Analysis Report QwUl4FaToe.exe

Overview

General Information

Sample Name:	QwUl4FaToe.exe
Analysis ID:	411368
MD5:	f5a572c1cff5536bef9519979cf2ac9b
SHA1:	8c3b72b66d2afb2a0cf9921948ad28519ad38d42
SHA256:	809faef964e5b1e958fadd4f04781f8f02795a0836fb8e2cda60a7f369ecd6bc
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected AntiVM3

Yara detected Nanocore RAT

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Non Interactive PowerShell

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8807-1300-000c0a4c", "Group": "casio", "Domain1": "sonspices.ddns.net", "Domain2": "127.0.0.1", "Port": 8282, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "", "BackupDNSServer": ""}

Multi AV Scanner detection for domain / URL

Source: sonspices.ddns.net

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Metadefender: Detection: 44%	Perma Link
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe	Metadefender: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: QwUl4FaToe.exe	Virustotal: Detection: 52%	Perma Link
Source: QwUl4FaToe.exe	Metadefender: Detection: 44%	Perma Link
Source: QwUl4FaToe.exe	ReversingLabs: Detection: 60%

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.850534083.0000000002F01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY
Source: Yara match	File source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f4ff64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f4ff64.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f5458d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.dhcpmon.exe.4453c98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QwUl4FaToe.exe.3f53c98.2.raw.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 30.2.dhcpmon.exe.400000.0.unpack

Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Source: QwUl4FaToe.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: QwUl4FaToe.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Administrator\Desktop\Client\Temp\dQmyaRXYES\src\obj\Debug\ICustomAdapter.pdb source: QwUl4FaToe.exe, dhcpmon.exe

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0DA4EB70
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0DA4EC9C
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0DA4EB60
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	17_2_0D6BDDA8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	17_2_0D6BDD9B
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	17_2_0D6BDED4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	17_2_0D6BF308
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	17_2_0D6BF273

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: sonspices.ddns.net
Source: Malware configuration extractor	URLs: 127.0.0.1

Uses dynamic DNS services

Source: unknown

DNS query: name: sonspices.ddns.net

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49743 -> 79.134.225.71:8282

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 79.134.225.71 79.134.225.71

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH

Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174
Source: unknown	UDP traffic detected without corresponding DNS query: 37.235.1.174

Source: unknown

DNS traffic detected: queries for: sonspices.ddns.net

Source: powershell.exe, 0000000A.00000003.871259726.00000000032B6000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.962116280.0000000007180000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000004.00000003.868385994.0000000008F1C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.m
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: powershell.exe, 0000000A.00000002.950176507.0000000005DB5000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.947787710.0000000004E8E000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.947787710.0000000004E8E000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.949325461.000000000425F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: QwUl4FaToe.exe, 00000000.00000002.681224194.0000000002E41000.00000004.00000001.sdmp, powershell.exe, 00000004.00000002.953578718.0000000004361000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.945723388.0000000004D51000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.821162047.0000000003341000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.948632179.0000000004121000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.947787710.0000000004E8E000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.949325461.000000000425F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: QwUl4FaToe.exe, QwUl4FaToe.exe, 00000000.00000000.646908576.0000000000A52000.00000002.00020000.sdmp, QwUl4FaToe.exe, 0000000C.00000000.672363062.0000000000962000.00000002.00020000.sdmp, dhcpmon.exe, dhcpmon.exe, 00000011.00000002.795136714.0000000000E22000.00000002.00020000.sdmp, dhcpmon.exe, 0000001E.00000002.835848860.00000000008A2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/Jamils_Good_Old_FunDataSet.xsd
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000A.00000002.947787710.0000000004E8E000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: QwUl4FaToe.exe, 00000000.00000003.653615010.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: QwUl4FaToe.exe, 00000000.00000003.675133849.0000000005EBA000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: QwUl4FaToe.exe, 00000000.00000003.675133849.0000000005EBA000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comt
Source: QwUl4FaToe.exe, 00000000.00000003.651049003.0000000005ECB000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: QwUl4FaToe.exe, 00000000.00000003.651097002.0000000005ECB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comic
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: QwUl4FaToe.exe, 00000000.00000003.652250741.0000000005EBE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cners
Source: QwUl4FaToe.exe, 00000000.00000003.652250741.0000000005EBE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnnte
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: QwUl4FaToe.exe, 00000000.00000003.653615010.0000000005EBC000.00000004.00000001.sdmp, QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: QwUl4FaToe.exe, 00000000.00000003.653615010.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/-
Source: QwUl4FaToe.exe, 00000000.00000003.654116446.0000000005EB9000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/K
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/R
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a-e
Source: QwUl4FaToe.exe, 00000000.00000003.654116446.0000000005EB9000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/h
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: QwUl4FaToe.exe, 00000000.00000003.653989051.0000000005EBC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/rpor
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: QwUl4FaToe.exe, 00000000.00000003.651227094.0000000005ECB000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comI
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: QwUl4FaToe.exe, 00000000.00000002.718419875.00000000070C2000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.878101141.0000000006310000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 0000000A.00000002.950176507.0000000005DB5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.950176507.0000000005DB5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.950176507.0000000005DB5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.947787710.0000000004E8E000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000003.878630905.0000000005701000.00000004.00000001.sdmp	String found in binary or memory: https://go.microd
Source: powershell.exe, 0000000A.00000002.950176507.0000000005DB5000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Source: dhcpmon.exe, 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.850534083.0000000002F01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY
Source: Yara match	File source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f4ff64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f4ff64.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f5458d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.dhcpmon.exe.4453c98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QwUl4FaToe.exe.3f53c98.2.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000002.850534083.0000000002F01000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.2.dhcpmon.exe.3f4ff64.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.2.dhcpmon.exe.2f69658.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.dhcpmon.exe.3f4ff64.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.dhcpmon.exe.3f5458d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.dhcpmon.exe.4453c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.dhcpmon.exe.4453c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Detected potential crypto function

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_014DC2B0	0_2_014DC2B0
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_014D9970	0_2_014D9970
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4DC30	0_2_0DA4DC30
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA46990	0_2_0DA46990
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA48AA8	0_2_0DA48AA8
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4AA10	0_2_0DA4AA10
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4B7E0	0_2_0DA4B7E0
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4B178	0_2_0DA4B178
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4F3E8	0_2_0DA4F3E8
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA47260	0_2_0DA47260
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4C816	0_2_0DA4C816
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4AA00	0_2_0DA4AA00
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4C5E8	0_2_0DA4C5E8
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4C5F8	0_2_0DA4C5F8
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4B7D1	0_2_0DA4B7D1
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4C7DA	0_2_0DA4C7DA
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA46648	0_2_0DA46648
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4B167	0_2_0DA4B167
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4C263	0_2_0DA4C263
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Code function: 0_2_0DA4C270	0_2_0DA4C270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_005591E0	4_2_005591E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0055D410	4_2_0055D410
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0055B5D8	4_2_0055B5D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0055F609	4_2_0055F609
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0055BB60	4_2_0055BB60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00555FC8	4_2_00555FC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0055B5D8	4_2_0055B5D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00559A10	4_2_00559A10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00557A30	4_2_00557A30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00557EA0	4_2_00557EA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00555FB7	4_2_00555FB7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_042F6970	4_2_042F6970
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0309C2A0	10_2_0309C2A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0309F770	10_2_0309F770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_03096A08	10_2_03096A08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_03099920	10_2_03099920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0309DE00	10_2_0309DE00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0309BD18	10_2_0309BD18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0309A150	10_2_0309A150
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_03098470	10_2_03098470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030969F8	10_2_030969F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030988E0	10_2_030988E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0309BD18	10_2_0309BD18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030AA380	10_2_030AA380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030AE2E8	10_2_030AE2E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030AFB50	10_2_030AFB50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030ABFB8	10_2_030ABFB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030E8F28	10_2_030E8F28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030EBD38	10_2_030EBD38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030E0040	10_2_030E0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030EBD38	10_2_030EBD38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030E96D8	10_2_030E96D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030EBD38	10_2_030EBD38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_077C8EB8	10_2_077C8EB8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_00E28E4F	17_2_00E28E4F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_01909970	17_2_01909970
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078FB5C8	17_2_078FB5C8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F6C30	17_2_078F6C30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F2688	17_2_078F2688
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F2681	17_2_078F2681
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F16A8	17_2_078F16A8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F16B8	17_2_078F16B8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F0E01	17_2_078F0E01
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F0E10	17_2_078F0E10
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F8660	17_2_078F8660
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F1489	17_2_078F1489
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F1498	17_2_078F1498
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F5CB0	17_2_078F5CB0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F6C20	17_2_078F6C20
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F5C71	17_2_078F5C71
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F7390	17_2_078F7390
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F73E0	17_2_078F73E0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F73F0	17_2_078F73F0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F1AE0	17_2_078F1AE0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F1AF0	17_2_078F1AF0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F0230	17_2_078F0230
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F0240	17_2_078F0240
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F70D8	17_2_078F70D8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F18E9	17_2_078F18E9
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F70E8	17_2_078F70E8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F18F8	17_2_078F18F8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F0007	17_2_078F0007
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F0040	17_2_078F0040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BCE60	17_2_0D6BCE60
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6B6990	17_2_0D6B6990
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BAA10	17_2_0D6BAA10
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6B8A88	17_2_0D6B8A88
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BE620	17_2_0D6BE620
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6B7260	17_2_0D6B7260
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BADF0	17_2_0D6BADF0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BB819	17_2_0D6BB819
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BBA46	17_2_0D6BBA46
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BBA0A	17_2_0D6BBA0A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BAA00	17_2_0D6BAA00
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BB48F	17_2_0D6BB48F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6B6648	17_2_0D6B6648
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0410AD78	28_2_0410AD78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0410AE03	28_2_0410AE03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07559A38	28_2_07559A38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755E3B8	28_2_0755E3B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755AD2A	28_2_0755AD2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755AD90	28_2_0755AD90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755AD80	28_2_0755AD80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755DB88	28_2_0755DB88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07598118	28_2_07598118
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07590040	28_2_07590040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07598118	28_2_07598118
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07590006	28_2_07590006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_04107692	28_2_04107692
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_041076A0	28_2_041076A0

Sample file is different than original file name gathered from version info

Source: QwUl4FaToe.exe, 00000000.00000002.675774715.0000000000B64000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameICustomAdapter.exed" vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 00000000.00000002.732214516.000000000D670000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 00000000.00000002.732214516.000000000D670000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 00000000.00000002.730773763.000000000D580000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 00000000.00000002.729604984.0000000007A80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 00000000.00000002.681224194.0000000002E41000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs QwUl4FaToe.exe
Source: QwUl4FaToe.exe, 0000000C.00000000.673587639.0000000000A74000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameICustomAdapter.exed" vs QwUl4FaToe.exe

Uses 32bit PE files

Source: QwUl4FaToe.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000002.850534083.0000000002F01000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.2.dhcpmon.exe.3f4ff64.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.dhcpmon.exe.3f4ff64.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.dhcpmon.exe.4453c98.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.2.dhcpmon.exe.2f69658.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.dhcpmon.exe.2f69658.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.2.dhcpmon.exe.3f4ff64.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.dhcpmon.exe.3f4ff64.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.2.dhcpmon.exe.3f5458d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.dhcpmon.exe.3f5458d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 30.2.dhcpmon.exe.3f4b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.dhcpmon.exe.4453c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.dhcpmon.exe.4453c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.QwUl4FaToe.exe.3f53c98.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: classification engine

Classification label: mal100.troj.evad.winEXE@27/21@17/3

Source: C:\Users\user\Desktop\QwUl4FaToe.exe

File created: C:\Program Files (x86)\DHCP Monitor

Source: C:\Users\user\Desktop\QwUl4FaToe.exe

File created: C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5716:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4664:120:WilError_01
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{5678add0-7d19-42b5-be56-0a8b3ab6f15f}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5068:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5380:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1836:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_01

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: unknown	Process created: C:\Users\user\Desktop\QwUl4FaToe.exe 'C:\Users\user\Desktop\QwUl4FaToe.exe'
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\QwUl4FaToe.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\JNJUIxHUzdwyw' /XML 'C:\Users\user\AppData\Local\Temp\tmp38D.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Users\user\Desktop\QwUl4FaToe.exe C:\Users\user\Desktop\QwUl4FaToe.exe
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\JNJUIxHUzdwyw' /XML 'C:\Users\user\AppData\Local\Temp\tmpD0C0.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\QwUl4FaToe.exe'	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe'	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\JNJUIxHUzdwyw' /XML 'C:\Users\user\AppData\Local\Temp\tmp38D.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe'	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process created: C:\Users\user\Desktop\QwUl4FaToe.exe C:\Users\user\Desktop\QwUl4FaToe.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\JNJUIxHUzdwyw' /XML 'C:\Users\user\AppData\Local\Temp\tmpD0C0.tmp'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0055E240 push es; ret	4_2_0055E250
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_005514F0 push esp; iretd	4_2_005514F1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_042F2045 push eax; iretd	4_2_042F2015
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_042F8B75 pushad ; iretd	4_2_042F8B83
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_042F7289 push cs; retn 5506h	4_2_042F72A6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_042F5CC0 push ss; retn 0006h	4_2_042F5CCA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_042FDB61 push es; ret	4_2_042FDB70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030A92A1 push eax; mov dword ptr [esp], ecx	10_2_030A92B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030A6147 push eax; mov dword ptr [esp], edx	10_2_030A615C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030A6158 push eax; mov dword ptr [esp], edx	10_2_030A615C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030A5C58 push eax; mov dword ptr [esp], edx	10_2_030A5C6C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030E6728 push ebp; ret	10_2_030E66D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030E66A0 push esp; ret	10_2_030E66B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_030E66C0 push ebp; ret	10_2_030E66D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_077CD5E8 pushad ; iretd	10_2_077CD5F5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F3D26 push ebx; retf	17_2_078F3D28
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_078F3880 push 0000004Dh; retf	17_2_078F3884
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 17_2_0D6BEA38 push eax; iretd	17_2_0D6BED45
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_041012A1 push es; ret	28_2_041012B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07551765 push esp; iretd	28_2_07551769
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_075515EC push FFFFFF8Bh; iretd	28_2_075515EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755FF62 push es; ret	28_2_0755FF70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0755FDDE push es; ret	28_2_0755FDE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_07551840 push FFFFFF8Bh; iretd	28_2_07551842
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_0759C150 push eax; mov dword ptr [esp], edx	28_2_0759C184

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	File created: C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe			Jump to dropped file
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe			Jump to dropped file

Source: Yara match	File source: 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5612, type: MEMORY

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: QwUl4FaToe.exe, 00000000.00000002.682085044.0000000002E8D000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3400	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3746	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4164	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2578	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4619	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2565	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Window / User API: threadDelayed 3095
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Window / User API: threadDelayed 6324
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Window / User API: foregroundWindowGot 598

Source: C:\Users\user\Desktop\QwUl4FaToe.exe TID: 6848	Thread sleep time: -102453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe TID: 6908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4632	Thread sleep count: 4164 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2740	Thread sleep count: 2578 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5548	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5648	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4488	Thread sleep count: 4619 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6276	Thread sleep count: 2565 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6564	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7132	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe TID: 6700	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4048	Thread sleep time: -103195s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6288	Thread sleep count: 62 > 30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1476	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Thread delayed: delay time: 102453	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 103195
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000004.00000003.936361447.0000000004B46000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.958789575.0000000004CEE000.00000004.00000001.sdmp	Binary or memory string: k:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: powershell.exe, 00000004.00000003.936361447.0000000004B46000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.958789575.0000000004CEE000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 00000011.00000002.821162047.0000000003341000.00000004.00000001.sdmp	Binary or memory string: k%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 00000011.00000002.822491830.000000000338D000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: dhcpmon.exe, 00000011.00000002.821162047.0000000003341000.00000004.00000001.sdmp	Binary or memory string: k"SOFTWARE\VMware, Inc.\VMware Tools
Source: QwUl4FaToe.exe, 0000000C.00000003.702148729.00000000011E9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QwUl4FaToe.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: powershell.exe, 00000004.00000002.952650186.0000000002DA0000.00000002.00000001.sdmp, powershell.exe, 0000001C.00000002.947889022.0000000002C10000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 00000004.00000002.952650186.0000000002DA0000.00000002.00000001.sdmp, powershell.exe, 0000001C.00000002.947889022.0000000002C10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000004.00000002.952650186.0000000002DA0000.00000002.00000001.sdmp, powershell.exe, 0000001C.00000002.947889022.0000000002C10000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: powershell.exe, 00000004.00000002.952650186.0000000002DA0000.00000002.00000001.sdmp, powershell.exe, 0000001C.00000002.947889022.0000000002C10000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: QwUl4FaToe.exe, 00000000.00000002.693953716.0000000003E49000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000011.00000002.840631275.0000000004349000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000001E.00000002.835080544.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000001E.00000002.852581570.0000000003F09000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Name	Malicious	Antivirus Detection	Reputation
sonspices.ddns.net	true	Avira URL Cloud: safe	unknown
127.0.0.1	true	Avira URL Cloud: safe	unknown

Analysis Report QwUl4FaToe.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

ID:	411368
Product:	CloudBasic
Start time:	20:33:19
Start date:	11.05.2021
Sample:	QwUl4FaToe.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	f5a572c1cff5536bef9519979cf2ac9b
SHA1:	8c3b72b66d2afb2a0cf9921948ad28519ad38d42
SHA256:	809faef964e5b1e958fadd4f04781f8f02795a0836fb8e2cda60a7f369ecd6bc
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	F5A572C1CFF5536BEF9519979CF2AC9B	8C3B72B66D2AFB2A0CF9921948AD28519AD38D42	809FAEF964E5B1E958FADD4F04781F8F02795A0836FB8E2CDA60A7F369ECD6BC
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QwUl4FaToe.exe.log	ASCII text, with CRLF line terminators	E5FA1A53BA6D70E18192AF6AF7CFDBFA	1C076481F11366751B8DA795C98A54DE8D1D82D5	1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log	ASCII text, with CRLF line terminators	E5FA1A53BA6D70E18192AF6AF7CFDBFA	1C076481F11366751B8DA795C98A54DE8D1D82D5	1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	67808DEFC823CC4DB95777A61A26D6C9	6CF5D43E9DD5FA4E417761679275F95714839BA8	A2426A2CB143DE75931C33B32C770B22493749B522896A8593A4F8842C7CAF7B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wockxhu.psb.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cyge3tr4.pu5.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dahoclsc.3gt.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fe1otdoo.dly.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rimiy031.vx4.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u33qkzew.4zr.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmp38D.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	2FA5861CB71CC8CDE2188F1BA09081FB	4BE9D909AEEF38D6394AF2D1B8098F9483D87FE5	2D6071775C8CAFE3D3E1960ADA8EE078F5243C945D1998970ED40FF43188C3AE
C:\Users\user\AppData\Local\Temp\tmpD0C0.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	2FA5861CB71CC8CDE2188F1BA09081FB	4BE9D909AEEF38D6394AF2D1B8098F9483D87FE5	2D6071775C8CAFE3D3E1960ADA8EE078F5243C945D1998970ED40FF43188C3AE
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	data	AF204FA6290FF2376D41B87771EB6F7D	72AF8D7E4EBFEB7584A9638EC262849BEFD022DD	490276FB91D192B2794DCE644C24615AC20C6E14621F213D69DF7C63473E3188
C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	F5A572C1CFF5536BEF9519979CF2AC9B	8C3B72B66D2AFB2A0CF9921948AD28519AD38D42	809FAEF964E5B1E958FADD4F04781F8F02795A0836FB8E2CDA60A7F369ECD6BC
C:\Users\user\AppData\Roaming\JNJUIxHUzdwyw.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20210511\PowerShell_transcript.065367.ILbmeA3M.20210511203423.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	5430586D02532637591CBEA37B0D75D3	B81A5E4D77C668FACFD5B604936234111DD2BBC8	705AA16F009633793C4A3586DE931F91F512E4077DD51270A16EB9E677F28826
C:\Users\user\Documents\20210511\PowerShell_transcript.065367.WpxYCarX.20210511203419.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	3F1AC74869722C771D2E0D19356CB80E	649283AB0E18E42BB01CBB80F5937E8C593EBA35	FA8113D05702976F4AE8A6CAE378349E1809C3C014021E8420BB7C6AF5730A51
C:\Users\user\Documents\20210511\PowerShell_transcript.065367._en8w0in.20210511203417.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	A4B5A86CCA9CBB88B0031B50B54B739F	782601E3906C480D3134A318261F6D9E777A095C	1FD8ECEAC82F64C94F4EEF90756991289AE21EB40E3277D69BB27CF960664759