Analysis Report f908098a_by_Libranalysis

Overview

General Information

Sample Name: f908098a_by_Libranalysis (renamed file extension from none to exe)
Analysis ID: 403331
MD5: f908098af6b73a5ea4081a3474030196
SHA1: 7c92b17c6e2ede3e3bee94c41603795c93d53c89
SHA256: aeb4339ff4e4d6f8249236e1280111324d84920c23a169cffc67577ab9f69217
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Nanocore RAT
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Machine Learning detection for sample
Potential time zone aware malware
Binary contains a suspicious time stamp
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Enables debug privileges
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "b3bfe601-8f28-4397-a972-90d172cf", "Group": "Default", "Domain1": "fedex.itemdb.com", "Domain2": "uspslabel.itemdb.com", "Port": 1090, "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8"}
Multi AV Scanner detection for submitted file
Source: f908098a_by_Libranalysis.exe Virustotal: Detection: 30% Perma Link
Source: f908098a_by_Libranalysis.exe ReversingLabs: Detection: 31%
Yara detected Nanocore RAT
Source: Yara match File source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY
Source: Yara match File source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: f908098a_by_Libranalysis.exe Joe Sandbox ML: detected
Source: f908098a_by_Libranalysis.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\System32\TileDataRepository.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\system32\Windows.StateRepository.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\SYSTEM32\usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\System32\Windows.StateRepositoryPS.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\system32\StateRepository.Core.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\System32\usermgrproxy.dll Jump to behavior

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: uspslabel.itemdb.com
Source: Malware configuration extractor URLs: fedex.itemdb.com

E-Banking Fraud:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY
Source: Yara match File source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
.NET source code contains very large strings
Source: f908098a_by_Libranalysis.exe, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 0.0.f908098a_by_Libranalysis.exe.d50000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 7.2.f908098a_by_Libranalysis.exe.2a0000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 7.0.f908098a_by_Libranalysis.exe.2a0000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 8.0.f908098a_by_Libranalysis.exe.6c0000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 8.2.f908098a_by_Libranalysis.exe.6c0000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 11.2.f908098a_by_Libranalysis.exe.f90000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 11.0.f908098a_by_Libranalysis.exe.f90000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 12.2.f908098a_by_Libranalysis.exe.f80000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 12.0.f908098a_by_Libranalysis.exe.f80000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 13.0.f908098a_by_Libranalysis.exe.ea0000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 13.2.f908098a_by_Libranalysis.exe.ea0000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 14.2.f908098a_by_Libranalysis.exe.e30000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 14.0.f908098a_by_Libranalysis.exe.e30000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 15.2.f908098a_by_Libranalysis.exe.b80000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 15.0.f908098a_by_Libranalysis.exe.b80000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 16.2.f908098a_by_Libranalysis.exe.600000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 16.0.f908098a_by_Libranalysis.exe.600000.0.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Source: 17.2.f908098a_by_Libranalysis.exe.a70000.1.unpack, ????????????????????????????????????????????????/??????????.cs Long String: Length: 1151773
Sample file is different than original file name gathered from version info
Source: f908098a_by_Libranalysis.exe, 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameTtUj Rdm.exe2 vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000000.00000000.673976619.0000000000D52000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000007.00000000.696324245.00000000002A2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000008.00000002.699238614.00000000006C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000000B.00000000.700650795.0000000000F92000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000000C.00000002.703961942.0000000000F82000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000000D.00000000.705268278.0000000000EA2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000000E.00000002.708435337.0000000000E32000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilename vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000000F.00000000.709949369.0000000000B82000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000010.00000002.714455206.0000000000602000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000011.00000000.715837458.0000000000A72000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000012.00000002.718980811.0000000000982000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000013.00000002.721470449.0000000000D32000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000014.00000002.723054234.0000000000152000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000015.00000000.724467032.0000000000762000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000016.00000002.727838186.0000000000CD2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000018.00000000.729151615.0000000000472000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000019.00000002.731766361.00000000003C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000001B.00000002.733743224.0000000000302000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000001C.00000000.735042109.0000000000CE2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000001D.00000000.737828175.0000000000C92000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000001E.00000000.740798809.0000000000312000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 0000001F.00000000.745314165.0000000000BF2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000021.00000002.748765167.0000000000F52000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000022.00000002.751235446.00000000001B2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000024.00000000.752668364.00000000000C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000025.00000000.754588800.0000000000F22000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000026.00000000.758516473.00000000002B2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe, 00000027.00000002.762246213.0000000000E32000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Source: f908098a_by_Libranalysis.exe Binary or memory string: OriginalFilenamefirst.exe, vs f908098a_by_Libranalysis.exe
Yara signature match
Source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: classification engine Classification label: mal100.troj.evad.winEXE@261/0@0/1
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: f908098a_by_Libranalysis.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: f908098a_by_Libranalysis.exe Virustotal: Detection: 30%
Source: f908098a_by_Libranalysis.exe ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe 'C:\Users\user\Desktop\f908098a_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\backgroundTaskHost.exe 'C:\Windows\system32\backgroundTaskHost.exe' -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\taskhostw.exe taskhostw.exe None
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\taskhostw.exe taskhostw.exe None Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: f908098a_by_Libranalysis.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: f908098a_by_Libranalysis.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: f908098a_by_Libranalysis.exe Static file information: File size 2311168 > 1048576
Source: f908098a_by_Libranalysis.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x233a00
Source: f908098a_by_Libranalysis.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Binary contains a suspicious time stamp
Source: f908098a_by_Libranalysis.exe Static PE information: 0xD93B9850 [Thu Jun 28 10:11:28 2085 UTC]
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Potential time zone aware malware
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe System information queried: CurrentTimeZoneInformation Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\System32\TileDataRepository.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\system32\Windows.StateRepository.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\SYSTEM32\usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\System32\Windows.StateRepositoryPS.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\system32\StateRepository.Core.dll Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe File opened: C:\Windows\System32\usermgrproxy.dll Jump to behavior
Source: svchost.exe, 0000000A.00000002.712688032.0000015BD0B40000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.752259578.0000028532C80000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 0000000A.00000002.712688032.0000015BD0B40000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.752259578.0000028532C80000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 0000000A.00000002.712688032.0000015BD0B40000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.752259578.0000028532C80000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 0000000A.00000002.712688032.0000015BD0B40000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.752259578.0000028532C80000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Thread information set: HideFromDebugger Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process token adjusted: Debug Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\taskhostw.exe taskhostw.exe None Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1 Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Queries volume information: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\f908098a_by_Libranalysis.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY
Source: Yara match File source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: f908098a_by_Libranalysis.exe, 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: f908098a_by_Libranalysis.exe, 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Yara detected Nanocore RAT
Source: Yara match File source: 0000001F.00000002.746272772.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.708373051.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.721358453.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.727791408.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.748683152.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.701491869.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.703895880.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.762072262.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.711316230.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.736073940.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.730062781.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.725332154.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.757220871.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.714383017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.699198660.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.845726341.00000000071B2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805194004.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.716772680.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.706079579.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.891871365.0000000004ACD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.718926424.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.738600817.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.805655388.0000000005206000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.858964589.0000000004B49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.818065172.0000000007C37000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.814590016.0000000007237000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7124, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5936, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 2912, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 5920, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6208, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6652, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 7088, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 4824, type: MEMORY
Source: Yara match File source: Process Memory Space: f908098a_by_Libranalysis.exe PID: 6268, type: MEMORY
Source: Yara match File source: 22.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 39.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.f908098a_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 403331 Sample: f908098a_by_Libranalysis Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 25 Found malware configuration 2->25 27 Malicious sample detected (through community Yara rule) 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 6 other signatures 2->31 7 f908098a_by_Libranalysis.exe 3 2->7         started        process3 dnsIp4 23 192.168.2.1 unknown unknown 7->23 33 Hides threads from debuggers 7->33 35 Potential time zone aware malware 7->35 11 cmd.exe 1 7->11         started        13 svchost.exe 1 7->13         started        15 svchost.exe 1 7->15         started        17 29 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 timeout.exe 1 11->21         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
192.168.2.1

Contacted URLs

Name Malicious Antivirus Detection Reputation
fedex.itemdb.com true
  • 3%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
uspslabel.itemdb.com true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown