Windows Analysis Report Contact00212399490.exe

Overview

General Information

Sample Name: Contact00212399490.exe
Analysis ID: 451970
MD5: a6bd3de048002bee7a8d973c887227d8
SHA1: 90cf93d93b141654a62ff3a3b6810faef2ff3d69
SHA256: 1e3539b9de51134004ff4bff43ab144e748a329265decf8421442cef3109210d
Tags: exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Nanocore Rat
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM3
Yara detected Nanocore RAT
.NET source code contains potential unpacker
.NET source code contains very large strings
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425327961.0000000004651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425228255.0000000003651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422686382.0000000004701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY
Source: Yara match File source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY
Antivirus or Machine Learning detection for unpacked file
Source: 18.2.Contact00212399490.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.2.Contact00212399490.exe.5f20000.8.unpack Avira: Label: TR/NanoCore.fadte
Source: 18.2.Contact00212399490.exe.4477b08.4.unpack Avira: Label: TR/NanoCore.fadte
Source: 32.2.Contact00212399490.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 33.2.dhcpmon.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

barindex
Uses 32bit PE files
Source: Contact00212399490.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\Contact00212399490.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: Contact00212399490.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: indows\symbols\dll\System.pdb source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: System.pdbM source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.pdb source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdbILE source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.pdb++X source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: indows\System.pdbpdbtem.pdbar source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: Contact00212399490.exe, 00000001.00000002.301522990.0000000001860000.00000002.00000001.sdmp, Contact00212399490.exe, 00000012.00000002.494518626.0000000005C30000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.406688308.0000000006860000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.418954402.0000000006440000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.422381656.00000000060F0000.00000002.00000001.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49724 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49727 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49737 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49743 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49744 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49745 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49746 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49749 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49751 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49752 -> 202.55.134.123:2017
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49753 -> 202.55.134.123:2017
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49724 -> 202.55.134.123:2017
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A2EA6 WSARecv, 18_2_017A2EA6
Source: unknown DNS traffic detected: queries for: hncbeyghfsbvcuabgsbncvzgaioiuyegdbhabbbw.ydns.eu
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Contact00212399490.exe, 00000001.00000003.219884312.0000000005B7D000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersv(W
Source: Contact00212399490.exe, 00000001.00000002.310521742.0000000005B70000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comu
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Contact00212399490.exe, 00000001.00000003.213381351.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com-
Source: Contact00212399490.exe, 00000001.00000003.213475793.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comcz
Source: Contact00212399490.exe, 00000001.00000003.213381351.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comnc
Source: Contact00212399490.exe, 00000001.00000003.215883816.0000000005B74000.00000004.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Contact00212399490.exe, 00000001.00000003.215883816.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Contact00212399490.exe, 00000001.00000003.215883816.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/yp
Source: Contact00212399490.exe, 00000001.00000003.215694432.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnLog
Source: Contact00212399490.exe, 00000001.00000003.215673684.0000000005BAD000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnh
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/eta
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/f
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/m
Source: Contact00212399490.exe, 00000001.00000003.217105531.0000000005B74000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: Contact00212399490.exe, 00000001.00000003.213559204.0000000005B8B000.00000004.00000001.sdmp, Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Contact00212399490.exe, 00000001.00000003.213559204.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.compor
Source: Contact00212399490.exe, 00000001.00000003.212968603.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.comt
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Contact00212399490.exe, 00000001.00000003.214876729.0000000005B79000.00000004.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Contact00212399490.exe, 00000001.00000003.214876729.0000000005B79000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krW
Source: Contact00212399490.exe, 00000001.00000003.214876729.0000000005B79000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krndor
Source: dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Contact00212399490.exe, 00000001.00000003.214146485.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com$
Source: Contact00212399490.exe, 00000001.00000003.214146485.0000000005B8B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comh
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Contact00212399490.exe, 00000001.00000003.219213854.0000000005B78000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.de
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Contact00212399490.exe, 00000001.00000002.311536637.0000000005CE0000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.402463014.0000000005330000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.415768184.0000000004F00000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.418372960.0000000004F90000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: dhcpmon.exe, 00000018.00000002.403706627.00000000008F8000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Installs a raw input device (often for capturing keystrokes)
Source: Contact00212399490.exe, 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425327961.0000000004651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425228255.0000000003651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422686382.0000000004701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY
Source: Yara match File source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.Contact00212399490.exe.3421280.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.2.dhcpmon.exe.3723ac8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.2d13980.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.Contact00212399490.exe.5c90000.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.425327961.0000000004651000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.425228255.0000000003651000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000021.00000002.422686382.0000000004701000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.494575561.0000000005C90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
.NET source code contains very large strings
Source: Contact00212399490.exe, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 1.2.Contact00212399490.exe.e80000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 1.0.Contact00212399490.exe.e80000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 17.2.Contact00212399490.exe.2e0000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 17.0.Contact00212399490.exe.2e0000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: dhcpmon.exe.18.dr, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 18.0.Contact00212399490.exe.b50000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 18.2.Contact00212399490.exe.b50000.1.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 23.0.Contact00212399490.exe.4e0000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Source: 23.2.Contact00212399490.exe.4e0000.0.unpack, uNotepad/CollectionToSort.cs Long String: Length: 32771
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A16DA NtQuerySystemInformation, 18_2_017A16DA
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A169F NtQuerySystemInformation, 18_2_017A169F
Detected potential crypto function
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03445B60 1_2_03445B60
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03443B68 1_2_03443B68
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03444370 1_2_03444370
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344B558 1_2_0344B558
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03440110 1_2_03440110
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03442598 1_2_03442598
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447DB8 1_2_03447DB8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03442C20 1_2_03442C20
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03444CE8 1_2_03444CE8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_034430B8 1_2_034430B8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03444360 1_2_03444360
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447BF9 1_2_03447BF9
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344A240 1_2_0344A240
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344CE61 1_2_0344CE61
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03445A70 1_2_03445A70
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344A230 1_2_0344A230
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447ED4 1_2_03447ED4
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03443AD8 1_2_03443AD8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447EF3 1_2_03447EF3
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344CEA0 1_2_0344CEA0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03443AAC 1_2_03443AAC
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344CEB0 1_2_0344CEB0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344B2B0 1_2_0344B2B0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447EB8 1_2_03447EB8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344B2B8 1_2_0344B2B8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03442548 1_2_03442548
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344B548 1_2_0344B548
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344010C 1_2_0344010C
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03449910 1_2_03449910
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03449920 1_2_03449920
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03442589 1_2_03442589
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447DB0 1_2_03447DB0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03448C68 1_2_03448C68
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447C08 1_2_03447C08
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344B808 1_2_0344B808
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344B818 1_2_0344B818
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447820 1_2_03447820
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03447830 1_2_03447830
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_034494C8 1_2_034494C8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03444CD8 1_2_03444CD8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_034430A8 1_2_034430A8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_03448CB8 1_2_03448CB8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_034494B8 1_2_034494B8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017389D8 18_2_017389D8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_01733850 18_2_01733850
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017323A0 18_2_017323A0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_01732FA8 18_2_01732FA8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_0173B2A8 18_2_0173B2A8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017395D8 18_2_017395D8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_0173306F 18_2_0173306F
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_0173969F 18_2_0173969F
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A15B60 23_2_02A15B60
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A14360 23_2_02A14360
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A13B68 23_2_02A13B68
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A130A8 23_2_02A130A8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A14CD8 23_2_02A14CD8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A12C10 23_2_02A12C10
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17DB7 23_2_02A17DB7
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A12598 23_2_02A12598
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A10110 23_2_02A10110
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1CEA0 23_2_02A1CEA0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A13AAC 23_2_02A13AAC
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1CEB0 23_2_02A1CEB0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1B2B0 23_2_02A1B2B0
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17EB8 23_2_02A17EB8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17EF3 23_2_02A17EF3
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17ED4 23_2_02A17ED4
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A13AD8 23_2_02A13AD8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1A230 23_2_02A1A230
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A15A70 23_2_02A15A70
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1A240 23_2_02A1A240
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17BF9 23_2_02A17BF9
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A194B8 23_2_02A194B8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A194C8 23_2_02A194C8
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17820 23_2_02A17820
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17830 23_2_02A17830
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A17C08 23_2_02A17C08
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1B808 23_2_02A1B808
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1B818 23_2_02A1B818
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A18C68 23_2_02A18C68
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A12589 23_2_02A12589
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A19920 23_2_02A19920
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1010C 23_2_02A1010C
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A19910 23_2_02A19910
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D3B68 24_2_025D3B68
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D5B60 24_2_025D5B60
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D4360 24_2_025D4360
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D2C10 24_2_025D2C10
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D4CD8 24_2_025D4CD8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D30A8 24_2_025D30A8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DB548 24_2_025DB548
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D0110 24_2_025D0110
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D2598 24_2_025D2598
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7DB0 24_2_025D7DB0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DA240 24_2_025DA240
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D5A70 24_2_025D5A70
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DA230 24_2_025DA230
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D3AD8 24_2_025D3AD8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7ED4 24_2_025D7ED4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7EF3 24_2_025D7EF3
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7EB8 24_2_025D7EB8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DCEB0 24_2_025DCEB0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DB2B0 24_2_025DB2B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D3AAC 24_2_025D3AAC
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DCEA0 24_2_025DCEA0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7BF9 24_2_025D7BF9
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D8C68 24_2_025D8C68
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DB818 24_2_025DB818
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7C08 24_2_025D7C08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DB808 24_2_025DB808
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7830 24_2_025D7830
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D7820 24_2_025D7820
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D94C8 24_2_025D94C8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D94B8 24_2_025D94B8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D9910 24_2_025D9910
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D0101 24_2_025D0101
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D9920 24_2_025D9920
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025D2589 24_2_025D2589
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B130A8 25_2_04B130A8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B14CD8 25_2_04B14CD8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B12C10 25_2_04B12C10
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17DB7 25_2_04B17DB7
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B12598 25_2_04B12598
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B10110 25_2_04B10110
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B14360 25_2_04B14360
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B15B60 25_2_04B15B60
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B13B68 25_2_04B13B68
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B194B8 25_2_04B194B8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B194C8 25_2_04B194C8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17830 25_2_04B17830
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17820 25_2_04B17820
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1B817 25_2_04B1B817
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1B818 25_2_04B1B818
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17C08 25_2_04B17C08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B18C68 25_2_04B18C68
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B12589 25_2_04B12589
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B19920 25_2_04B19920
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B19910 25_2_04B19910
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1010C 25_2_04B1010C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1CEB0 25_2_04B1CEB0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1B2B0 25_2_04B1B2B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17EB8 25_2_04B17EB8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1CEA0 25_2_04B1CEA0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B13AAC 25_2_04B13AAC
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17EF3 25_2_04B17EF3
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B15AFD 25_2_04B15AFD
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17ED4 25_2_04B17ED4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B13AD8 25_2_04B13AD8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1A230 25_2_04B1A230
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1A240 25_2_04B1A240
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B17BF9 25_2_04B17BF9
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B13B2A 25_2_04B13B2A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B15B49 25_2_04B15B49
PE file contains strange resources
Source: Contact00212399490.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.18.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Contact00212399490.exe, 00000001.00000002.321379414.00000000074E0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000001.00000000.211780664.0000000000FB3000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamerurpD.exe2 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000001.00000002.301522990.0000000001860000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000001.00000002.322118908.0000000008B70000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameResource_Meter.dll> vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000011.00000000.298347434.0000000000413000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamerurpD.exe2 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.486778537.00000000012AA000.00000004.00000020.sdmp Binary or memory string: OriginalFilenamemscorwks.dllT vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.492186132.0000000003411000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000003.308294812.0000000001331000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamerurpD.exe2 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.487995396.0000000001790000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.495580837.0000000006A80000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000012.00000002.494518626.0000000005C30000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000017.00000002.407222996.0000000007BE0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameResource_Meter.dll> vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000017.00000002.394897792.00000000040DC000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000017.00000002.406688308.0000000006860000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000017.00000002.386372991.0000000000613000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamerurpD.exe2 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000020.00000000.385765653.0000000000623000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamerurpD.exe2 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000020.00000002.410510544.0000000005020000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs Contact00212399490.exe
Source: Contact00212399490.exe, 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Contact00212399490.exe
Uses 32bit PE files
Source: Contact00212399490.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.Contact00212399490.exe.3421280.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.3421280.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.2.dhcpmon.exe.3723ac8.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.dhcpmon.exe.3723ac8.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.2d13980.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.Contact00212399490.exe.2d13980.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 18.2.Contact00212399490.exe.5c90000.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.Contact00212399490.exe.5c90000.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.425327961.0000000004651000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.425228255.0000000003651000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000021.00000002.422686382.0000000004701000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.494575561.0000000005C90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.494575561.0000000005C90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Contact00212399490.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.18.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.evad.winEXE@20/9@12/2
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_077F0F52 AdjustTokenPrivileges, 1_2_077F0F52
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_077F0F1B AdjustTokenPrivileges, 1_2_077F0F1B
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A149A AdjustTokenPrivileges, 18_2_017A149A
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A1463 AdjustTokenPrivileges, 18_2_017A1463
Source: C:\Users\user\Desktop\Contact00212399490.exe File created: C:\Program Files (x86)\DHCP Monitor Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Contact00212399490.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_01
Source: C:\Users\user\Desktop\Contact00212399490.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6396:120:WilError_01
Source: C:\Users\user\Desktop\Contact00212399490.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{238a496b-ffb2-448a-bc1f-f27aa51697ac}
Source: C:\Users\user\Desktop\Contact00212399490.exe File created: C:\Users\user\AppData\Local\Temp\tmp203E.tmp Jump to behavior
Source: Contact00212399490.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe File read: C:\Users\user\Desktop\Contact00212399490.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Contact00212399490.exe 'C:\Users\user\Desktop\Contact00212399490.exe'
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path}
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path}
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp203E.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp23F8.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\Desktop\Contact00212399490.exe C:\Users\user\Desktop\Contact00212399490.exe 0
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp203E.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp23F8.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll Jump to behavior
Source: Contact00212399490.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Contact00212399490.exe Static file information: File size 1249792 > 1048576
Source: C:\Users\user\Desktop\Contact00212399490.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: Contact00212399490.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: indows\symbols\dll\System.pdb source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: System.pdbM source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.pdb source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdbILE source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.pdb++X source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: indows\System.pdbpdbtem.pdbar source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: System.pdb source: Contact00212399490.exe, 00000012.00000002.489301665.00000000030C5000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: Contact00212399490.exe, 00000001.00000002.301522990.0000000001860000.00000002.00000001.sdmp, Contact00212399490.exe, 00000012.00000002.494518626.0000000005C30000.00000002.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.406688308.0000000006860000.00000002.00000001.sdmp, dhcpmon.exe, 00000018.00000002.418954402.0000000006440000.00000002.00000001.sdmp, dhcpmon.exe, 00000019.00000002.422381656.00000000060F0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Contact00212399490.exe, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.Contact00212399490.exe.e80000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.Contact00212399490.exe.e80000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.2.Contact00212399490.exe.2e0000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.Contact00212399490.exe.2e0000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: dhcpmon.exe.18.dr, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.Contact00212399490.exe.b50000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.2.Contact00212399490.exe.b50000.1.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 23.0.Contact00212399490.exe.4e0000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 23.2.Contact00212399490.exe.4e0000.0.unpack, uNotepad/Form1.cs .Net Code: GGGGGGGGGGGGGGGGGGGG System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 1_2_0344CC68 push ds; ret 1_2_0344CC69
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 23_2_02A1CC68 push ds; ret 23_2_02A1CC69
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 24_2_025DCC68 push ds; ret 24_2_025DCC69
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 25_2_04B1CC68 push ds; ret 25_2_04B1CC69
Source: initial sample Static PE information: section name: .text entropy: 7.74858352039
Source: initial sample Static PE information: section name: .text entropy: 7.74858352039
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 18.2.Contact00212399490.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Contact00212399490.exe File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp203E.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Contact00212399490.exe File opened: C:\Users\user\Desktop\Contact00212399490.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Contact00212399490.exe PID: 6424, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6584, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Contact00212399490.exe, 00000001.00000002.302975646.00000000037F1000.00000004.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.389986355.0000000002DC1000.00000004.00000001.sdmp, dhcpmon.exe, 00000018.00000002.409362465.0000000002981000.00000004.00000001.sdmp, dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Contact00212399490.exe, 00000001.00000002.302975646.00000000037F1000.00000004.00000001.sdmp, Contact00212399490.exe, 00000017.00000002.389986355.0000000002DC1000.00000004.00000001.sdmp, dhcpmon.exe, 00000018.00000002.409362465.0000000002981000.00000004.00000001.sdmp, dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Contact00212399490.exe Window / User API: foregroundWindowGot 621 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 5724 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6476 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6476 Thread sleep count: 153 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6504 Thread sleep count: 31 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6476 Thread sleep count: 157 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6484 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6464 Thread sleep count: 45 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6464 Thread sleep time: -900000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6524 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6684 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6872 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe TID: 6336 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5932 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\Contact00212399490.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Contact00212399490.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A11C2 GetSystemInfo, 18_2_017A11C2
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Contact00212399490.exe, 00000012.00000002.495580837.0000000006A80000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: vmware
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Contact00212399490.exe, 00000012.00000002.495580837.0000000006A80000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Contact00212399490.exe, 00000012.00000002.495580837.0000000006A80000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Contact00212399490.exe, 00000012.00000002.486921214.000000000132C000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: dhcpmon.exe, 00000019.00000002.410902694.0000000002A51000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Contact00212399490.exe, 00000012.00000002.495580837.0000000006A80000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\Contact00212399490.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\Contact00212399490.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Contact00212399490.exe Memory written: C:\Users\user\Desktop\Contact00212399490.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Memory written: C:\Users\user\Desktop\Contact00212399490.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp203E.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp23F8.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Process created: C:\Users\user\Desktop\Contact00212399490.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: Contact00212399490.exe, 00000012.00000002.493112085.000000000355E000.00000004.00000001.sdmp Binary or memory string: Program Manager
Source: Contact00212399490.exe, 00000012.00000002.488469100.0000000001B60000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: Contact00212399490.exe, 00000012.00000002.488469100.0000000001B60000.00000002.00000001.sdmp Binary or memory string: Progman
Source: Contact00212399490.exe, 00000012.00000002.492590543.00000000034A0000.00000004.00000001.sdmp Binary or memory string: Program Manager0
Source: Contact00212399490.exe, 00000012.00000002.488469100.0000000001B60000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Contact00212399490.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425327961.0000000004651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425228255.0000000003651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422686382.0000000004701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY
Source: Yara match File source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: Contact00212399490.exe, 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Contact00212399490.exe, 00000012.00000002.492186132.0000000003411000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Contact00212399490.exe, 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Contact00212399490.exe, 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RAT
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d3eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.4477b08.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d39cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.447c131.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Contact00212399490.exe.4916d10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4749cd6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Contact00212399490.exe.5f24629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.4753135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.Contact00212399490.exe.3d43135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.dhcpmon.exe.3aa6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.dhcpmon.exe.474eb0c.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.Contact00212399490.exe.3ee6d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.dhcpmon.exe.3b76d10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.493564138.0000000004468000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422634506.0000000003701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.403561087.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.494730709.0000000005F20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.422426870.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.413945103.0000000003A36000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.411512020.0000000003966000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.391430185.0000000003DA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409908287.0000000002CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425327961.0000000004651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.409994109.0000000003CF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.481278156.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.417010887.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.307046969.00000000047D6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.425228255.0000000003651000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.422686382.0000000004701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6360, type: MEMORY
Source: Yara match File source: Process Memory Space: Contact00212399490.exe PID: 5276, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A29EA bind, 18_2_017A29EA
Source: C:\Users\user\Desktop\Contact00212399490.exe Code function: 18_2_017A2998 bind, 18_2_017A2998
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs