Hash: 8cb496635b66806aed1b4195ed59194e7d8c1d6c5b1ac62c8a038ab57e0757c8
Instruction Fuzzy Hash: 98419D78E84344DFEB01DFA1E984BA97BB5FB49702F10862AE9458B3C5C7756942CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0280BCF9, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0280BD87

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed00ea68e359dcfb82fb9affb675b6078fbfe1ebde27844d02494667058fb33f
Instruction ID: b0f0572ef6a16c7f8a76203bba8b93efaf9095bbed7639701282d9ba4ec18736
Opcode Fuzzy Hash: ed00ea68e359dcfb82fb9affb675b6078fbfe1ebde27844d02494667058fb33f
Instruction Fuzzy Hash: 5321E3B5D012489FDB10CF9AD984ADEFBF4EB48324F14841AE959A3350D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0280BD00, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0280BD87

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fea351995dfb73c5688ec529461bb04de5651579ce67e7681b0c8889f1d59873
Instruction ID: 1c4aa9b43c6730374cae5ca2208c0d462710ef7c0ca85a376053979a193d52d6
Opcode Fuzzy Hash: fea351995dfb73c5688ec529461bb04de5651579ce67e7681b0c8889f1d59873
Instruction Fuzzy Hash: B621E4B5D002489FDB10CF9AD984ADEFBF4FB48324F14841AE958A3350C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02809849, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,028096A9,00000800,00000000,00000000), ref: 028098BA

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 86c7268e3bda7ce9b4778535f2e12acd5f1431c4de095994d14f81de9c27351f
Instruction ID: 734a6eebb182915b1287d5e0cc5b75b15de63b4feac12e5d77dc4efc51ba7086
Opcode Fuzzy Hash: 86c7268e3bda7ce9b4778535f2e12acd5f1431c4de095994d14f81de9c27351f
Instruction Fuzzy Hash: 461124B6D002498FDB10CF9AC884BDEBBF4EB48324F04842EE559A7600C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02808768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,028096A9,00000800,00000000,00000000), ref: 028098BA

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74874bd93a32baf4bd4a22aa9ff269ff5c7e288c8e62c7c9327a34b0dbfcb510
Instruction ID: 7952200b333dd11d14851a067c8e5f21d71b475d13ab9fd4587cc02c24ead353
Opcode Fuzzy Hash: 74874bd93a32baf4bd4a22aa9ff269ff5c7e288c8e62c7c9327a34b0dbfcb510
Instruction Fuzzy Hash: 3D1103BAD042498FDB10CF9AC884BDEBBF4EB48724F04842EE519A7740C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 028095C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0280962E

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f57c60fe0e5850a1e56363055b6fb123ab29ab7183f0d6727c18443ea05ef00
Instruction ID: 7b265db2f451638000937bcd5ee91621907c0ac5ddaff77bd6cae8f377659e2a
Opcode Fuzzy Hash: 1f57c60fe0e5850a1e56363055b6fb123ab29ab7183f0d6727c18443ea05ef00
Instruction Fuzzy Hash: 8111E3B6D002898FCB10CF9AC844BDEFBF4AF88624F14841AD469A7651D374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0280FE38, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0280FE9D

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e87008c7462ca632661a0afb2aa5ad19cb1e747b245b03590cf6501c3164332a
Instruction ID: 3ec1b0714be224de84fe30247c45f0015db4fc7a6ad4c149e8750e3ca281059e
Opcode Fuzzy Hash: e87008c7462ca632661a0afb2aa5ad19cb1e747b245b03590cf6501c3164332a
Instruction Fuzzy Hash: 461133B5D002488FCB20CF99D589BDFBBF4EB88324F10841AE959A7240C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0280FE40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0280FE9D

Memory Dump Source

Source File: 00000004.00000002.500926181.0000000002800000.00000040.00000001.sdmp, Offset: 02800000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d027cebf5621c2b2a809ceaeb31489048bbe9cdd1e1828f8bdad50ff29c66b4c
Instruction ID: 8d7ac19e8ce64f7f3d1b731c8457ef5c16a9dd006798ef69b0bc962f369fb328
Opcode Fuzzy Hash: d027cebf5621c2b2a809ceaeb31489048bbe9cdd1e1828f8bdad50ff29c66b4c
Instruction Fuzzy Hash: C81115B59002488FDB10CF99D584BDFBBF8EB48324F10841AE959A7740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500466971.0000000000DAD000.00000040.00000001.sdmp, Offset: 00DAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af7939952ca407ef0da52c5cc1591c8f20827bba04d136e4480ada2a6e4700e1
Instruction ID: f3116d294823461c7cd48baebd020b4c687239369734745839c907bf29fb0a28
Opcode Fuzzy Hash: af7939952ca407ef0da52c5cc1591c8f20827bba04d136e4480ada2a6e4700e1
Instruction Fuzzy Hash: 1C2125B1504240DFDB04DF14D8C0F26BB66FB98324F28C569E94A4BA46C376EC46CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500466971.0000000000DAD000.00000040.00000001.sdmp, Offset: 00DAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67615cd899b7ef35d08e820be77026c948bf7383f9e1f2447844d705a8e3f81
Instruction ID: e0b2ee5f0b13d4940d16b8c58b80134721c7b2e3638705682a1e48ecede029f2
Opcode Fuzzy Hash: c67615cd899b7ef35d08e820be77026c948bf7383f9e1f2447844d705a8e3f81
Instruction Fuzzy Hash: C52128B1908240DFDB05DF14D8C0B26BF66FB99328F288569D9464B616C336DC46CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0266D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500668544.000000000266D000.00000040.00000001.sdmp, Offset: 0266D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f641b6aabeb5814b45fde5c7c54e6a803740431e6fb482cf8733e1520a9a7b0d
Instruction ID: b237ccdd10fa2b9c20948c8c6b461e55a37a0cb7b90a312411bd1717b86dc52c
Opcode Fuzzy Hash: f641b6aabeb5814b45fde5c7c54e6a803740431e6fb482cf8733e1520a9a7b0d
Instruction Fuzzy Hash: 1721C2B5608280DFDB14DF14D9C8B36BB65FB88318F24C569E94A4B356C336D847CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0266D006, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500668544.000000000266D000.00000040.00000001.sdmp, Offset: 0266D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54d49aeacdbf3cab3ee0329dfdb28bd6c9c6e7fa3e3917fa9e731a6be4347ad
Instruction ID: c1d0ef20913a58f7e5e058a9b9466d7eb7dafd5b3bb029f408fc581a00dc4429
Opcode Fuzzy Hash: f54d49aeacdbf3cab3ee0329dfdb28bd6c9c6e7fa3e3917fa9e731a6be4347ad
Instruction Fuzzy Hash: 272162755093C08FDB12CF24D594B25BF71EB46214F28C5DAD8498B667C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500466971.0000000000DAD000.00000040.00000001.sdmp, Offset: 00DAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction ID: 81cdeffbe48a795897384f4a4218b3e95f905c4def3cb52949abc70fedacd968
Opcode Fuzzy Hash: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction Fuzzy Hash: 0111E676904280CFDF16CF14D5C4B16BF72FB95324F28C6A9D8050B616C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.500466971.0000000000DAD000.00000040.00000001.sdmp, Offset: 00DAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction ID: 77a4b646bf7ebe2822f7596c74bb49f7cb36d8d1f50536a8276dee5159710799
Opcode Fuzzy Hash: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction Fuzzy Hash: 59110876504280CFDF15CF10D5C4B16BF72FB99324F28C6A9D8450BA16C336E856CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 7060 Parent PID: 3292 dhcpmon.exeCOMMON

Executed Functions

Function 032DE740, Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27068638c044f43a17b89eb20511eaa3829dec484a7aec03f9cd62675dc996e
Instruction ID: bee634ecbc83baf486367e0d7705d000a018645dca6e8505d17aaf24f2dde6fa
Opcode Fuzzy Hash: b27068638c044f43a17b89eb20511eaa3829dec484a7aec03f9cd62675dc996e
Instruction Fuzzy Hash: DB818CB1C14388AFDF12CFA5C880ADDBFB1EF49310F1A819AE454AB262D7759885CF51

Uniqueness

Uniqueness Score: -1.00%

Function 032DC7A0, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7f89c1841e7a51e22e876fdeab4d23c2cc957e44ab67a7b88ffd0c4c2422d7c7
Instruction ID: 384469445048d15d6c383ac34ed4d9c6775f5e2c3f0b9fdf38bbba5eb840831f
Opcode Fuzzy Hash: 7f89c1841e7a51e22e876fdeab4d23c2cc957e44ab67a7b88ffd0c4c2422d7c7
Instruction Fuzzy Hash: 5B714770A10B168FDB24DF2AD054B5ABBF5FF88204F04892DD44ADBA50DB74E885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 032DE780, Relevance: 1.7, APIs: 1, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ce859400b72daae82b7ae969b9b7e930bab3e435b3e3e75a614c1b9b31c0eb
Instruction ID: 56adcdff03e93df2327a1db6325fcbb5c59e8c0f51c8299f4735633980f7f63f
Opcode Fuzzy Hash: 50ce859400b72daae82b7ae969b9b7e930bab3e435b3e3e75a614c1b9b31c0eb
Instruction Fuzzy Hash: 777132B1C10249AFDF15CFA5D880ADDBFB1FF48310F19815AE818AB221D731A886DF91

Uniqueness

Uniqueness Score: -1.00%

Function 032DB804, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032DE96A

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 32467813671de0f03b47ed8660c9305f64d7b37e799a57234acb623dcec0346b
Instruction ID: c09dfc1599a6a84e8f6f30532e77a8741476c11adb0ec5e5de44caef93d2f869
Opcode Fuzzy Hash: 32467813671de0f03b47ed8660c9305f64d7b37e799a57234acb623dcec0346b
Instruction Fuzzy Hash: 9C51B0B1D10349DFDB14CF99D884ADEFBB5BF48314F25822AE819AB210D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 032D63B0, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed1cdae8f740c576865ab7079819eedaa3ea4a1e794c2a1643f88afbd79e996
Instruction ID: 70a3309b499d0b9157bd27bc526d4bf32b299f6817a6b72b8874f5b547290d65
Opcode Fuzzy Hash: 3ed1cdae8f740c576865ab7079819eedaa3ea4a1e794c2a1643f88afbd79e996
Instruction Fuzzy Hash: 72418F718193989FDB02CFADD890ADEBFF4EF1A214F05446AE540E7292D3789D44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 032D6466, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,032D7D6E,?,?,?,?,?), ref: 032D7E2F

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c4fb4788ff9bfba36f8dbde4ba9c7648676a12fb07130364a4b09dd7eaf3bc20
Instruction ID: 525600325295dd241c8485a46710a8a3697fcf105d5e65f3d57df1edadbbb693
Opcode Fuzzy Hash: c4fb4788ff9bfba36f8dbde4ba9c7648676a12fb07130364a4b09dd7eaf3bc20
Instruction Fuzzy Hash: 703126B5914208EFDB10CF99D484AEEFBF8FB48314F14851AE859A3350D378A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 032DEE0B, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,032DEE90,?,?,?,?), ref: 032DEF05

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 33bee34953c7c5274bc4000ee03450365d5d0c1f5d2efd46465c6b1500e16dcd
Instruction ID: 512594aa380784972d32ed597ab4e726890a25676cd1bf619f275aeed37dbf1d
Opcode Fuzzy Hash: 33bee34953c7c5274bc4000ee03450365d5d0c1f5d2efd46465c6b1500e16dcd
Instruction Fuzzy Hash: BC319CB5910349AFDB15DF99C845BAFBBF8FB48364F15841AE405AB300C775A840CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 032D6404, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,032D7D6E,?,?,?,?,?), ref: 032D7E2F

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8463a904a23cda5cdee026ce601c78dabd902ecf02e1a3612db386931396bf93
Instruction ID: 02c638fe9448fe142df8ca89baf456942e1b30c75beb200c2425c8fd527f4a97
Opcode Fuzzy Hash: 8463a904a23cda5cdee026ce601c78dabd902ecf02e1a3612db386931396bf93
Instruction Fuzzy Hash: 9E21E6B59002589FDB10CF99D584AEEFBF8FB48314F14841AE955A3310D378A945DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 032D7DA3, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,032D7D6E,?,?,?,?,?), ref: 032D7E2F

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 608d31de7e083cb999ff92cc702f66b8bfdebae8621184153f8b757e7b2982c6
Instruction ID: 81c94ae490586884c82c953bc7705640f29f581497a3f4552ccdfbe42517c09c
Opcode Fuzzy Hash: 608d31de7e083cb999ff92cc702f66b8bfdebae8621184153f8b757e7b2982c6
Instruction Fuzzy Hash: A221E6B59002489FDB10CF99D484ADEFBF4FB48314F14841AE954A3310D378A945DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 032DCC00, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,032DCA61,00000800,00000000,00000000), ref: 032DCC72

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a49d007eb12d42d2184f9098955f3661355f79fa1e6ae35094ebb5d1aba18758
Instruction ID: c0dcf5831e3c82072f6d3d9d1a01957af7b88d8aedae4a442bbcfd91111a0f6b
Opcode Fuzzy Hash: a49d007eb12d42d2184f9098955f3661355f79fa1e6ae35094ebb5d1aba18758
Instruction Fuzzy Hash: EE2144B28003499FDB10CF9AD544ADEFBF4FB88324F14852EE529A7200C375A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 032DB6C8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,032DCA61,00000800,00000000,00000000), ref: 032DCC72

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f4813940d4700bd75f43a3050784665a00873d6ef4181893aa1899cdf191e085
Instruction ID: 260ce84e5fa6d7e7755649c6443a42492657e6009d6ed632d7fb040af4867cfe
Opcode Fuzzy Hash: f4813940d4700bd75f43a3050784665a00873d6ef4181893aa1899cdf191e085
Instruction Fuzzy Hash: 691126B29043599FDB10CF9AD444BDEFBF4EB48720F14852EE515A7200C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 032DB674, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,032DC7B3), ref: 032DC9E6

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6f43f64733fa1eccaf5f48ecd849b80edda903c65165e0ca0caf325cdf99aa5f
Instruction ID: cfc35f0a9f4689d56e3f74974009e9990d993def4049da65dd79d42079c73b1b
Opcode Fuzzy Hash: 6f43f64733fa1eccaf5f48ecd849b80edda903c65165e0ca0caf325cdf99aa5f
Instruction Fuzzy Hash: C711F3B29102598BCB10CF9AD444BEEFBF8AB48214F14851AD45AB7300C375A946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 032DB81C, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,032DEE90,?,?,?,?), ref: 032DEF05

Memory Dump Source

Source File: 00000008.00000002.300340490.00000000032D0000.00000040.00000001.sdmp, Offset: 032D0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 847348d1b6b378126c1eef0ab5a6097c20d7005d225616691eab71ca18266cef
Instruction ID: 7e26c0569f0dc35959818ee7c8ffc16dc2d4894f3c373a9a0e054a6e57515fe2
Opcode Fuzzy Hash: 847348d1b6b378126c1eef0ab5a6097c20d7005d225616691eab71ca18266cef
Instruction Fuzzy Hash: 2F01D3B0814349DFDB10DF9AC489BAEBBF8EB48314F158459E855BB340C3B4A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 6232 Parent PID: 7060 dhcpmon.exeCOMMON

Executed Functions

Function 0307B6C0, Relevance: 6.1, APIs: 4, Instructions: 127threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0307B730
GetCurrentThread.KERNEL32 ref: 0307B76D
GetCurrentProcess.KERNEL32 ref: 0307B7AA
GetCurrentThreadId.KERNEL32 ref: 0307B803

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bbe54dedfcbba0ce48e8aebc97e80acba1be97365c2295545f11be8dc50d1324
Instruction ID: c573bb4855bebc7da4323d20ab2d14d2c1329a835034b48a6521b9f28154941b
Opcode Fuzzy Hash: bbe54dedfcbba0ce48e8aebc97e80acba1be97365c2295545f11be8dc50d1324
Instruction Fuzzy Hash: AA5135B0E062888FDB10CFA9D548BDEBBF1BF49314F24845AE049A7350D7746845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0307B6D0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0307B730
GetCurrentThread.KERNEL32 ref: 0307B76D
GetCurrentProcess.KERNEL32 ref: 0307B7AA
GetCurrentThreadId.KERNEL32 ref: 0307B803

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cdfca79322f4284d645d8384cf6143577435397bc9c0d448f830d8da62e38dce
Instruction ID: 47b74781c5b2ac9d3a42c4a836721fd1c0bf962f94dbaf22b2a64398de2551c7
Opcode Fuzzy Hash: cdfca79322f4284d645d8384cf6143577435397bc9c0d448f830d8da62e38dce
Instruction Fuzzy Hash: 955136B0E052498FDB10CFA9D548BDEBBF1BF48314F24845AE019A7350D7746845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030793E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0307962E

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9c26cb185dc8af4e2cd7baa833d713ad588959091dfa67f011c48aca3f03325b
Instruction ID: 353412221778d22b6d6256d9186b9ad1a4c467a0412ba061c7ca2dc98c75c558
Opcode Fuzzy Hash: 9c26cb185dc8af4e2cd7baa833d713ad588959091dfa67f011c48aca3f03325b
Instruction Fuzzy Hash: C0713570A01B058FDB64DF2AD445B9AB7F1FF88214F048A2ED48ADBA50DB34E845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0307FBEC, Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0307FD0A

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4b5a1258890b0e9c9ee29de26ff166ac84d1ebeac1db25bf43b26dc398df71f4
Instruction ID: e9ae2067e82e82c5288b52c8c2f3e9f9c8183e9f01f81105aee71aea96abbefc
Opcode Fuzzy Hash: 4b5a1258890b0e9c9ee29de26ff166ac84d1ebeac1db25bf43b26dc398df71f4
Instruction Fuzzy Hash: FF51C2B1D01349DFDB14CF99C884ADDBBB1FF88314F24862AE815AB210D7749945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0307FBF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0307FD0A

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 11a26717e4fedc30466e0a556310268d0c9b1372c6929aa61a6f2a56b00361c5
Instruction ID: fcc71466dc052d50062f0e9f4b4ef2ba7e356d027415ffafc878daa2a54e04f4
Opcode Fuzzy Hash: 11a26717e4fedc30466e0a556310268d0c9b1372c6929aa61a6f2a56b00361c5
Instruction Fuzzy Hash: 7E41C1B1D003099FDB14CF99C884ADEBBF5BF88314F24822AE819AB210D774A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0307BCF9, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0307BD87

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 60941e67aa9186d15f55a5f6098818df417557ce1422b4a7bbeb83abffb33836
Instruction ID: 5c1c6b9012735df36f7dec5fce139feb6e5c78b4c5379ca2e9f023e8ce4515f1
Opcode Fuzzy Hash: 60941e67aa9186d15f55a5f6098818df417557ce1422b4a7bbeb83abffb33836
Instruction Fuzzy Hash: EF2105B59012489FDB10CFAAD484ADEBFF4EB49324F14841AE954A7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0307BD00, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0307BD87

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8938aaf8c5fb053f4726c47a25a3f9859d7e702f7bf1c167af600a004da12b17
Instruction ID: 438ccceba80813b4176d272f3ec2096e883aafe410b2f74521864f44fe6587ad
Opcode Fuzzy Hash: 8938aaf8c5fb053f4726c47a25a3f9859d7e702f7bf1c167af600a004da12b17
Instruction Fuzzy Hash: AE21F3B5D012489FDB10CFAAD884ADEFBF8FB48324F14841AE954A3310D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03078768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030796A9,00000800,00000000,00000000), ref: 030798BA

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5098cb9f6b3610fdc46ea40ee28810f92188a7da080208b51c74d65ccb597552
Instruction ID: 918733373d777929c0412d99b397da6eee19703a8a0eea053bafd76714feee4e
Opcode Fuzzy Hash: 5098cb9f6b3610fdc46ea40ee28810f92188a7da080208b51c74d65ccb597552
Instruction Fuzzy Hash: 211114B6D012498FDB10CF9AC444BDEFBF4EB88324F04842EE559A7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03079849, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030796A9,00000800,00000000,00000000), ref: 030798BA

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5d06954222a5ba05f12dbabfed655e05e34b34e04ae39e29b23f9c9bc1ce668b
Instruction ID: 2913c8e685cb0af61202f7005f03a7f57431c0f99153268cdde192be8c3c004a
Opcode Fuzzy Hash: 5d06954222a5ba05f12dbabfed655e05e34b34e04ae39e29b23f9c9bc1ce668b
Instruction Fuzzy Hash: 3F1114B6D002499FDB10CFAAC444BDEFBF4EB89324F04852ED455A7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030795C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0307962E

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 97737c55e5e89ec77ba5547e7d418b6ae770829c75878415162174e81de282e2
Instruction ID: f8d47d6cd13ea192934754a3e3e2265c1a3eda2c0bae749f5023f69f312df5f4
Opcode Fuzzy Hash: 97737c55e5e89ec77ba5547e7d418b6ae770829c75878415162174e81de282e2
Instruction Fuzzy Hash: 0B11E0B6D012498FDB20DF9AC444BDEFBF4AB88224F14851AD459A7610C378A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0307FE38, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0307FE9D

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f694471be59c78a0bebe9ac879d3a11ff940e58a78f4c9b04cca389970f15adc
Instruction ID: 5010f072be03bc1c0eeb44ea43723892a1389cf80766005c0fde3a73edf8f30d
Opcode Fuzzy Hash: f694471be59c78a0bebe9ac879d3a11ff940e58a78f4c9b04cca389970f15adc
Instruction Fuzzy Hash: 331100B59002498FDB10CF9AD488BDEBBF8EB88324F14851AE955A7701C374A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0307FE40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0307FE9D

Memory Dump Source

Source File: 00000012.00000002.322211021.0000000003070000.00000040.00000001.sdmp, Offset: 03070000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b42ee1a43b320ba3547cba22b37320fa561b37876b719d105548768966bddfb7
Instruction ID: 42e13684c6ba2621a17af804a8cfd9a9750b6c0bbeefb2f44a359ea093457359
Opcode Fuzzy Hash: b42ee1a43b320ba3547cba22b37320fa561b37876b719d105548768966bddfb7
Instruction Fuzzy Hash: 521112B59002498FDB10CF9AD488BDEFBF8EB88324F14841AE855A7300C374A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0129D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.321787567.000000000129D000.00000040.00000001.sdmp, Offset: 0129D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be9ea3c6d36773c5d97366dad1fe6755699c3a3ce9f9b311967fd2bd6120e0d
Instruction ID: f66fb0879a92db0f0b15f8aeed7ae888cb6ab26c562b1d1edecc70feb4add415
Opcode Fuzzy Hash: 0be9ea3c6d36773c5d97366dad1fe6755699c3a3ce9f9b311967fd2bd6120e0d
Instruction Fuzzy Hash: 562136B1514244DFDF05DF9CE8C0B66BF65FB88328F248568DA090A217C336D806DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012BD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.321815875.00000000012BD000.00000040.00000001.sdmp, Offset: 012BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f02efedb84335083d28ccc6c1f95c71b3a05b991cda7e7489ba073c4bff3cd7
Instruction ID: 0735635f4a7b88e11549b765dd39cb42e0c5d17443c9caedb42bab5b9c7a75ac
Opcode Fuzzy Hash: 9f02efedb84335083d28ccc6c1f95c71b3a05b991cda7e7489ba073c4bff3cd7
Instruction Fuzzy Hash: DA216775618248DFDB14CF58D4C0BA6BB61FB88398F24C96DD9094B242C336D807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 012BD006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.321815875.00000000012BD000.00000040.00000001.sdmp, Offset: 012BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b9dbe464b476e3be1cad6f48a1961ed897bf85ec1f50583b4e803165709f57
Instruction ID: 9956465b6aaddba57129ad5bdd6967fba660381e20eeee4fe3ca1b7497233cd1
Opcode Fuzzy Hash: 01b9dbe464b476e3be1cad6f48a1961ed897bf85ec1f50583b4e803165709f57
Instruction Fuzzy Hash: 6621B0714083849FCB02CF24D9D4B51BF71EB46354F28C5DAD8498B267C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0129D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.321787567.000000000129D000.00000040.00000001.sdmp, Offset: 0129D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction ID: 61067814f974c55b3d47baa1602bd429a2049d2fb20e80f2e0a11bca14b34cc2
Opcode Fuzzy Hash: cd9fccb4d1f700996e96346b7a0ce1f317b0c695758ddfa9f0b4c227b16085db
Instruction Fuzzy Hash: B7119D76904284CFDF16CF58E5C4B16BF71FB84324F2486A9D9050A616C336D456DBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report cpIaMuv3PV.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets