Windows Analysis Report #RFQ ORDER7678432213211.exe

Overview

General Information

Sample Name:	#RFQ ORDER7678432213211.exe
Analysis ID:	451085
MD5:	2f286cd817b368e8a747e8f0d8f28825
SHA1:	e49beec02d942e12b0dad74d81ab8ed4f02667e2
SHA256:	b291d719522053a662cadd70b131668a1d953d4c4dd648e8a5647b689eb6341d
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Defender Exclusion

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 00000012.00000002.490625846.0000000004081000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8807-1300-000c0a4c", "Group": "oluwa", "Domain1": "194.5.98.120", "Domain2": "joseedward5001.ddns.net", "Port": 1604, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe

ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Source: #RFQ ORDER7678432213211.exe

ReversingLabs: Detection: 13%

Yara detected Nanocore RAT

Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.5944629.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.408d071.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.477033384.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.493731765.0000000005940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.490625846.0000000004081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #RFQ ORDER7678432213211.exe PID: 1328, type: MEMORY

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: #RFQ ORDER7678432213211.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.unpack	Avira: Label: TR/NanoCore.fadte
Source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Source: #RFQ ORDER7678432213211.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: #RFQ ORDER7678432213211.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: mscorlib.pdb source: #RFQ ORDER7678432213211.exe, 00000012.00000002.483167361.000000000124C000.00000004.00000020.sdmp
Source:	Binary string: System.pdb source: #RFQ ORDER7678432213211.exe, 00000012.00000002.483005071.0000000001217000.00000004.00000020.sdmp

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]		18_2_0658AEB0
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]		18_2_0658AEA1

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49726 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49729 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49730 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49731 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49735 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49737 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49738 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49739 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49740 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49742 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49744 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49745 -> 194.5.98.120:1604
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49746 -> 194.5.98.120:1604

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 194.5.98.120
Source: Malware configuration extractor	URLs: joseedward5001.ddns.net

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49726 -> 194.5.98.120:1604

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: DANILENKODE DANILENKODE

Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.98.120

Source: powershell.exe, 0000000A.00000003.386127494.00000000076E4000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.424050500.0000000004F71000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.224155563.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: powershell.exe, 0000000A.00000003.386127494.00000000076E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.224155563.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.220096464.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.220096464.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.224155563.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.220096464.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comaV.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.224155563.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comasva
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.219670990.000000000564F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.215745931.0000000000DFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.215745931.0000000000DFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comd
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.215745931.0000000000DFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comp
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.222450009.0000000005677000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.222450009.0000000005677000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/W
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.223772397.000000000564C000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmI;
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218561472.0000000005649000.00000004.00000001.sdmp, #RFQ ORDER7678432213211.exe, 00000000.00000003.218259854.000000000564A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218089594.0000000005642000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//tr
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218359434.000000000564F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/2.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218359434.000000000564F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/O.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218089594.0000000005642000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218089594.0000000005642000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X7e
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218561472.0000000005649000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218561472.0000000005649000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-f
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218359434.000000000564F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c.U
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218561472.0000000005649000.00000004.00000001.sdmp, #RFQ ORDER7678432213211.exe, 00000000.00000003.218259854.000000000564A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218446869.0000000005646000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/O.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218561472.0000000005649000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/j.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218089594.0000000005642000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n-u
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218089594.0000000005642000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/rV.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218446869.0000000005646000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218359434.000000000564F000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/u.
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.218561472.0000000005649000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: #RFQ ORDER7678432213211.exe, 00000000.00000003.217505680.0000000005654000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: powershell.exe, 0000000A.00000003.386127494.00000000076E4000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000003.389513372.0000000005A9B000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000003.395464833.00000000051BF000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.490625846.0000000004081000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.5944629.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.#RFQ ORDER7678432213211.exe.408d071.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.477033384.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.493731765.0000000005940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.490625846.0000000004081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #RFQ ORDER7678432213211.exe PID: 1328, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 18.2.#RFQ ORDER7678432213211.exe.6310000.19.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.57f0000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5830000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.6310000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.57e0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5810000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.584e8a4.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.#RFQ ORDER7678432213211.exe.5944629.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5840000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5800000.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5830000.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.57f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5844c9f.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5630000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5810000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.408d071.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5800000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.5840000.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.#RFQ ORDER7678432213211.exe.307f090.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.493425460.0000000005840000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.493258723.00000000057F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.493293452.0000000005800000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.494090628.0000000006310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.477033384.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.477033384.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.493236087.00000000057E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.493731765.0000000005940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.493399369.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.492994566.0000000005630000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.493334722.0000000005810000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: #RFQ ORDER7678432213211.exe PID: 1328, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: #RFQ ORDER7678432213211.exe PID: 1328, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: #RFQ ORDER7678432213211.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_00A531B8	18_2_00A531B8
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_00A52ADF	18_2_00A52ADF
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_0145E471	18_2_0145E471
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_0145E480	18_2_0145E480
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_0145BBD4	18_2_0145BBD4
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_06588030	18_2_06588030
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_06588C48	18_2_06588C48
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_06588D06	18_2_06588D06

Sample file is different than original file name gathered from version info

Source: #RFQ ORDER7678432213211.exe, 00000000.00000000.212779401.00000000002AC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSafeTypeNameParserHand.exeB vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.485095538.0000000003078000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.479636748.0000000000B5C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSafeTypeNameParserHand.exeB vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.494090628.0000000006310000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.493987708.00000000061E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.490625846.0000000004081000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.495135748.00000000070B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs #RFQ ORDER7678432213211.exe
Source: #RFQ ORDER7678432213211.exe	Binary or memory string: OriginalFilenameSafeTypeNameParserHand.exeB vs #RFQ ORDER7678432213211.exe

Uses 32bit PE files

Source: #RFQ ORDER7678432213211.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 18.2.#RFQ ORDER7678432213211.exe.6310000.19.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.6310000.19.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.57f0000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.57f0000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5830000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5830000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.6310000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.6310000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.57e0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.57e0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5810000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5810000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.584e8a4.13.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.584e8a4.13.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.#RFQ ORDER7678432213211.exe.5944629.16.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5944629.16.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5840000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5840000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5800000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5800000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5940000.17.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5830000.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5830000.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.57f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.57f0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5844c9f.14.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5844c9f.14.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5630000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5630000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.4088a48.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5810000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5810000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.408d071.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.408d071.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5800000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5800000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.5840000.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.5840000.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.#RFQ ORDER7678432213211.exe.307f090.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.#RFQ ORDER7678432213211.exe.307f090.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.493425460.0000000005840000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493425460.0000000005840000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.493258723.00000000057F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493258723.00000000057F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.493293452.0000000005800000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493293452.0000000005800000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.494090628.0000000006310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.494090628.0000000006310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.477033384.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.477033384.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.493236087.00000000057E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493236087.00000000057E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.493731765.0000000005940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493731765.0000000005940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.493399369.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493399369.0000000005830000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.492994566.0000000005630000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.492994566.0000000005630000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.493334722.0000000005810000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.493334722.0000000005810000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: #RFQ ORDER7678432213211.exe PID: 1328, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: #RFQ ORDER7678432213211.exe PID: 1328, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: #RFQ ORDER7678432213211.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XgPYsUfalKn.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/20@0/1

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe

File created: C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Mutant created: \Sessions\1\BaseNamedObjects\QlFZHJmmpieHYITog
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1844:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1532:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_01
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{bf74327b-790a-4b3b-9c77-a151927b7a0c}

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: unknown	Process created: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe 'C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe'
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe'
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XgPYsUfalKn' /XML 'C:\Users\user\AppData\Local\Temp\tmpFD92.tmp'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe'
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe'	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XgPYsUfalKn' /XML 'C:\Users\user\AppData\Local\Temp\tmpFD92.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe'	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process created: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_034A2118 push eax; mov dword ptr [esp], edx	8_2_034A2254
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_034A1C88 push eax; mov dword ptr [esp], edx	8_2_034A1C9C
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_0658C0E1 push es; retf	18_2_0658C1CC
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Code function: 18_2_0658C1CD push es; retf	18_2_0658C1D0

Source: initial sample	Static PE information: section name: .text entropy: 7.61140570465
Source: initial sample	Static PE information: section name: .text entropy: 7.61140570465

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4631	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2269	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4255	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2680	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5378
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3163
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Window / User API: threadDelayed 5367
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Window / User API: threadDelayed 4007
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Window / User API: foregroundWindowGot 639

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe TID: 3396	Thread sleep time: -41772s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe TID: 6136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7132	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3840	Thread sleep count: 4255 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep count: 2680 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5144	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6232	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe TID: 6292	Thread sleep time: -11068046444225724s >= -30000s

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Thread delayed: delay time: 41772	Jump to behavior
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000008.00000003.389081037.00000000059A8000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000003.394834074.00000000050CC000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.495135748.00000000070B0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: #RFQ ORDER7678432213211.exe	Binary or memory string: zE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD\|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg\|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e\|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ]tM5W\|Y5fY<YeDL[]nopgyMKX3QZ]tM5WzE[Ti4JD\|YJ]s]6e\|EIgmYpdl<nfoU[gz45eG<YeDPZeV]WerYHWsYZfGgmTWg4U3EzTqEqVWooe
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.483084169.000000000122D000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)Zs
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.495135748.00000000070B0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.495135748.00000000070B0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: powershell.exe, 00000008.00000003.389081037.00000000059A8000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000003.394834074.00000000050CC000.00000004.00000001.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.495135748.00000000070B0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\#RFQ ORDER7678432213211.exe	Process token adjusted: Debug

Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.489922128.00000000033F8000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.483819077.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.483819077.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.483819077.0000000001A10000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.485095538.0000000003078000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: #RFQ ORDER7678432213211.exe, 00000012.00000002.485095538.0000000003078000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Name	Malicious	Antivirus Detection	Reputation
194.5.98.120	true	Avira URL Cloud: safe	unknown
joseedward5001.ddns.net	true	Avira URL Cloud: safe	unknown

ID:	451085
Product:	CloudBasic
Start time:	08:12:09
Start date:	20.07.2021
Sample:	#RFQ ORDER7678432213211.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	2f286cd817b368e8a747e8f0d8f28825
SHA1:	e49beec02d942e12b0dad74d81ab8ed4f02667e2
SHA256:	b291d719522053a662cadd70b131668a1d953d4c4dd648e8a5647b689eb6341d
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#RFQ ORDER7678432213211.exe.log	ASCII text, with CRLF line terminators	E5FA1A53BA6D70E18192AF6AF7CFDBFA	1C076481F11366751B8DA795C98A54DE8D1D82D5	1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	8D5E194411E038C060288366D6766D3D	DC1A8229ED0B909042065EA69253E86E86D71C88	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	59B78DBBB727A10360D42CDD87E4F00B	93AAFD5EAAB8630C2C0414200107BBEE63CB0461	61E26BCF20A5A4285027EB793DFE60E6D960FEC1CF6988187DF2AFF5A8B0AEFF
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3lbm0dym.0pl.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bowk3z4.alr.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jkmlqmz3.kot.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbvx1mrl.nve.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mjdu1muo.pll.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwb0ckt4.xfw.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmpFD92.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	C4BC1F6430E99ECF81752591B68F61E4	EB94AEA189CE6B14A93DBCE1D95216E30C645DF4	2414C3BBC0BCEACEA13605FDF2BFC30407EDCA1966BC833EBAB1CE2FFF111DE2
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat	data	6D2C1BD8306716462108A6A3B4069F75	F46B24F6060F5F15F05CB3C1CFE633E349FFF316	861DDBD599B4033924CDE39DDA488C7F01F36734489859355F7F419AB75B31C0
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	Non-ISO extended-ASCII text, with no line terminators	F95935841A379CDF26C0AE3A4C0FBBE5	4C11219A155A69DD265A6DBC30B08D75675B88EC	6248547EF44A01CC92AEEF2DE7A5B1EDDEA0B48D03B1CB020F8087BE1ED22263
C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	2F286CD817B368E8A747E8F0D8F28825	E49BEEC02D942E12B0DAD74D81AB8ED4F02667E2	B291D719522053A662CADD70B131668A1D953D4C4DD648E8A5647B689EB6341D
C:\Users\user\AppData\Roaming\XgPYsUfalKn.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20210720\PowerShell_transcript.226546.QECk8fRN.20210720081336.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	74ECE1B3B7B74B56D45D0B249CEA1026	F3262670D2FF79491054B542E1F1FEEDA11795A8	8C4AE9368E03AEB005387E0ED70E0AF86619C35536D349E7982AC8C75700BC54
C:\Users\user\Documents\20210720\PowerShell_transcript.226546.u9dWU6FT.20210720081341.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	94A5AE9AD0D8454A4EF076656F8CD28C	121D585258DF4F2E7F6014EDAE62E7B3DBAB28D2	D772214C85FA0304F10BAE0A6EF2E121D0E178FBCF5D1D5E7E365121C1E0D09C
C:\Users\user\Documents\20210720\PowerShell_transcript.226546.xFvC9uuU.20210720081339.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	B31D920EEB8EE60422F11E5502682C2D	462C3BC549115DD38E47A26E1C7CEC05E57C46DF	EBDDFEE32AC4653F7D04B6ECA36895358930EE4540BDD228B033CA1C5D582449

Windows Analysis Report #RFQ ORDER7678432213211.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs