Play interactive tour

Edit tour

Windows Analysis Report yMI7.exe

Overview

General Information

Sample Name:	yMI7.exe
Analysis ID:	452025
MD5:	39121091956f8934b1c73041ee1cc90f
SHA1:	2d63ef96343bd4636ced243f81ce9cc361b28f74
SHA256:	9a2247160056d9a5de43a34672b7e1650402a8ec6f435f1ef0d07a5347907404
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Antivirus or Machine Learning detection for unpacked file

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

yMI7.exe (PID: 784 cmdline: 'C:\Users\user\Desktop\yMI7.exe' MD5: 39121091956F8934B1C73041EE1CC90F)

dhcpmon.exe (PID: 4188 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 39121091956F8934B1C73041EE1CC90F)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "1d151c9c-8c5a-49a2-b97c-b83e2e70", "Group": "Default", "Domain1": "marquinhos-36228.portmap.host", "Domain2": "127.0.0.1", "Port": 36228, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
yMI7.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
yMI7.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
yMI7.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
yMI7.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11555d:$a: NanoCore 0x1155b6:$a: NanoCore 0x1155f3:$a: NanoCore 0x11566c:$a: NanoCore 0x11e140:$a: NanoCore 0x11e165:$a: NanoCore 0x11e1be:$a: NanoCore 0x12e35b:$a: NanoCore 0x12e381:$a: NanoCore 0x12e3dd:$a: NanoCore 0x13f97b:$a: NanoCore 0x13f9a4:$a: NanoCore 0x14b71d:$a: NanoCore 0x14b746:$a: NanoCore 0x160bd4:$a: NanoCore 0x160be9:$a: NanoCore 0x160c1e:$a: NanoCore 0x188e3f:$a: NanoCore 0x188e57:$a: NanoCore 0x188e80:$a: NanoCore 0x198283:$a: NanoCore
00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x23ba3:$a: NanoCore 0x23bfc:$a: NanoCore 0x23c39:$a: NanoCore 0x23cb2:$a: NanoCore 0x2c9c2:$a: NanoCore 0x2c9e7:$a: NanoCore 0x2ca40:$a: NanoCore 0x3cc7f:$a: NanoCore 0x3cca5:$a: NanoCore 0x3cd01:$a: NanoCore 0x4e2f0:$a: NanoCore 0x4e319:$a: NanoCore 0x5a172:$a: NanoCore 0x5a19b:$a: NanoCore 0x65fb9:$a: NanoCore 0x65fd1:$a: NanoCore 0x65ff6:$a: NanoCore 0x23c05:$b: ClientPlugin 0x23c42:$b: ClientPlugin 0x24540:$b: ClientPlugin 0x2454d:$b: ClientPlugin
Process Memory Space: yMI7.exe PID: 784	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x11c3ed:$x1: NanoCore.ClientPluginHost 0x11c44e:$x2: IClientNetworkHost 0x121853:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x12f7c5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: yMI7.exe PID: 784	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: yMI7.exe PID: 784	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11bef2:$a: NanoCore 0x11bf0e:$a: NanoCore 0x11c069:$a: NanoCore 0x11c078:$a: NanoCore 0x11c351:$a: NanoCore 0x11c37d:$a: NanoCore 0x11c3ed:$a: NanoCore 0x12be2f:$a: NanoCore 0x12be41:$a: NanoCore 0x12be7d:$a: NanoCore 0x11bf99:$b: ClientPlugin 0x11c0c2:$b: ClientPlugin 0x11c386:$b: ClientPlugin 0x11c3f6:$b: ClientPlugin 0x12be4a:$b: ClientPlugin 0x12be86:$b: ClientPlugin 0x11c20f:$c: ProjectData 0x12bd7c:$c: ProjectData 0x11d34b:$d: DESCrypto 0x12c6da:$d: DESCrypto 0x1276d8:$e: KeepAlive
Process Memory Space: dhcpmon.exe PID: 4188	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf720:$x1: NanoCore.ClientPluginHost 0x18fe0:$x1: NanoCore.ClientPluginHost 0x47686:$x1: NanoCore.ClientPluginHost 0x4a453:$x1: NanoCore.ClientPluginHost 0x54d6d:$x1: NanoCore.ClientPluginHost 0x6850b:$x1: NanoCore.ClientPluginHost 0x74ce5:$x1: NanoCore.ClientPluginHost 0x7e7b0:$x1: NanoCore.ClientPluginHost 0xa1144:$x1: NanoCore.ClientPluginHost 0xafaff:$x1: NanoCore.ClientPluginHost 0xbef58:$x1: NanoCore.ClientPluginHost 0xe18cc:$x1: NanoCore.ClientPluginHost 0x102300:$x1: NanoCore.ClientPluginHost 0x10517c:$x1: NanoCore.ClientPluginHost 0x10fa9f:$x1: NanoCore.ClientPluginHost 0x123245:$x1: NanoCore.ClientPluginHost 0x12fa39:$x1: NanoCore.ClientPluginHost 0x136b91:$x1: NanoCore.ClientPluginHost 0xf297:$x2: IClientNetworkHost 0x19041:$x2: IClientNetworkHost 0x476ac:$x2: IClientNetworkHost
Process Memory Space: dhcpmon.exe PID: 4188	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 4188	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xbe84:$a: NanoCore 0xcddf:$a: NanoCore 0xeb8f:$a: NanoCore 0xecb8:$a: NanoCore 0xf720:$a: NanoCore 0x18ae5:$a: NanoCore 0x18b01:$a: NanoCore 0x18c5c:$a: NanoCore 0x18c6b:$a: NanoCore 0x18f44:$a: NanoCore 0x18f70:$a: NanoCore 0x18fe0:$a: NanoCore 0x28a22:$a: NanoCore 0x28a34:$a: NanoCore 0x28a70:$a: NanoCore 0x47578:$a: NanoCore 0x47619:$a: NanoCore 0x47686:$a: NanoCore 0x47747:$a: NanoCore 0x48618:$a: NanoCore 0x4866b:$a: NanoCore
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.dhcpmon.exe.2e68e2c.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
5.2.dhcpmon.exe.2e68e2c.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
5.2.dhcpmon.exe.3f5a5aa.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
5.2.dhcpmon.exe.3f5a5aa.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
5.2.dhcpmon.exe.3f667dc.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
5.2.dhcpmon.exe.3f667dc.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
5.2.dhcpmon.exe.2e75100.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
5.2.dhcpmon.exe.2e75100.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
5.2.dhcpmon.exe.2e68e2c.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14e79:$x1: NanoCore.ClientPluginHost 0x264ed:$x1: NanoCore.ClientPluginHost 0x3236f:$x1: NanoCore.ClientPluginHost 0x3e1ca:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14ea6:$x2: IClientNetworkHost 0x26507:$x2: IClientNetworkHost 0x32389:$x2: IClientNetworkHost 0x3e207:$x2: IClientNetworkHost
5.2.dhcpmon.exe.2e68e2c.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x14e79:$x2: NanoCore.ClientPluginHost 0x264ed:$x2: NanoCore.ClientPluginHost 0x3236f:$x2: NanoCore.ClientPluginHost 0x3e1ca:$x2: NanoCore.ClientPluginHost 0x15e48:$s2: FileCommand 0x6a6b:$s4: PipeCreated 0x1a84a:$s4: PipeCreated 0x27522:$s4: PipeCreated 0x3411a:$s4: PipeCreated 0x4161d:$s4: PipeCreated 0x14e93:$s5: IClientLoggingHost 0x264da:$s5: IClientLoggingHost 0x3235c:$s5: IClientLoggingHost 0x3e1f4:$s5: IClientLoggingHost
0.0.yMI7.exe.ba0000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.yMI7.exe.ba0000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.0.yMI7.exe.ba0000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.yMI7.exe.ba0000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.dhcpmon.exe.2e75100.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x1a219:$x1: NanoCore.ClientPluginHost 0x2609b:$x1: NanoCore.ClientPluginHost 0x31ef6:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x1a233:$x2: IClientNetworkHost 0x260b5:$x2: IClientNetworkHost 0x31f33:$x2: IClientNetworkHost
5.2.dhcpmon.exe.2e75100.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x1a219:$x2: NanoCore.ClientPluginHost 0x2609b:$x2: NanoCore.ClientPluginHost 0x31ef6:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x1b24e:$s4: PipeCreated 0x27e46:$s4: PipeCreated 0x35349:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost 0x1a206:$s5: IClientLoggingHost 0x26088:$s5: IClientLoggingHost 0x31f20:$s5: IClientLoggingHost
5.2.dhcpmon.exe.2e63dc4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x9c23:$x1: NanoCore.ClientPluginHost 0x19ee1:$x1: NanoCore.ClientPluginHost 0x2b555:$x1: NanoCore.ClientPluginHost 0x373d7:$x1: NanoCore.ClientPluginHost 0x43232:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x9c4d:$x2: IClientNetworkHost 0x19f0e:$x2: IClientNetworkHost 0x2b56f:$x2: IClientNetworkHost 0x373f1:$x2: IClientNetworkHost 0x4326f:$x2: IClientNetworkHost
5.2.dhcpmon.exe.2e63dc4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x9c23:$x2: NanoCore.ClientPluginHost 0x19ee1:$x2: NanoCore.ClientPluginHost 0x2b555:$x2: NanoCore.ClientPluginHost 0x373d7:$x2: NanoCore.ClientPluginHost 0x43232:$x2: NanoCore.ClientPluginHost 0x1aeb0:$s2: FileCommand 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xbad3:$s4: PipeCreated 0x1f8b2:$s4: PipeCreated 0x2c58a:$s4: PipeCreated 0x39182:$s4: PipeCreated 0x46685:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x19efb:$s5: IClientLoggingHost 0x2b542:$s5: IClientLoggingHost 0x373c4:$s5: IClientLoggingHost 0x4325c:$s5: IClientLoggingHost
5.2.dhcpmon.exe.2e63dc4.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x9bfe:$a: NanoCore 0x9c23:$a: NanoCore 0x9c7c:$a: NanoCore 0x19ebb:$a: NanoCore 0x19ee1:$a: NanoCore 0x19f3d:$a: NanoCore 0x2b52c:$a: NanoCore 0x2b555:$a: NanoCore 0x373ae:$a: NanoCore 0x373d7:$a: NanoCore 0x431f5:$a: NanoCore 0x4320d:$a: NanoCore 0x43232:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin
5.2.dhcpmon.exe.720000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.dhcpmon.exe.720000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.2.dhcpmon.exe.720000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.dhcpmon.exe.720000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.0.dhcpmon.exe.720000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.0.dhcpmon.exe.720000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
5.0.dhcpmon.exe.720000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.0.dhcpmon.exe.720000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.dhcpmon.exe.3f667dc.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x1a1c8:$x1: NanoCore.ClientPluginHost 0x25f6a:$x1: NanoCore.ClientPluginHost 0x3b442:$x1: NanoCore.ClientPluginHost 0x636a4:$x1: NanoCore.ClientPluginHost 0x72ae4:$x1: NanoCore.ClientPluginHost 0x8a971:$x1: NanoCore.ClientPluginHost 0xb2bbf:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x1a1e2:$x2: IClientNetworkHost 0x25f84:$x2: IClientNetworkHost 0x3b46f:$x2: IClientNetworkHost 0x636be:$x2: IClientNetworkHost 0x72b21:$x2: IClientNetworkHost 0x8a99e:$x2: IClientNetworkHost 0xb2bd9:$x2: IClientNetworkHost
5.2.dhcpmon.exe.3f667dc.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14dd7:$x1: NanoCore.ClientPluginHost 0x263fa:$x1: NanoCore.ClientPluginHost 0x3219c:$x1: NanoCore.ClientPluginHost 0x47674:$x1: NanoCore.ClientPluginHost 0x6f8d6:$x1: NanoCore.ClientPluginHost 0x7ed16:$x1: NanoCore.ClientPluginHost 0x96ba3:$x1: NanoCore.ClientPluginHost 0xbedf1:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e04:$x2: IClientNetworkHost 0x26414:$x2: IClientNetworkHost 0x321b6:$x2: IClientNetworkHost 0x476a1:$x2: IClientNetworkHost 0x6f8f0:$x2: IClientNetworkHost 0x7ed53:$x2: IClientNetworkHost 0x96bd0:$x2: IClientNetworkHost 0xbee0b:$x2: IClientNetworkHost
5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.dhcpmon.exe.3f5577e.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x99e7:$x1: NanoCore.ClientPluginHost 0x19c03:$x1: NanoCore.ClientPluginHost 0x2b226:$x1: NanoCore.ClientPluginHost 0x36fc8:$x1: NanoCore.ClientPluginHost 0x4c4a0:$x1: NanoCore.ClientPluginHost 0x74702:$x1: NanoCore.ClientPluginHost 0x83b42:$x1: NanoCore.ClientPluginHost 0x9b9cf:$x1: NanoCore.ClientPluginHost 0xc3c1d:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x9a11:$x2: IClientNetworkHost 0x19c30:$x2: IClientNetworkHost 0x2b240:$x2: IClientNetworkHost 0x36fe2:$x2: IClientNetworkHost 0x4c4cd:$x2: IClientNetworkHost 0x7471c:$x2: IClientNetworkHost 0x83b7f:$x2: IClientNetworkHost 0x9b9fc:$x2: IClientNetworkHost 0xc3c37:$x2: IClientNetworkHost
5.2.dhcpmon.exe.3f5577e.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.dhcpmon.exe.3f5577e.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x99c2:$a: NanoCore 0x99e7:$a: NanoCore 0x9a40:$a: NanoCore 0x19bdd:$a: NanoCore 0x19c03:$a: NanoCore 0x19c5f:$a: NanoCore 0x2b1fd:$a: NanoCore 0x2b226:$a: NanoCore 0x36f9f:$a: NanoCore 0x36fc8:$a: NanoCore 0x4c456:$a: NanoCore 0x4c46b:$a: NanoCore 0x4c4a0:$a: NanoCore 0x746c1:$a: NanoCore 0x746d9:$a: NanoCore 0x74702:$a: NanoCore 0x83b05:$a: NanoCore
Click to see the 29 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\yMI7.exe, ProcessId: 784, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\yMI7.exe, ProcessId: 784, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\yMI7.exe, ProcessId: 784, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\yMI7.exe, ProcessId: 784, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: yMI7.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Avira: detection malicious, Label: TR/Dropper.MSIL.Gen7

Found malware configuration

Show sources

Source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "1d151c9c-8c5a-49a2-b97c-b83e2e70", "Group": "Default", "Domain1": "marquinhos-36228.portmap.host", "Domain2": "127.0.0.1", "Port": 36228, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Virustotal: Detection: 80%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: yMI7.exe

Virustotal: Detection: 80%

Perma Link

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: yMI7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f667dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED

Machine Learning detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: yMI7.exe

Joe Sandbox ML: detected

Source: 0.0.yMI7.exe.ba0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.2.dhcpmon.exe.720000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 5.0.dhcpmon.exe.720000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: yMI7.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: C:\Users\user\Desktop\yMI7.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: marquinhos-36228.portmap.host
Source: Malware configuration extractor	URLs: 127.0.0.1

Source: unknown

DNS traffic detected: query: marquinhos-36228.portmap.host replaycode: Name error (3)

Source: unknown

DNS traffic detected: queries for: marquinhos-36228.portmap.host

Source: dhcpmon.exe, 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: yMI7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f667dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: yMI7.exe, type: SAMPLE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: yMI7.exe, type: SAMPLE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.dhcpmon.exe.2e68e2c.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.3f5a5aa.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.3f667dc.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.2e75100.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.2e68e2c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.dhcpmon.exe.2e75100.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.2e63dc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.2e63dc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.dhcpmon.exe.3f667dc.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_0072524A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_02A623A0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_02A62FA8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_02A63850
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_02A6306F

Source: yMI7.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: yMI7.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: yMI7.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: yMI7.exe, type: SAMPLE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.dhcpmon.exe.2e68e2c.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.2e68e2c.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.3f5a5aa.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.3f5a5aa.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.3f667dc.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.3f667dc.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.2e75100.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.2e75100.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.2e68e2c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.2e68e2c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.dhcpmon.exe.2e75100.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.2e75100.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.2e63dc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.2e63dc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.2e63dc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.dhcpmon.exe.3f667dc.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: yMI7.exe	Static PE information: Section: .rsrc ZLIB complexity 0.999126519097
Source: dhcpmon.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999126519097

Source: yMI7.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: yMI7.exe, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: yMI7.exe, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: dhcpmon.exe.0.dr, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: dhcpmon.exe.0.dr, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: dhcpmon.exe.0.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: dhcpmon.exe.0.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: dhcpmon.exe.0.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.dhcpmon.exe.720000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.dhcpmon.exe.720000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.dhcpmon.exe.720000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.2.dhcpmon.exe.720000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: yMI7.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: yMI7.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/4@45/2

Source: C:\Users\user\Desktop\yMI7.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Users\user\Desktop\yMI7.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: C:\Users\user\Desktop\yMI7.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{1d151c9c-8c5a-49a2-b97c-b83e2e70c3df}
Source: C:\Users\user\Desktop\yMI7.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: yMI7.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yMI7.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\yMI7.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\yMI7.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll

Source: C:\Users\user\Desktop\yMI7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\yMI7.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\yMI7.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: yMI7.exe

Virustotal: Detection: 80%

Source: C:\Users\user\Desktop\yMI7.exe

File read: C:\Users\user\Desktop\yMI7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yMI7.exe 'C:\Users\user\Desktop\yMI7.exe'
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'

Source: C:\Users\user\Desktop\yMI7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Users\user\Desktop\yMI7.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: yMI7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\yMI7.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: yMI7.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: yMI7.exe, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: dhcpmon.exe.0.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: dhcpmon.exe.0.dr, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.dhcpmon.exe.720000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.dhcpmon.exe.720000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.dhcpmon.exe.720000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.dhcpmon.exe.720000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: yMI7.exe, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: yMI7.exe, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: dhcpmon.exe.0.dr, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: dhcpmon.exe.0.dr, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 0.0.yMI7.exe.ba0000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 5.2.dhcpmon.exe.720000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.2.dhcpmon.exe.720000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 5.0.dhcpmon.exe.720000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 5.0.dhcpmon.exe.720000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\yMI7.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\yMI7.exe

File opened: C:\Users\user\Desktop\yMI7.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\yMI7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\yMI7.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\yMI7.exe	Window / User API: threadDelayed 379
Source: C:\Users\user\Desktop\yMI7.exe	Window / User API: foregroundWindowGot 549
Source: C:\Users\user\Desktop\yMI7.exe	Window / User API: foregroundWindowGot 637

Source: C:\Users\user\Desktop\yMI7.exe TID: 5460	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\yMI7.exe TID: 5464	Thread sleep time: -220000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5076	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\yMI7.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\yMI7.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\yMI7.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\yMI7.exe

Memory allocated: page read and write | page guard

Source: yMI7.exe, 00000000.00000003.328170646.00000000060E4000.00000004.00000001.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\yMI7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: yMI7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f667dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: yMI7.exe, 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: yMI7.exe	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: yMI7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yMI7.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.dhcpmon.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f667dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5a5aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.3f5577e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yMI7.exe PID: 784, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4188, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection2	Masquerading2	Input Capture11	Security Software Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Remote Access Software1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection2	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing12	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yMI7.exe	80%	Virustotal		Browse
yMI7.exe	100%	Avira	TR/Dropper.MSIL.Gen7
yMI7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Avira	TR/Dropper.MSIL.Gen7
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	80%	Virustotal		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.yMI7.exe.ba0000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.2.dhcpmon.exe.720000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
5.0.dhcpmon.exe.720000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
marquinhos-36228.portmap.host	0%	Avira URL Cloud	safe
127.0.0.1	0%	Virustotal		Browse
127.0.0.1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
marquinhos-36228.portmap.host	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
marquinhos-36228.portmap.host	true	Avira URL Cloud: safe	unknown
127.0.0.1	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452025
Start date:	21.07.2021
Start time:	18:08:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	yMI7.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/4@45/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 13.88.21.125, 104.43.193.48, 23.54.113.53, 52.255.188.83, 13.64.90.137, 104.43.139.144, 20.50.102.62, 23.54.113.104, 40.112.88.60, 23.0.174.185, 23.0.174.200, 23.10.249.26, 23.10.249.43, 20.82.209.183 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:08:56	API Interceptor	1059x Sleep call for process: yMI7.exe modified
18:09:01	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\Desktop\yMI7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	486400
Entropy (8bit):	7.858767992660797
Encrypted:	false
SSDEEP:	12288:MLV6BtpmkSYu1kSk63qiwi1kdENzqCm1zTZsiqx60HidcAEx43y:+ApfSYu+r6YSkdE5mFTZ+Hq243y
MD5:	39121091956F8934B1C73041EE1CC90F
SHA1:	2D63EF96343BD4636CED243F81CE9CC361B28F74
SHA-256:	9A2247160056D9A5DE43A34672B7E1650402A8EC6F435F1EF0D07A5347907404
SHA-512:	83671F6DFFBB90B6DDBE7504E9805AA5A66E8FD8025B3B8C330A37CF342F845F880B0A9A6ED95BE70F1A5FE0994FD3B6A4E8C4BDBE59ADD0183DBAD95A7CE8FC
Malicious:	true
Yara Hits:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Joe Security Rule: NanoCore, Description: unknown, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 80%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.T................................. ........@.. ......................................................................8...W.... ............................................................................... ............... ..H............text........ ...................... ..`.reloc..............................@..B.rsrc........ ......................@..@................t.......H...........T............................................................0..Q........o5........o6....-.&......3+..+.... ....3......1..... 2.... ....3.... ............0..E.......s7....-(&s8....-&&s9....,$&s:........s;.............+.....+.....+.....0..........~....o<.....0..........~....o=.....0..........~....o>.....0..........~....o?.....0..........~....o@.....0.............-.&(A...&+...0..$.......~B........-.(...+.-.&+..B...+.~B....0.............-.&(A...&+...0..

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\yMI7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9tv:MLF20NaL329hJ5g522rWz2T
MD5:	61CCF53571C9ABA6511D696CB0D32E45
SHA1:	A13A42A20EC14942F52DB20FB16A0A520F8183CE
SHA-256:	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
SHA-512:	90E180D9A681F82C010C326456AC88EBB89256CC769E900BFB4B2DF92E69CA69726863B45DFE4627FC1EE8C281F2AF86A6A1E2EF1710094CCD3F4E092872F06F
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\yMI7.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:HiIp8t:LSt
MD5:	D968E8CAF6CE7C3F89D60D184D89ECCB
SHA1:	9EE5ADC2852A7FBF89475B4DA612C1F601B4FB99
SHA-256:	406646F65342BC1D184FB76057FDFC62ED701E62E2696709F5C249B720BED595
SHA-512:	88D7E0046B9D109DB70858AEC41F0971F9F0A80207539B6B51C4892971DC381F3F3E933A075D01F87B8C8F5B9736F6BE9749BF2BD27F58DD011BCCC9E4FC513B
Malicious:	true
Reputation:	low
Preview:	...G.L.H

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.858767992660797
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	yMI7.exe
File size:	486400
MD5:	39121091956f8934b1c73041ee1cc90f
SHA1:	2d63ef96343bd4636ced243f81ce9cc361b28f74
SHA256:	9a2247160056d9a5de43a34672b7e1650402a8ec6f435f1ef0d07a5347907404
SHA512:	83671f6dffbb90b6ddbe7504e9805aa5a66e8fd8025b3b8c330a37cf342f845f880b0a9a6ed95be70f1a5fe0994fd3b6a4e8c4bdbe59add0183dbad95a7ce8fc
SSDEEP:	12288:MLV6BtpmkSYu1kSk63qiwi1kdENzqCm1zTZsiqx60HidcAEx43y:+ApfSYu+r6YSkdE5mFTZ+Hq243y
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.T................................. ........@.. .....................................................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x41e792
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:
Time Stamp:	0x54E927A1 [Sun Feb 22 00:49:37 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e738	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x59e18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x20000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1c798	0x1c800	False	0.594503837719	data	6.59807609597	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.reloc	0x20000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x59e18	0x5a000	False	0.999126519097	data	7.99949505545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_RCDATA	0x22058	0x59dc0	TIM image, Pixel at (24880,47463) Size=10872x29692

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 21, 2021 18:08:49.408694029 CEST	50620	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:49.420985937 CEST	53	50620	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:50.391608953 CEST	64938	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:50.405205011 CEST	53	64938	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:51.168989897 CEST	60152	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:51.181888103 CEST	53	60152	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:51.276034117 CEST	57544	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:51.294008970 CEST	53	57544	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:54.078818083 CEST	55984	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:54.091849089 CEST	53	55984	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:55.552917004 CEST	64185	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:55.566559076 CEST	53	64185	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:56.566930056 CEST	65110	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:56.580017090 CEST	53	65110	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:57.596287966 CEST	58361	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:57.610011101 CEST	53	58361	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:58.682250023 CEST	63492	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:58.695177078 CEST	53	63492	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:59.154131889 CEST	60831	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:59.189044952 CEST	53	60831	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:59.234327078 CEST	60100	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:08:59.248064995 CEST	53	60100	8.8.4.4	192.168.2.3
Jul 21, 2021 18:08:59.265060902 CEST	53195	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:59.278369904 CEST	53	53195	8.8.8.8	192.168.2.3
Jul 21, 2021 18:08:59.733872890 CEST	50141	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:08:59.746829033 CEST	53	50141	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:00.741177082 CEST	53023	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:00.754364967 CEST	53	53023	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:01.548338890 CEST	49563	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:01.561408997 CEST	53	49563	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:02.602241993 CEST	51352	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:02.616133928 CEST	53	51352	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:03.390698910 CEST	59349	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:03.404673100 CEST	53	59349	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:03.433067083 CEST	57084	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:03.446898937 CEST	53	57084	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:03.454628944 CEST	58823	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:03.468732119 CEST	53	58823	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:03.602423906 CEST	57568	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:03.616652966 CEST	53	57568	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:04.627053022 CEST	50540	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:04.640058994 CEST	53	50540	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:05.747694016 CEST	54366	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:05.760886908 CEST	53	54366	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:06.598638058 CEST	53034	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:06.612566948 CEST	53	53034	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:07.420758963 CEST	57762	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:07.434305906 CEST	53	57762	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:07.606671095 CEST	55435	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:07.620855093 CEST	53	55435	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:07.711667061 CEST	50713	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:07.724493980 CEST	53	50713	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:07.798871040 CEST	56132	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:07.812117100 CEST	53	56132	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:24.302570105 CEST	58987	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:24.329488993 CEST	53	58987	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:25.309164047 CEST	56579	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:25.327780962 CEST	53	56579	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:27.610974073 CEST	60633	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:27.625359058 CEST	53	60633	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:27.628843069 CEST	61292	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:27.642312050 CEST	53	61292	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:27.827480078 CEST	63619	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:27.840261936 CEST	53	63619	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:31.936835051 CEST	64938	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:31.950519085 CEST	53	64938	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:31.953711987 CEST	61946	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:31.967222929 CEST	53	61946	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:31.975235939 CEST	64910	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:31.988960028 CEST	53	64910	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:36.034465075 CEST	52123	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:36.047396898 CEST	53	52123	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:36.050039053 CEST	56130	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:36.063028097 CEST	53	56130	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:36.069166899 CEST	56338	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:36.082801104 CEST	53	56338	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:42.004146099 CEST	59420	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:42.031419039 CEST	53	59420	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:44.504885912 CEST	58784	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:44.523040056 CEST	53	58784	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:55.256452084 CEST	63978	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:55.269335985 CEST	53	63978	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:55.300771952 CEST	62938	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:55.314256907 CEST	53	62938	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:55.320933104 CEST	55708	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:55.334157944 CEST	53	55708	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:58.610618114 CEST	56803	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:58.624608994 CEST	53	56803	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:59.371862888 CEST	57145	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:59.384891987 CEST	53	57145	8.8.8.8	192.168.2.3
Jul 21, 2021 18:09:59.523283958 CEST	55359	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:09:59.538171053 CEST	53	55359	8.8.4.4	192.168.2.3
Jul 21, 2021 18:09:59.544392109 CEST	58306	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:09:59.559184074 CEST	53	58306	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:02.013952971 CEST	64124	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:02.032975912 CEST	53	64124	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:03.617001057 CEST	49361	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:03.630134106 CEST	53	49361	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:03.718733072 CEST	63150	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:03.733841896 CEST	53	63150	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:03.884324074 CEST	53279	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:03.898324013 CEST	53	53279	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:23.072074890 CEST	56881	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:23.085443020 CEST	53	56881	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:23.088762999 CEST	53642	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:23.102976084 CEST	53	53642	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:23.119174957 CEST	55667	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:23.133109093 CEST	53	55667	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:27.210969925 CEST	54833	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:27.224175930 CEST	53	54833	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:27.227534056 CEST	62476	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:27.239530087 CEST	53	62476	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:27.246526957 CEST	49705	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:27.259665012 CEST	53	49705	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:31.314162016 CEST	61477	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:31.327352047 CEST	53	61477	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:31.333368063 CEST	61633	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:31.346574068 CEST	53	61633	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:31.361603975 CEST	55949	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:31.374669075 CEST	53	55949	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:33.304223061 CEST	57601	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:33.331764936 CEST	53	57601	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:34.556324959 CEST	49342	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:34.583259106 CEST	53	49342	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:50.875526905 CEST	56253	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:50.889142036 CEST	53	56253	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:50.915549994 CEST	49667	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:50.928364038 CEST	53	49667	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:50.934480906 CEST	55439	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:50.948419094 CEST	53	55439	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:54.999332905 CEST	57069	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:55.013149977 CEST	53	57069	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:55.019088030 CEST	57659	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:55.031843901 CEST	53	57659	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:55.068900108 CEST	54717	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:55.083175898 CEST	53	54717	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:59.121402979 CEST	63975	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:59.134984970 CEST	53	63975	8.8.8.8	192.168.2.3
Jul 21, 2021 18:10:59.137598991 CEST	56639	53	192.168.2.3	8.8.4.4
Jul 21, 2021 18:10:59.150541067 CEST	53	56639	8.8.4.4	192.168.2.3
Jul 21, 2021 18:10:59.164417982 CEST	51856	53	192.168.2.3	8.8.8.8
Jul 21, 2021 18:10:59.177824974 CEST	53	51856	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 21, 2021 18:08:59.154131889 CEST	192.168.2.3	8.8.8.8	0x7d2	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:08:59.234327078 CEST	192.168.2.3	8.8.4.4	0x9d21	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:08:59.265060902 CEST	192.168.2.3	8.8.8.8	0x65d	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:03.390698910 CEST	192.168.2.3	8.8.8.8	0xff3e	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:03.433067083 CEST	192.168.2.3	8.8.4.4	0x776	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:03.454628944 CEST	192.168.2.3	8.8.8.8	0xbfcc	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:07.606671095 CEST	192.168.2.3	8.8.8.8	0xe9c2	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:07.711667061 CEST	192.168.2.3	8.8.4.4	0x1659	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:07.798871040 CEST	192.168.2.3	8.8.8.8	0x2a7	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:27.610974073 CEST	192.168.2.3	8.8.8.8	0x4ee9	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:27.628843069 CEST	192.168.2.3	8.8.4.4	0x1d6e	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:27.827480078 CEST	192.168.2.3	8.8.8.8	0x7352	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:31.936835051 CEST	192.168.2.3	8.8.8.8	0x54b5	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:31.953711987 CEST	192.168.2.3	8.8.4.4	0x3d0e	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:31.975235939 CEST	192.168.2.3	8.8.8.8	0x1906	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:36.034465075 CEST	192.168.2.3	8.8.8.8	0x875	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:36.050039053 CEST	192.168.2.3	8.8.4.4	0xd11c	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:36.069166899 CEST	192.168.2.3	8.8.8.8	0xbff	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:55.256452084 CEST	192.168.2.3	8.8.8.8	0xea5	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:55.300771952 CEST	192.168.2.3	8.8.4.4	0xa266	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:55.320933104 CEST	192.168.2.3	8.8.8.8	0x2cc5	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:59.371862888 CEST	192.168.2.3	8.8.8.8	0x93ee	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:59.523283958 CEST	192.168.2.3	8.8.4.4	0x9120	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:59.544392109 CEST	192.168.2.3	8.8.8.8	0xb47d	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:03.617001057 CEST	192.168.2.3	8.8.8.8	0x61b	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:03.718733072 CEST	192.168.2.3	8.8.4.4	0xf2af	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:03.884324074 CEST	192.168.2.3	8.8.8.8	0xd41f	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:23.072074890 CEST	192.168.2.3	8.8.8.8	0xe1b4	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:23.088762999 CEST	192.168.2.3	8.8.4.4	0x802d	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:23.119174957 CEST	192.168.2.3	8.8.8.8	0x9fff	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:27.210969925 CEST	192.168.2.3	8.8.8.8	0x47c9	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:27.227534056 CEST	192.168.2.3	8.8.4.4	0xb168	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:27.246526957 CEST	192.168.2.3	8.8.8.8	0x735e	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:31.314162016 CEST	192.168.2.3	8.8.8.8	0x5f8f	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:31.333368063 CEST	192.168.2.3	8.8.4.4	0x9f83	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:31.361603975 CEST	192.168.2.3	8.8.8.8	0xa6d0	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:50.875526905 CEST	192.168.2.3	8.8.8.8	0xb830	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:50.915549994 CEST	192.168.2.3	8.8.4.4	0xef2a	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:50.934480906 CEST	192.168.2.3	8.8.8.8	0x3da4	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:54.999332905 CEST	192.168.2.3	8.8.8.8	0x5778	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:55.019088030 CEST	192.168.2.3	8.8.4.4	0x37c1	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:55.068900108 CEST	192.168.2.3	8.8.8.8	0xba8f	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:59.121402979 CEST	192.168.2.3	8.8.8.8	0x575b	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:59.137598991 CEST	192.168.2.3	8.8.4.4	0xe731	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:59.164417982 CEST	192.168.2.3	8.8.8.8	0x9055	Standard query (0)	marquinhos-36228.portmap.host	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 21, 2021 18:08:59.189044952 CEST	8.8.8.8	192.168.2.3	0x7d2	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:08:59.248064995 CEST	8.8.4.4	192.168.2.3	0x9d21	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:08:59.278369904 CEST	8.8.8.8	192.168.2.3	0x65d	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:03.404673100 CEST	8.8.8.8	192.168.2.3	0xff3e	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:03.446898937 CEST	8.8.4.4	192.168.2.3	0x776	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:03.468732119 CEST	8.8.8.8	192.168.2.3	0xbfcc	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:07.620855093 CEST	8.8.8.8	192.168.2.3	0xe9c2	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:07.724493980 CEST	8.8.4.4	192.168.2.3	0x1659	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:07.812117100 CEST	8.8.8.8	192.168.2.3	0x2a7	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:27.625359058 CEST	8.8.8.8	192.168.2.3	0x4ee9	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:27.642312050 CEST	8.8.4.4	192.168.2.3	0x1d6e	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:27.840261936 CEST	8.8.8.8	192.168.2.3	0x7352	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:31.950519085 CEST	8.8.8.8	192.168.2.3	0x54b5	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:31.967222929 CEST	8.8.4.4	192.168.2.3	0x3d0e	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:31.988960028 CEST	8.8.8.8	192.168.2.3	0x1906	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:36.047396898 CEST	8.8.8.8	192.168.2.3	0x875	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:36.063028097 CEST	8.8.4.4	192.168.2.3	0xd11c	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:36.082801104 CEST	8.8.8.8	192.168.2.3	0xbff	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:55.269335985 CEST	8.8.8.8	192.168.2.3	0xea5	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:55.314256907 CEST	8.8.4.4	192.168.2.3	0xa266	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:55.334157944 CEST	8.8.8.8	192.168.2.3	0x2cc5	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:59.384891987 CEST	8.8.8.8	192.168.2.3	0x93ee	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:59.538171053 CEST	8.8.4.4	192.168.2.3	0x9120	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:09:59.559184074 CEST	8.8.8.8	192.168.2.3	0xb47d	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:03.630134106 CEST	8.8.8.8	192.168.2.3	0x61b	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:03.733841896 CEST	8.8.4.4	192.168.2.3	0xf2af	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:03.898324013 CEST	8.8.8.8	192.168.2.3	0xd41f	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:23.085443020 CEST	8.8.8.8	192.168.2.3	0xe1b4	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:23.102976084 CEST	8.8.4.4	192.168.2.3	0x802d	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:23.133109093 CEST	8.8.8.8	192.168.2.3	0x9fff	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:27.224175930 CEST	8.8.8.8	192.168.2.3	0x47c9	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:27.239530087 CEST	8.8.4.4	192.168.2.3	0xb168	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:27.259665012 CEST	8.8.8.8	192.168.2.3	0x735e	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:31.327352047 CEST	8.8.8.8	192.168.2.3	0x5f8f	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:31.346574068 CEST	8.8.4.4	192.168.2.3	0x9f83	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:31.374669075 CEST	8.8.8.8	192.168.2.3	0xa6d0	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:50.889142036 CEST	8.8.8.8	192.168.2.3	0xb830	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:50.928364038 CEST	8.8.4.4	192.168.2.3	0xef2a	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:50.948419094 CEST	8.8.8.8	192.168.2.3	0x3da4	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:55.013149977 CEST	8.8.8.8	192.168.2.3	0x5778	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:55.031843901 CEST	8.8.4.4	192.168.2.3	0x37c1	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:55.083175898 CEST	8.8.8.8	192.168.2.3	0xba8f	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:59.134984970 CEST	8.8.8.8	192.168.2.3	0x575b	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:59.150541067 CEST	8.8.4.4	192.168.2.3	0xe731	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)
Jul 21, 2021 18:10:59.177824974 CEST	8.8.8.8	192.168.2.3	0x9055	Name error (3)	marquinhos-36228.portmap.host	none	none	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: yMI7.exe PID: 784 Parent PID: 5664

General

Start time:	18:08:55
Start date:	21/07/2021
Path:	C:\Users\user\Desktop\yMI7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\yMI7.exe'
Imagebase:	0xba0000
File size:	486400 bytes
MD5 hash:	39121091956F8934B1C73041EE1CC90F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000000.203043099.0000000000BA2000.00000002.00020000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 4188 Parent PID: 3388

General

Start time:	18:09:09
Start date:	21/07/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x720000
File size:	486400 bytes
MD5 hash:	39121091956F8934B1C73041EE1CC90F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000000.234012520.0000000000722000.00000002.00020000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.251432444.0000000000722000.00000002.00020000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.252582895.0000000003E41000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.252465646.0000000002E41000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Joe Security Rule: NanoCore, Description: unknown, Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 80%, Virustotal, Browse
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report yMI7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution