Windows Analysis Report
Divit-RekutPO260122.exe

Overview

General Information

Sample Name: Divit-RekutPO260122.exe
Analysis ID: 561090
MD5: 036f7890e6e19a1de41ea9c326f30742
SHA1: 3ecaf58fa2e994b2c389c184885eba0dfeda17ea
SHA256: 39896e26bce7833af0016124109693ed3ff222f2a6f2409bf8352533cfa9d304
Tags: exeNanoCoreRAT
Infos:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Detected Nanocore Rat
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Yara detected Costura Assembly Loader
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Sigma detected: Suspicious Svchost Process
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses dynamic DNS services
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Sigma detected: Autorun Keys Modification

Classification

AV Detection
barindex
Found malware configuration
Source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "60bf7181-21f3-44c6-a8b6-9af1ea9b", "Group": "RR", "Domain1": "renareport.duckdns.org", "Domain2": "", "Port": 7522, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 3979, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 29994, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}
Multi AV Scanner detection for submitted file
Source: Divit-RekutPO260122.exe Metadefender: Detection: 26% Perma Link
Source: Divit-RekutPO260122.exe ReversingLabs: Detection: 32%
Multi AV Scanner detection for domain / URL
Source: renareport.duckdns.org Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\sjndll.exe Metadefender: Detection: 26% Perma Link
Source: C:\Users\user\AppData\Local\sjndll.exe ReversingLabs: Detection: 32%
Yara detected Nanocore RAT
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR
Machine Learning detection for sample
Source: Divit-RekutPO260122.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\sjndll.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack Avira: Label: TR/NanoCore.fadte
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack Avira: Label: TR/Dropper.MSIL.Gen7

Compliance
barindex
Uses 32bit PE files
Source: Divit-RekutPO260122.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: Divit-RekutPO260122.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: protobuf-net.pdbSHA256 source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs:
Source: Malware configuration extractor URLs: renareport.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: renareport.duckdns.org
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: M247GB M247GB
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /attachments/935829381669081140/935832049175101510/pl33.png HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/935829381669081140/935832049175101510/pl33.png HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/935829381669081140/935832049175101510/pl33.png HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.130.233 162.159.130.233
Source: Joe Sandbox View IP Address: 162.159.130.233 162.159.130.233
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: sjndll.exe, 00000015.00000002.930643182.0000000001742000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Divit-RekutPO260122.exe, 00000000.00000002.812756048.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.930844103.0000000003281000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.930786347.00000000026E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Divit-RekutPO260122.exe, 00000000.00000002.812756048.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.930844103.0000000003281000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.930786347.00000000026E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com
Source: sjndll.exe, sjndll.exe, 0000001A.00000002.930786347.00000000026E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/935829381669081140/935832049175101510/pl33.png
Source: Divit-RekutPO260122.exe, sjndll.exe.0.dr String found in binary or memory: https://cdn.discordapp.com/attachments/935829381669081140/935832049175101510/pl33.png%Thwmyhrwxha.Cz
Source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: unknown DNS traffic detected: queries for: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /attachments/935829381669081140/935832049175101510/pl33.png HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/935829381669081140/935832049175101510/pl33.png HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/935829381669081140/935832049175101510/pl33.png HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49845 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: sjndll.exe, 00000015.00000002.930481901.00000000016CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Installs a raw input device (often for capturing keystrokes)
Source: Divit-RekutPO260122.exe, 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: RegisterRawInputDevices

E-Banking Fraud
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.3004f40.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.Divit-RekutPO260122.exe.5910000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.933086972.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.813412361.0000000002CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.813412361.0000000002CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Uses 32bit PE files
Source: Divit-RekutPO260122.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: Divit-RekutPO260122.exe, type: SAMPLE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 18.2.Divit-RekutPO260122.exe.3d0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.Divit-RekutPO260122.exe.9c0000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.Divit-RekutPO260122.exe.9c0000.7.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 16.0.Divit-RekutPO260122.exe.1a0000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 18.0.Divit-RekutPO260122.exe.3d0000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 18.0.Divit-RekutPO260122.exe.3d0000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.2.Divit-RekutPO260122.exe.860000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 18.0.Divit-RekutPO260122.exe.3d0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.2.sjndll.exe.f20000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 26.0.sjndll.exe.430000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 26.2.sjndll.exe.430000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 16.0.Divit-RekutPO260122.exe.1a0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 16.2.Divit-RekutPO260122.exe.1a0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.Divit-RekutPO260122.exe.9c0000.5.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 18.0.Divit-RekutPO260122.exe.3d0000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.0.sjndll.exe.f20000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.3004f40.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.3004f40.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.Divit-RekutPO260122.exe.9c0000.11.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.Divit-RekutPO260122.exe.9c0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.Divit-RekutPO260122.exe.9c0000.13.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.9c0000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.2d1a0c4.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 16.0.Divit-RekutPO260122.exe.1a0000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.Divit-RekutPO260122.exe.9c0000.9.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.5910000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.5910000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.9c0000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.0.Divit-RekutPO260122.exe.860000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.Divit-RekutPO260122.exe.9c0000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 16.0.Divit-RekutPO260122.exe.1a0000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.933086972.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.933086972.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.813412361.0000000002CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.813412361.0000000002CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: C:\Users\user\AppData\Local\sjndll.exe, type: DROPPED Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Detected potential crypto function
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE138A 0_2_02AE138A
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE83D0 0_2_02AE83D0
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AEB040 0_2_02AEB040
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE2130 0_2_02AE2130
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AEE168 0_2_02AEE168
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AEB7D8 0_2_02AEB7D8
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AECA18 0_2_02AECA18
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE1A75 0_2_02AE1A75
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE12A2 0_2_02AE12A2
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE21F2 0_2_02AE21F2
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE167A 0_2_02AE167A
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE8710 0_2_02AE8710
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE94C8 0_2_02AE94C8
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE25E1 0_2_02AE25E1
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AE1B66 0_2_02AE1B66
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AECCD0 0_2_02AECCD0
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_060D0338 0_2_060D0338
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_060E1018 0_2_060E1018
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_060EB908 0_2_060EB908
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_060E87C8 0_2_060E87C8
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_013AE471 19_2_013AE471
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_013AE480 19_2_013AE480
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_013ABBD4 19_2_013ABBD4
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_05416550 19_2_05416550
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541CF10 19_2_0541CF10
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_05413E30 19_2_05413E30
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_05414A50 19_2_05414A50
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541C2F8 19_2_0541C2F8
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541CFCE 19_2_0541CFCE
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_05414B08 19_2_05414B08
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159E168 21_2_0159E168
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_01592130 21_2_01592130
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159B009 21_2_0159B009
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_015983E0 21_2_015983E0
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159138A 21_2_0159138A
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159B7D8 21_2_0159B7D8
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_01591A75 21_2_01591A75
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159CA28 21_2_0159CA28
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_015921F2 21_2_015921F2
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_015912A2 21_2_015912A2
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_015925E1 21_2_015925E1
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_015994C8 21_2_015994C8
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_01598710 21_2_01598710
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159167A 21_2_0159167A
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_01591B66 21_2_01591B66
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_0159CCC1 21_2_0159CCC1
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_067B0338 21_2_067B0338
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_067C100F 21_2_067C100F
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 21_2_067C85A8 21_2_067C85A8
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_026683D0 26_2_026683D0
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266138A 26_2_0266138A
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266B040 26_2_0266B040
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266E168 26_2_0266E168
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_02662130 26_2_02662130
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266B7D8 26_2_0266B7D8
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_02661A75 26_2_02661A75
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266CA18 26_2_0266CA18
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_026612A2 26_2_026612A2
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_026621F2 26_2_026621F2
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266167A 26_2_0266167A
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_02668710 26_2_02668710
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_026694C8 26_2_026694C8
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_026625E1 26_2_026625E1
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_02661B66 26_2_02661B66
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266CCD0 26_2_0266CCD0
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CC0338 26_2_05CC0338
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD1018 26_2_05CD1018
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD8848 26_2_05CD8848
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD0FE7 26_2_05CD0FE7
Sample file is different than original file name gathered from version info
Source: Divit-RekutPO260122.exe Binary or memory string: OriginalFilename vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000000.00000000.662304048.0000000000862000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamepl33.exej% vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000000.00000002.815210338.0000000005E30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepl33.exej% vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe Binary or memory string: OriginalFilename vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000010.00000000.803204454.00000000001A2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamepl33.exej% vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe Binary or memory string: OriginalFilename vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000012.00000000.805227348.00000000003D2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamepl33.exej% vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe Binary or memory string: OriginalFilename vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.930126833.00000000009C2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamepl33.exej% vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.933450100.0000000006080000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe, 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Divit-RekutPO260122.exe
Source: Divit-RekutPO260122.exe Binary or memory string: OriginalFilenamepl33.exej% vs Divit-RekutPO260122.exe
PE file contains strange resources
Source: Divit-RekutPO260122.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sjndll.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Divit-RekutPO260122.exe Metadefender: Detection: 26%
Source: Divit-RekutPO260122.exe ReversingLabs: Detection: 32%
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File read: C:\Users\user\Desktop\Divit-RekutPO260122.exe Jump to behavior
Source: Divit-RekutPO260122.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe "C:\Users\user\Desktop\Divit-RekutPO260122.exe"
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe
Source: unknown Process created: C:\Users\user\AppData\Local\sjndll.exe "C:\Users\user\AppData\Local\sjndll.exe"
Source: C:\Users\user\AppData\Local\sjndll.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19
Source: unknown Process created: C:\Users\user\AppData\Local\sjndll.exe "C:\Users\user\AppData\Local\sjndll.exe"
Source: C:\Users\user\AppData\Local\sjndll.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19 Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19 Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File created: C:\Users\user\AppData\Local\sjndll.exe Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@25/4@6/5
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5996:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_01
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{60bf7181-21f3-44c6-a8b6-9af1ea9b5717}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_01
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Divit-RekutPO260122.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Divit-RekutPO260122.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: protobuf-net.pdbSHA256 source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Divit-RekutPO260122.exe, 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.813689766.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.816126312.0000000006060000.00000004.08000000.00040000.00000000.sdmp, Divit-RekutPO260122.exe, 00000000.00000002.814148995.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931178792.00000000042E9000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931785489.0000000006740000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 00000015.00000002.931298378.0000000004416000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931772258.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931156217.0000000003749000.00000004.00000800.00020000.00000000.sdmp, sjndll.exe, 0000001A.00000002.931272276.0000000003876000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected Costura Assembly Loader
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.6010000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.sjndll.exe.4e20000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.sjndll.exe.428b510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.sjndll.exe.36eb510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.sjndll.exe.66f0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.931135648.0000000004289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.931019614.00000000027FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.812852924.0000000002B57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.931442404.0000000004E20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.813168383.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.931109207.00000000036E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.931735113.00000000066F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.815822555.0000000006010000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.931053019.000000000339B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.930941643.00000000032CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.930886341.000000000272F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sjndll.exe PID: 4292, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sjndll.exe PID: 5296, type: MEMORYSTR
.NET source code contains potential unpacker
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AED4A7 push FFFFFF8Bh; ret 0_2_02AED4A9
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AED4E1 push FFFFFF8Bh; ret 0_2_02AED4E3
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_02AED4F8 push FFFFFF8Bh; iretd 0_2_02AED4FA
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_060E85A8 pushfd ; retn 060Bh 0_2_060E87C1
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 0_2_060E9CF2 pushfd ; iretd 0_2_060E9CF5
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541B369 push 8BB44589h; retf 19_2_0541B375
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541B321 push 8BB84589h; retf 19_2_0541B32D
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541B3AE push 8BB04589h; retf 19_2_0541B3BA
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541B2D8 push 8BBC4589h; retf 19_2_0541B2E5
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Code function: 19_2_0541B28C push 8BC04589h; retf 19_2_0541B29D
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266D61B push FFFFFF8Bh; iretd 26_2_0266D622
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266D4E0 push FFFFFF8Bh; ret 26_2_0266D4E3
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266D4F7 push FFFFFF8Bh; iretd 26_2_0266D4FA
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266F5C1 push eax; retf 26_2_0266F5CE
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266E8F7 push ecx; retf 26_2_0266E996
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_02666941 push ds; retf 26_2_02666956
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_0266E9C8 push eax; retf 26_2_0266E9D6
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_026669D1 push ds; retf 26_2_026669DE
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_02666998 push ds; retf 26_2_026669A6
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD7DE8 pushad ; retf 26_2_05CD7DF6
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD61F1 push ecx; retf 26_2_05CD61FE
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD65B0 push ecx; retf 26_2_05CD65BE
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD6500 push ecx; retf 26_2_05CD650E
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD50C0 push edi; retf 26_2_05CD50CE
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD00DA push eax; retf 26_2_05CD00E6
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD3058 push eax; retf 26_2_05CD3066
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD5878 push eax; retf 26_2_05CD5886
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD2FEF push edi; retf 26_2_05CD300E
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD5388 pushad ; retf 26_2_05CD5396
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD0A80 push eax; retf 26_2_05CD0A8E
Source: C:\Users\user\AppData\Local\sjndll.exe Code function: 26_2_05CD2E11 push edi; retf 26_2_05CD2E1E
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File created: C:\Users\user\AppData\Local\sjndll.exe Jump to dropped file
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run sjndll Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run sjndll Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe File opened: C:\Users\user\Desktop\Divit-RekutPO260122.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe TID: 5032 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe TID: 5032 Thread sleep time: -32000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe TID: 1664 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe TID: 5348 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5620 Thread sleep count: 155 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe TID: 7124 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 1740 Thread sleep count: 155 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 1316 Thread sleep count: 161 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\sjndll.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\sjndll.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Window / User API: threadDelayed 3828 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Window / User API: threadDelayed 5444 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Window / User API: foregroundWindowGot 363 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: sjndll.exe, 00000015.00000002.930643182.0000000001742000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging
barindex
Enables debug privileges
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Memory written: C:\Users\user\Desktop\Divit-RekutPO260122.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19 Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Process created: C:\Users\user\Desktop\Divit-RekutPO260122.exe C:\Users\user\Desktop\Divit-RekutPO260122.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19 Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19 Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C timeout 19 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 19
Source: Divit-RekutPO260122.exe, 00000013.00000002.931145447.0000000003109000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931719359.0000000003418000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931561353.0000000003394000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931587534.000000000339E000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.934139054.0000000006DED000.00000004.00000010.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931239837.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.933178414.0000000005F6B000.00000004.00000010.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931026159.000000000301B000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.933841136.000000000640D000.00000004.00000010.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.933570256.00000000061CD000.00000004.00000010.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931087204.000000000309D000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.933908407.000000000654C000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: Divit-RekutPO260122.exe, 00000013.00000002.931587534.000000000339E000.00000004.00000800.00020000.00000000.sdmp, Divit-RekutPO260122.exe, 00000013.00000002.931239837.00000000031E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager|$?

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Queries volume information: C:\Users\user\Desktop\Divit-RekutPO260122.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Queries volume information: C:\Users\user\Desktop\Divit-RekutPO260122.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Queries volume information: C:\Users\user\AppData\Local\sjndll.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\sjndll.exe Queries volume information: C:\Users\user\AppData\Local\sjndll.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Divit-RekutPO260122.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Nanocore Rat
Source: Divit-RekutPO260122.exe, 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000000.00000002.813412361.0000000002CCA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Divit-RekutPO260122.exe, 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Divit-RekutPO260122.exe, 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RAT
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6064629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e957f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.6060000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e1d7b8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.Divit-RekutPO260122.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.400458d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.Divit-RekutPO260122.exe.3ffff64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Divit-RekutPO260122.exe.3e457d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000013.00000002.933356197.0000000006060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809933277.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809640883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.809306152.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814640504.0000000003E95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.931764008.0000000003FF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930058666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.814433186.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.813620922.0000000003B19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.810262980.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.930968892.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 5940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Divit-RekutPO260122.exe PID: 3480, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 561090 Sample: Divit-RekutPO260122.exe Startdate: 27/01/2022 Architecture: WINDOWS Score: 100 61 Multi AV Scanner detection for domain / URL 2->61 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 10 other signatures 2->67 7 Divit-RekutPO260122.exe 16 6 2->7         started        12 sjndll.exe 14 3 2->12         started        14 sjndll.exe 3 2->14         started        process3 dnsIp4 53 cdn.discordapp.com 162.159.130.233, 443, 49775 CLOUDFLARENETUS United States 7->53 45 C:\Users\user\AppData\Local\sjndll.exe, PE32 7->45 dropped 47 C:\Users\user\...\sjndll.exe:Zone.Identifier, ASCII 7->47 dropped 49 C:\Users\user\...\Divit-RekutPO260122.exe.log, ASCII 7->49 dropped 71 Injects a PE file into a foreign processes 7->71 16 Divit-RekutPO260122.exe 6 7->16         started        21 cmd.exe 1 7->21         started        23 svchost.exe 1 7->23         started        29 2 other processes 7->29 55 162.159.129.233, 443, 49842 CLOUDFLARENETUS United States 12->55 73 Multi AV Scanner detection for dropped file 12->73 75 Machine Learning detection for dropped file 12->75 25 cmd.exe 1 12->25         started        57 162.159.134.233, 443, 49845 CLOUDFLARENETUS United States 14->57 59 192.168.2.1 unknown unknown 14->59 27 cmd.exe 14->27         started        file5 signatures6 process7 dnsIp8 51 renareport.duckdns.org 192.145.124.8, 7522 M247GB Romania 16->51 43 C:\Users\user\AppData\Roaming\...\run.dat, data 16->43 dropped 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->69 31 conhost.exe 21->31         started        33 timeout.exe 1 21->33         started        35 conhost.exe 25->35         started        37 timeout.exe 1 25->37         started        39 conhost.exe 27->39         started        41 timeout.exe 27->41         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.130.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false
192.145.124.8
 renareport.duckdns.org Romania
9009 M247GB true
162.159.129.233
 unknown United States
13335 CLOUDFLARENETUS false
162.159.134.233
 unknown United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
renareport.duckdns.org 192.145.124.8 true
cdn.discordapp.com 162.159.130.233 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
true
  • Avira URL Cloud: safe
 low
renareport.duckdns.org true
  • Avira URL Cloud: safe
 unknown
https://cdn.discordapp.com/attachments/935829381669081140/935832049175101510/pl33.png false
    		high