Edit tour

Windows Analysis Report
gruopon.exe

Overview

General Information

Sample Name:	gruopon.exe
Analysis ID:	561562
MD5:	40d8f956a39a697e1aa509efe0e167f5
SHA1:	45814f4a78c727a84c008232de7672461c3be706
SHA256:	c46ba296e23895758e7bf5c515e10784e317c4754d53d3c308e0b71110b861ad
Tags:	exe
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

gruopon.exe (PID: 5992 cmdline: "C:\Users\user\Desktop\gruopon.exe" MD5: 40D8F956A39A697E1AA509EFE0E167F5)

RegAsm.exe (PID: 6036 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cmd.exe (PID: 4628 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 4584 cmdline: schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4676 cmdline: cmd" /c copy "C:\Users\user\Desktop\gruopon.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

jsdudg.exe (PID: 3448 cmdline: C:\Users\user\AppData\Roaming\jsdudg.exe MD5: 40D8F956A39A697E1AA509EFE0E167F5)

RegAsm.exe (PID: 5684 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cmd.exe (PID: 3980 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5260 cmdline: schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5664 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

jsdudg.exe (PID: 6692 cmdline: C:\Users\user\AppData\Roaming\jsdudg.exe MD5: 40D8F956A39A697E1AA509EFE0E167F5)

RegAsm.exe (PID: 3900 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cmd.exe (PID: 6856 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6804 cmdline: schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 6900 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "efb71872-e607-4767-b940-43b2f1a4", "Group": "BACK UP", "Domain1": "20.91.192.34", "Domain2": "", "Port": 6422, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6b453:$a: NanoCore 0x6b4ac:$a: NanoCore 0x6b4e9:$a: NanoCore 0x6b562:$a: NanoCore 0x6b4b5:$b: ClientPlugin 0x6b4f2:$b: ClientPlugin 0x6bdf0:$b: ClientPlugin 0x6bdfd:$b: ClientPlugin 0x6109a:$e: KeepAlive 0x6b93d:$g: LogClientMessage 0x6b8bd:$i: get_Connected 0x5b889:$j: #=q 0x5b8b9:$j: #=q 0x5b8f5:$j: #=q 0x5b91d:$j: #=q 0x5b94d:$j: #=q 0x5b97d:$j: #=q 0x5b9ad:$j: #=q 0x5b9dd:$j: #=q 0x5b9f9:$j: #=q 0x5ba29:$j: #=q
00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xdc3cd:$x1: NanoCore.ClientPluginHost 0x10eded:$x1: NanoCore.ClientPluginHost 0x14160d:$x1: NanoCore.ClientPluginHost 0xdc40a:$x2: IClientNetworkHost 0x10ee2a:$x2: IClientNetworkHost 0x14164a:$x2: IClientNetworkHost 0xdff3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x11295d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x14517d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xdc135:$a: NanoCore 0xdc145:$a: NanoCore 0xdc379:$a: NanoCore 0xdc38d:$a: NanoCore 0xdc3cd:$a: NanoCore 0x10eb55:$a: NanoCore 0x10eb65:$a: NanoCore 0x10ed99:$a: NanoCore 0x10edad:$a: NanoCore 0x10eded:$a: NanoCore 0x141375:$a: NanoCore 0x141385:$a: NanoCore 0x1415b9:$a: NanoCore 0x1415cd:$a: NanoCore 0x14160d:$a: NanoCore 0xdc194:$b: ClientPlugin 0xdc396:$b: ClientPlugin 0xdc3d6:$b: ClientPlugin 0x10ebb4:$b: ClientPlugin 0x10edb6:$b: ClientPlugin 0x10edf6:$b: ClientPlugin
00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2efd:$a: NanoCore 0x2f56:$a: NanoCore 0x2f93:$a: NanoCore 0x300c:$a: NanoCore 0x166b7:$a: NanoCore 0x166cc:$a: NanoCore 0x16701:$a: NanoCore 0x2f16b:$a: NanoCore 0x2f180:$a: NanoCore 0x2f1b5:$a: NanoCore 0x2f5f:$b: ClientPlugin 0x2f9c:$b: ClientPlugin 0x389a:$b: ClientPlugin 0x38a7:$b: ClientPlugin 0x16473:$b: ClientPlugin 0x1648e:$b: ClientPlugin 0x164be:$b: ClientPlugin 0x166d5:$b: ClientPlugin 0x1670a:$b: ClientPlugin 0x2ef27:$b: ClientPlugin 0x2ef42:$b: ClientPlugin
00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42efd:$a: NanoCore 0x42f56:$a: NanoCore 0x42f93:$a: NanoCore 0x4300c:$a: NanoCore 0x566b7:$a: NanoCore 0x566cc:$a: NanoCore 0x56701:$a: NanoCore 0x6f16b:$a: NanoCore 0x6f180:$a: NanoCore 0x6f1b5:$a: NanoCore 0x42f5f:$b: ClientPlugin 0x42f9c:$b: ClientPlugin 0x4389a:$b: ClientPlugin 0x438a7:$b: ClientPlugin 0x56473:$b: ClientPlugin 0x5648e:$b: ClientPlugin 0x564be:$b: ClientPlugin 0x566d5:$b: ClientPlugin 0x5670a:$b: ClientPlugin 0x6ef27:$b: ClientPlugin 0x6ef42:$b: ClientPlugin
0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42efd:$a: NanoCore 0x42f56:$a: NanoCore 0x42f93:$a: NanoCore 0x4300c:$a: NanoCore 0x566b7:$a: NanoCore 0x566cc:$a: NanoCore 0x56701:$a: NanoCore 0x6f16b:$a: NanoCore 0x6f180:$a: NanoCore 0x6f1b5:$a: NanoCore 0x42f5f:$b: ClientPlugin 0x42f9c:$b: ClientPlugin 0x4389a:$b: ClientPlugin 0x438a7:$b: ClientPlugin 0x56473:$b: ClientPlugin 0x5648e:$b: ClientPlugin 0x564be:$b: ClientPlugin 0x566d5:$b: ClientPlugin 0x5670a:$b: ClientPlugin 0x6ef27:$b: ClientPlugin 0x6ef42:$b: ClientPlugin
00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xdc3cd:$x1: NanoCore.ClientPluginHost 0x10eded:$x1: NanoCore.ClientPluginHost 0x14160d:$x1: NanoCore.ClientPluginHost 0xdc40a:$x2: IClientNetworkHost 0x10ee2a:$x2: IClientNetworkHost 0x14164a:$x2: IClientNetworkHost 0xdff3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x11295d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x14517d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xdc135:$a: NanoCore 0xdc145:$a: NanoCore 0xdc379:$a: NanoCore 0xdc38d:$a: NanoCore 0xdc3cd:$a: NanoCore 0x10eb55:$a: NanoCore 0x10eb65:$a: NanoCore 0x10ed99:$a: NanoCore 0x10edad:$a: NanoCore 0x10eded:$a: NanoCore 0x141375:$a: NanoCore 0x141385:$a: NanoCore 0x1415b9:$a: NanoCore 0x1415cd:$a: NanoCore 0x14160d:$a: NanoCore 0xdc194:$b: ClientPlugin 0xdc396:$b: ClientPlugin 0xdc3d6:$b: ClientPlugin 0x10ebb4:$b: ClientPlugin 0x10edb6:$b: ClientPlugin 0x10edf6:$b: ClientPlugin
0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xdc3cd:$x1: NanoCore.ClientPluginHost 0x10eded:$x1: NanoCore.ClientPluginHost 0x14160d:$x1: NanoCore.ClientPluginHost 0xdc40a:$x2: IClientNetworkHost 0x10ee2a:$x2: IClientNetworkHost 0x14164a:$x2: IClientNetworkHost 0xdff3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x11295d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x14517d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xdc135:$a: NanoCore 0xdc145:$a: NanoCore 0xdc379:$a: NanoCore 0xdc38d:$a: NanoCore 0xdc3cd:$a: NanoCore 0x10eb55:$a: NanoCore 0x10eb65:$a: NanoCore 0x10ed99:$a: NanoCore 0x10edad:$a: NanoCore 0x10eded:$a: NanoCore 0x141375:$a: NanoCore 0x141385:$a: NanoCore 0x1415b9:$a: NanoCore 0x1415cd:$a: NanoCore 0x14160d:$a: NanoCore 0xdc194:$b: ClientPlugin 0xdc396:$b: ClientPlugin 0xdc3d6:$b: ClientPlugin 0x10ebb4:$b: ClientPlugin 0x10edb6:$b: ClientPlugin 0x10edf6:$b: ClientPlugin
0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6b453:$a: NanoCore 0x6b4ac:$a: NanoCore 0x6b4e9:$a: NanoCore 0x6b562:$a: NanoCore 0x6b4b5:$b: ClientPlugin 0x6b4f2:$b: ClientPlugin 0x6bdf0:$b: ClientPlugin 0x6bdfd:$b: ClientPlugin 0x6109a:$e: KeepAlive 0x6b93d:$g: LogClientMessage 0x6b8bd:$i: get_Connected 0x5b889:$j: #=q 0x5b8b9:$j: #=q 0x5b8f5:$j: #=q 0x5b91d:$j: #=q 0x5b94d:$j: #=q 0x5b97d:$j: #=q 0x5b9ad:$j: #=q 0x5b9dd:$j: #=q 0x5b9f9:$j: #=q 0x5ba29:$j: #=q
Process Memory Space: RegAsm.exe PID: 6036	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13c15:$x1: NanoCore.ClientPluginHost 0x4adfa:$x1: NanoCore.ClientPluginHost 0x7031e:$x1: NanoCore.ClientPluginHost 0x8d6fc:$x1: NanoCore.ClientPluginHost 0x13c52:$x2: IClientNetworkHost 0x4ae27:$x2: IClientNetworkHost 0x70338:$x2: IClientNetworkHost 0x8d716:$x2: IClientNetworkHost 0x17743:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x227c9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 6036	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6036	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x138e2:$a: NanoCore 0x138f2:$a: NanoCore 0x139b1:$a: NanoCore 0x139c0:$a: NanoCore 0x13bc1:$a: NanoCore 0x13bd5:$a: NanoCore 0x13c15:$a: NanoCore 0x1ee33:$a: NanoCore 0x1ee45:$a: NanoCore 0x1ee81:$a: NanoCore 0x2d083:$a: NanoCore 0x2d0de:$a: NanoCore 0x2d151:$a: NanoCore 0x4adb0:$a: NanoCore 0x4adc5:$a: NanoCore 0x4adfa:$a: NanoCore 0x4ff7c:$a: NanoCore 0x4ff8f:$a: NanoCore 0x4ffc1:$a: NanoCore 0x70288:$a: NanoCore 0x702e1:$a: NanoCore
Process Memory Space: RegAsm.exe PID: 5684	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1fe1:$x1: NanoCore.ClientPluginHost 0x30e4c:$x1: NanoCore.ClientPluginHost 0x33522:$x1: NanoCore.ClientPluginHost 0x201e:$x2: IClientNetworkHost 0x30e66:$x2: IClientNetworkHost 0x3353c:$x2: IClientNetworkHost 0x5b0f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10b95:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 5684	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 5684	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1cae:$a: NanoCore 0x1cbe:$a: NanoCore 0x1d7d:$a: NanoCore 0x1d8c:$a: NanoCore 0x1f8d:$a: NanoCore 0x1fa1:$a: NanoCore 0x1fe1:$a: NanoCore 0xd1ff:$a: NanoCore 0xd211:$a: NanoCore 0xd24d:$a: NanoCore 0x1b19c:$a: NanoCore 0x1b1f7:$a: NanoCore 0x1b26b:$a: NanoCore 0x30db6:$a: NanoCore 0x30e0f:$a: NanoCore 0x30e4c:$a: NanoCore 0x30ec5:$a: NanoCore 0x31653:$a: NanoCore 0x316a6:$a: NanoCore 0x316df:$a: NanoCore 0x31752:$a: NanoCore
Process Memory Space: RegAsm.exe PID: 3900	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x17653:$x1: NanoCore.ClientPluginHost 0x1986b:$x1: NanoCore.ClientPluginHost 0x32f1a:$x1: NanoCore.ClientPluginHost 0x1766d:$x2: IClientNetworkHost 0x198a8:$x2: IClientNetworkHost 0x32f34:$x2: IClientNetworkHost 0x1d399:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2841f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 3900	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 3900	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1869:$a: NanoCore 0x18c4:$a: NanoCore 0x1938:$a: NanoCore 0x175bd:$a: NanoCore 0x17616:$a: NanoCore 0x17653:$a: NanoCore 0x176cc:$a: NanoCore 0x17e5a:$a: NanoCore 0x17ead:$a: NanoCore 0x17ee6:$a: NanoCore 0x17f59:$a: NanoCore 0x18a35:$a: NanoCore 0x19538:$a: NanoCore 0x19548:$a: NanoCore 0x19607:$a: NanoCore 0x19616:$a: NanoCore 0x19817:$a: NanoCore 0x1982b:$a: NanoCore 0x1986b:$a: NanoCore 0x24a89:$a: NanoCore 0x24a9b:$a: NanoCore
Click to see the 73 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.0.RegAsm.exe.400000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
30.0.RegAsm.exe.400000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
30.0.RegAsm.exe.400000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
30.0.RegAsm.exe.400000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.0.RegAsm.exe.400000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
10.2.jsdudg.exe.37e5240.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x753cd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x7540a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x78f3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.jsdudg.exe.37e5240.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.jsdudg.exe.37e5240.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0x75135:$a: NanoCore 0x75145:$a: NanoCore 0x75379:$a: NanoCore 0x7538d:$a: NanoCore 0x753cd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin
30.0.RegAsm.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
30.0.RegAsm.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
30.0.RegAsm.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.0.RegAsm.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
30.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
30.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
30.0.RegAsm.exe.400000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.0.RegAsm.exe.400000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
28.2.jsdudg.exe.42f5240.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x753cd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x7540a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x78f3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
28.2.jsdudg.exe.42f5240.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.jsdudg.exe.42f5240.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0x75135:$a: NanoCore 0x75145:$a: NanoCore 0x75379:$a: NanoCore 0x7538d:$a: NanoCore 0x753cd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin
3.2.RegAsm.exe.58e0000.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
3.2.RegAsm.exe.58e0000.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
3.2.RegAsm.exe.3e9457d.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c38:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c65:$x2: IClientNetworkHost
3.2.RegAsm.exe.3e9457d.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c38:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d13:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c52:$s5: IClientLoggingHost
3.2.RegAsm.exe.3e9457d.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.28fb674.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.RegAsm.exe.28fb674.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.0.RegAsm.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
1.2.gruopon.exe.3737c60.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.gruopon.exe.3737c60.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.gruopon.exe.3737c60.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.3737c60.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
3.2.RegAsm.exe.3e8ff54.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28261:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x2828e:$x2: IClientNetworkHost
3.2.RegAsm.exe.3e8ff54.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28261:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2933c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2827b:$s5: IClientLoggingHost
3.2.RegAsm.exe.3e8ff54.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.3e8ff54.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
3.2.RegAsm.exe.3e8ff54.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
3.2.RegAsm.exe.3e8ff54.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.0.RegAsm.exe.400000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.2.RegAsm.exe.3e8b11e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d097:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0c4:$x2: IClientNetworkHost
3.2.RegAsm.exe.3e8b11e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d097:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e172:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0b1:$s5: IClientLoggingHost
3.2.RegAsm.exe.3e8b11e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.3e8b11e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d04d:$a: NanoCore 0x2d062:$a: NanoCore 0x2d097:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce09:$b: ClientPlugin 0x2ce24:$b: ClientPlugin
30.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
30.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
30.0.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.0.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
28.2.jsdudg.exe.42f5240.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
28.2.jsdudg.exe.42f5240.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
28.2.jsdudg.exe.42f5240.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.jsdudg.exe.42f5240.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
28.2.jsdudg.exe.4327c60.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
28.2.jsdudg.exe.4327c60.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
28.2.jsdudg.exe.4327c60.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.jsdudg.exe.4327c60.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
3.2.RegAsm.exe.2e9ff6c.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
1.2.gruopon.exe.3737c60.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x429ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x429ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.gruopon.exe.3737c60.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x42725:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x429ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x43fe6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x43fda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x44e8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ac42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x429d7:$s5: IClientLoggingHost
1.2.gruopon.exe.3737c60.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.3737c60.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42715:$a: NanoCore 0x42725:$a: NanoCore 0x42959:$a: NanoCore 0x4296d:$a: NanoCore 0x429ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42774:$b: ClientPlugin 0x42976:$b: ClientPlugin 0x429b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4289b:$c: ProjectData 0x10a82:$d: DESCrypto 0x432a2:$d: DESCrypto 0x1844e:$e: KeepAlive
10.2.jsdudg.exe.3817c60.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x429ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x429ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.jsdudg.exe.3817c60.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x42725:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x429ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x43fe6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x43fda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x44e8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ac42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x429d7:$s5: IClientLoggingHost
10.2.jsdudg.exe.3817c60.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.jsdudg.exe.3817c60.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42715:$a: NanoCore 0x42725:$a: NanoCore 0x42959:$a: NanoCore 0x4296d:$a: NanoCore 0x429ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42774:$b: ClientPlugin 0x42976:$b: ClientPlugin 0x429b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4289b:$c: ProjectData 0x10a82:$d: DESCrypto 0x432a2:$d: DESCrypto 0x1844e:$e: KeepAlive
10.2.jsdudg.exe.377f1d0.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x761fd:$x1: NanoCore.ClientPluginHost 0xa8c1d:$x1: NanoCore.ClientPluginHost 0xdb43d:$x1: NanoCore.ClientPluginHost 0x7623a:$x2: IClientNetworkHost 0xa8c5a:$x2: IClientNetworkHost 0xdb47a:$x2: IClientNetworkHost 0x79d6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac78d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xdefad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.jsdudg.exe.377f1d0.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.jsdudg.exe.377f1d0.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x75f65:$a: NanoCore 0x75f75:$a: NanoCore 0x761a9:$a: NanoCore 0x761bd:$a: NanoCore 0x761fd:$a: NanoCore 0xa8985:$a: NanoCore 0xa8995:$a: NanoCore 0xa8bc9:$a: NanoCore 0xa8bdd:$a: NanoCore 0xa8c1d:$a: NanoCore 0xdb1a5:$a: NanoCore 0xdb1b5:$a: NanoCore 0xdb3e9:$a: NanoCore 0xdb3fd:$a: NanoCore 0xdb43d:$a: NanoCore 0x75fc4:$b: ClientPlugin 0x761c6:$b: ClientPlugin 0x76206:$b: ClientPlugin 0xa89e4:$b: ClientPlugin 0xa8be6:$b: ClientPlugin 0xa8c26:$b: ClientPlugin
3.2.RegAsm.exe.6070000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
3.2.RegAsm.exe.6070000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
3.2.RegAsm.exe.6070000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.jsdudg.exe.37e5240.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.jsdudg.exe.37e5240.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
10.2.jsdudg.exe.37e5240.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.jsdudg.exe.37e5240.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
30.2.RegAsm.exe.323b674.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
30.2.RegAsm.exe.323b674.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
12.2.RegAsm.exe.38dff54.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegAsm.exe.38dff54.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.38dff54.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.3705240.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.gruopon.exe.3705240.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.gruopon.exe.3705240.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.3705240.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
3.2.RegAsm.exe.6074629.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
3.2.RegAsm.exe.6074629.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
3.2.RegAsm.exe.6074629.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.RegAsm.exe.6070000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
3.2.RegAsm.exe.6070000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
3.2.RegAsm.exe.6070000.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.2.RegAsm.exe.421ff54.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
30.2.RegAsm.exe.421ff54.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
30.2.RegAsm.exe.421ff54.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.2.RegAsm.exe.422457d.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c38:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c65:$x2: IClientNetworkHost
30.2.RegAsm.exe.422457d.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c38:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d13:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c52:$s5: IClientLoggingHost
30.2.RegAsm.exe.422457d.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.369f1d0.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x761fd:$x1: NanoCore.ClientPluginHost 0xa8c1d:$x1: NanoCore.ClientPluginHost 0xdb43d:$x1: NanoCore.ClientPluginHost 0x7623a:$x2: IClientNetworkHost 0xa8c5a:$x2: IClientNetworkHost 0xdb47a:$x2: IClientNetworkHost 0x79d6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac78d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xdefad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.gruopon.exe.369f1d0.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.369f1d0.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x75f65:$a: NanoCore 0x75f75:$a: NanoCore 0x761a9:$a: NanoCore 0x761bd:$a: NanoCore 0x761fd:$a: NanoCore 0xa8985:$a: NanoCore 0xa8995:$a: NanoCore 0xa8bc9:$a: NanoCore 0xa8bdd:$a: NanoCore 0xa8c1d:$a: NanoCore 0xdb1a5:$a: NanoCore 0xdb1b5:$a: NanoCore 0xdb3e9:$a: NanoCore 0xdb3fd:$a: NanoCore 0xdb43d:$a: NanoCore 0x75fc4:$b: ClientPlugin 0x761c6:$b: ClientPlugin 0x76206:$b: ClientPlugin 0xa89e4:$b: ClientPlugin 0xa8be6:$b: ClientPlugin 0xa8c26:$b: ClientPlugin
30.2.RegAsm.exe.421b11e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d097:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0c4:$x2: IClientNetworkHost
30.2.RegAsm.exe.421b11e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d097:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e172:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0b1:$s5: IClientLoggingHost
30.2.RegAsm.exe.421b11e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.2.RegAsm.exe.421b11e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d04d:$a: NanoCore 0x2d062:$a: NanoCore 0x2d097:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce09:$b: ClientPlugin 0x2ce24:$b: ClientPlugin
12.2.RegAsm.exe.38db11e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d097:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0c4:$x2: IClientNetworkHost
12.2.RegAsm.exe.38db11e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d097:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e172:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0b1:$s5: IClientLoggingHost
12.2.RegAsm.exe.38db11e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.38db11e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d04d:$a: NanoCore 0x2d062:$a: NanoCore 0x2d097:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce09:$b: ClientPlugin 0x2ce24:$b: ClientPlugin
10.2.jsdudg.exe.3817c60.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.jsdudg.exe.3817c60.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
10.2.jsdudg.exe.3817c60.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.jsdudg.exe.3817c60.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
30.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
30.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
30.0.RegAsm.exe.400000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.0.RegAsm.exe.400000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.38dff54.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28261:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x2828e:$x2: IClientNetworkHost
12.2.RegAsm.exe.38dff54.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28261:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2933c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2827b:$s5: IClientLoggingHost
12.2.RegAsm.exe.38dff54.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.38e457d.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c38:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c65:$x2: IClientNetworkHost
12.2.RegAsm.exe.38e457d.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c38:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d13:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c52:$s5: IClientLoggingHost
12.2.RegAsm.exe.38e457d.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.jsdudg.exe.4327c60.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x429ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x429ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
28.2.jsdudg.exe.4327c60.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x42725:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x429ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x43fe6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x43fda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x44e8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ac42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x429d7:$s5: IClientLoggingHost
28.2.jsdudg.exe.4327c60.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.jsdudg.exe.4327c60.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42715:$a: NanoCore 0x42725:$a: NanoCore 0x42959:$a: NanoCore 0x4296d:$a: NanoCore 0x429ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42774:$b: ClientPlugin 0x42976:$b: ClientPlugin 0x429b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4289b:$c: ProjectData 0x10a82:$d: DESCrypto 0x432a2:$d: DESCrypto 0x1844e:$e: KeepAlive
3.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
30.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
30.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
30.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
30.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
3.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
3.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
3.0.RegAsm.exe.400000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.0.RegAsm.exe.400000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
30.2.RegAsm.exe.421ff54.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28261:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x2828e:$x2: IClientNetworkHost
30.2.RegAsm.exe.421ff54.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28261:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2933c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2827b:$s5: IClientLoggingHost
30.2.RegAsm.exe.421ff54.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.3705240.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42bad:$x1: NanoCore.ClientPluginHost 0x753cd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42bea:$x2: IClientNetworkHost 0x7540a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4671d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x78f3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.gruopon.exe.3705240.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.gruopon.exe.3705240.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42915:$a: NanoCore 0x42925:$a: NanoCore 0x42b59:$a: NanoCore 0x42b6d:$a: NanoCore 0x42bad:$a: NanoCore 0x75135:$a: NanoCore 0x75145:$a: NanoCore 0x75379:$a: NanoCore 0x7538d:$a: NanoCore 0x753cd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42974:$b: ClientPlugin 0x42b76:$b: ClientPlugin 0x42bb6:$b: ClientPlugin
28.2.jsdudg.exe.428f1d0.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x761fd:$x1: NanoCore.ClientPluginHost 0xa8c1d:$x1: NanoCore.ClientPluginHost 0xdb43d:$x1: NanoCore.ClientPluginHost 0x7623a:$x2: IClientNetworkHost 0xa8c5a:$x2: IClientNetworkHost 0xdb47a:$x2: IClientNetworkHost 0x79d6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xac78d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xdefad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
28.2.jsdudg.exe.428f1d0.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
28.2.jsdudg.exe.428f1d0.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x75f65:$a: NanoCore 0x75f75:$a: NanoCore 0x761a9:$a: NanoCore 0x761bd:$a: NanoCore 0x761fd:$a: NanoCore 0xa8985:$a: NanoCore 0xa8995:$a: NanoCore 0xa8bc9:$a: NanoCore 0xa8bdd:$a: NanoCore 0xa8c1d:$a: NanoCore 0xdb1a5:$a: NanoCore 0xdb1b5:$a: NanoCore 0xdb3e9:$a: NanoCore 0xdb3fd:$a: NanoCore 0xdb43d:$a: NanoCore 0x75fc4:$b: ClientPlugin 0x761c6:$b: ClientPlugin 0x76206:$b: ClientPlugin 0xa89e4:$b: ClientPlugin 0xa8be6:$b: ClientPlugin 0xa8c26:$b: ClientPlugin
Click to see the 176 entries

Sigma Overview

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 6036, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentCommandLine: "C:\Users\user\Desktop\gruopon.exe" , ParentImage: C:\Users\user\Desktop\gruopon.exe, ParentProcessId: 5992, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 6036

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentCommandLine: "C:\Users\user\Desktop\gruopon.exe" , ParentImage: C:\Users\user\Desktop\gruopon.exe, ParentProcessId: 5992, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 6036

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "efb71872-e607-4767-b940-43b2f1a4", "Group": "BACK UP", "Domain1": "20.91.192.34", "Domain2": "", "Port": 6422, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for submitted file

Source: gruopon.exe	Virustotal: Detection: 46%			Perma Link
Source: gruopon.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Virustotal: Detection: 46%			Perma Link
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	ReversingLabs: Detection: 39%

Yara detected Nanocore RAT

Source: Yara match	File source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR

Machine Learning detection for sample

Source: gruopon.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\jsdudg.exe

Joe Sandbox ML: detected

Source: 30.0.RegAsm.exe.400000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 30.0.RegAsm.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 30.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 30.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.0.RegAsm.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.0.RegAsm.exe.400000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.2.RegAsm.exe.6070000.6.unpack	Avira: Label: TR/NanoCore.fadte
Source: 30.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.0.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 30.0.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 3.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: gruopon.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: gruopon.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: 20.91.192.34

Source: Joe Sandbox View

ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: global traffic

TCP traffic: 192.168.2.6:49755 -> 20.91.192.34:6422

Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.91.192.34

Source: jsdudg.exe, jsdudg.exe, 0000001C.00000002.524002624.0000000003221000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.includehelp.com:8082/Article/CPrograms/
Source: gruopon.exe, jsdudg.exe.6.dr	String found in binary or memory: http://www.includehelp.com:8082/Article/CPrograms/1gmzbbBb9cJRFsuZUXOXWHw==AP12d9eB4sE/Ua3buASP

Source: gruopon.exe, 00000001.00000002.363671082.0000000000A70000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: RegAsm.exe, 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.58e0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.28fb674.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.2e9ff6c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.2.RegAsm.exe.323b674.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: gruopon.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.58e0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.58e0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.28fb674.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.28fb674.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.2e9ff6c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.2.RegAsm.exe.323b674.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.RegAsm.exe.323b674.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\gruopon.exe	Code function: 1_2_024D4BF8	1_2_024D4BF8
Source: C:\Users\user\Desktop\gruopon.exe	Code function: 1_2_024D3C48	1_2_024D3C48
Source: C:\Users\user\Desktop\gruopon.exe	Code function: 1_2_024D3C58	1_2_024D3C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0125E471	3_2_0125E471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0125E480	3_2_0125E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0125BBD4	3_2_0125BBD4
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 10_2_04B74BF8	10_2_04B74BF8
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 10_2_04B73C58	10_2_04B73C58
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 10_2_04B73C48	10_2_04B73C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0287E480	12_2_0287E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0287E471	12_2_0287E471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0287BBD4	12_2_0287BBD4
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 28_2_01734BF8	28_2_01734BF8
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 28_2_01733C58	28_2_01733C58
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 28_2_01733C48	28_2_01733C48

Source: C:\Users\user\Desktop\gruopon.exe

Code function: 1_2_024D8610 CreateProcessAsUserA,

1_2_024D8610

Source: gruopon.exe, 00000001.00000000.348340730.0000000000365000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTeamViewer.exel& vs gruopon.exe
Source: gruopon.exe	Binary or memory string: OriginalFilenameTeamViewer.exel& vs gruopon.exe

Source: gruopon.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: jsdudg.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior

Source: gruopon.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: jsdudg.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: gruopon.exe	Virustotal: Detection: 46%
Source: gruopon.exe	ReversingLabs: Detection: 39%

Source: gruopon.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gruopon.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gruopon.exe "C:\Users\user\Desktop\gruopon.exe"
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\gruopon.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jsdudg.exe C:\Users\user\AppData\Roaming\jsdudg.exe
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jsdudg.exe C:\Users\user\AppData\Roaming\jsdudg.exe
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\gruopon.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gruopon.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@33/6@0/1

Source: 3.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.RegAsm.exe.400000.2.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.RegAsm.exe.400000.2.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.0.RegAsm.exe.400000.2.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.RegAsm.exe.400000.2.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.0.RegAsm.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.RegAsm.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.RegAsm.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.RegAsm.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\gruopon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: gruopon.exe, arIpamkknnkjbjf.cs	Base64 encoded string: 'NihtjyBcTlcJdSURVBwEviLmByt1cD+TNS0vZyUJyRg6Vl3ebypuJLoybSgX6OPlNT7oGdpuJfk='
Source: 1.2.gruopon.exe.2e0000.0.unpack, arIpamkknnkjbjf.cs	Base64 encoded string: 'NihtjyBcTlcJdSURVBwEviLmByt1cD+TNS0vZyUJyRg6Vl3ebypuJLoybSgX6OPlNT7oGdpuJfk='
Source: 1.0.gruopon.exe.2e0000.0.unpack, arIpamkknnkjbjf.cs	Base64 encoded string: 'NihtjyBcTlcJdSURVBwEviLmByt1cD+TNS0vZyUJyRg6Vl3ebypuJLoybSgX6OPlNT7oGdpuJfk='
Source: jsdudg.exe.6.dr, arIpamkknnkjbjf.cs	Base64 encoded string: 'NihtjyBcTlcJdSURVBwEviLmByt1cD+TNS0vZyUJyRg6Vl3ebypuJLoybSgX6OPlNT7oGdpuJfk='
Source: 10.2.jsdudg.exe.380000.0.unpack, arIpamkknnkjbjf.cs	Base64 encoded string: 'NihtjyBcTlcJdSURVBwEviLmByt1cD+TNS0vZyUJyRg6Vl3ebypuJLoybSgX6OPlNT7oGdpuJfk='
Source: 10.0.jsdudg.exe.380000.0.unpack, arIpamkknnkjbjf.cs	Base64 encoded string: 'NihtjyBcTlcJdSURVBwEviLmByt1cD+TNS0vZyUJyRg6Vl3ebypuJLoybSgX6OPlNT7oGdpuJfk='

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{efb71872-e607-4767-b940-43b2f1a43e63}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_01

Source: gruopon.exe, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: gruopon.exe, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: gruopon.exe, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: gruopon.exe, arIpamkknnkjbjf.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.2.gruopon.exe.2e0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.gruopon.exe.2e0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.gruopon.exe.2e0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.gruopon.exe.2e0000.0.unpack, arIpamkknnkjbjf.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.0.gruopon.exe.2e0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.gruopon.exe.2e0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.gruopon.exe.2e0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\gruopon.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: gruopon.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gruopon.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

.NET source code contains potential unpacker

Source: gruopon.exe, SmartAssembly.AssemblyResolver/AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.gruopon.exe.2e0000.0.unpack, SmartAssembly.AssemblyResolver/AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.gruopon.exe.2e0000.0.unpack, SmartAssembly.AssemblyResolver/AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.2.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.2.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.3.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.RegAsm.exe.400000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: jsdudg.exe.6.dr, SmartAssembly.AssemblyResolver/AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.jsdudg.exe.380000.0.unpack, SmartAssembly.AssemblyResolver/AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.jsdudg.exe.380000.0.unpack, SmartAssembly.AssemblyResolver/AssemblyResolverHelper.cs	.Net Code: ResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.2.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.2.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\gruopon.exe	Code function: 1_2_002E84AC push ss; ret	1_2_002E8796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_012569B0 pushfd ; ret	3_2_012569B1
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 10_2_003884AC push ss; ret	10_2_00388796
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 10_2_04B76200 push 14502910h; ret	10_2_04B762AD
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Code function: 28_2_00E784AC push ss; ret	28_2_00E78796

Source: gruopon.exe	Static PE information: real checksum: 0x86878 should be: 0x102878
Source: jsdudg.exe.6.dr	Static PE information: real checksum: 0x86878 should be: 0x102878

Source: initial sample	Static PE information: section name: .text entropy: 7.86220693634
Source: initial sample	Static PE information: section name: .text entropy: 7.86220693634

Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.2.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.0.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 3.0.RegAsm.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.0.RegAsm.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 3.0.RegAsm.exe.400000.2.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 3.0.RegAsm.exe.400000.2.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.0.RegAsm.exe.400000.3.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.0.RegAsm.exe.400000.3.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 3.0.RegAsm.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 3.0.RegAsm.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.0.RegAsm.exe.400000.2.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.0.RegAsm.exe.400000.2.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.0.RegAsm.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.0.RegAsm.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\jsdudg.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe TID: 6232	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe TID: 2192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6424	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe TID: 3016	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe TID: 852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe TID: 4860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe TID: 3400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6808	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7129	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2319	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 897	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\gruopon.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D4A008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 6D3008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10B7008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\gruopon.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\gruopon.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\gruopon.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.620260353.0000000003401000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618605280.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.620297624.000000000340F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618393953.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.620207483.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618664149.0000000002FDD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.622598670.0000000006DBE000.00000004.00000010.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.622221181.0000000005F7B000.00000004.00000010.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618074252.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.622427454.000000000641E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000003.00000002.618605280.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618393953.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.620207483.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618664149.0000000002FDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\|$U
Source: RegAsm.exe, 00000003.00000002.618605280.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerx
Source: RegAsm.exe, 00000003.00000002.622353382.00000000061DD000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: RegAsm.exe, 00000003.00000002.622579915.0000000006C7E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager`[
Source: RegAsm.exe, 00000003.00000002.622450476.000000000655E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager`;
Source: RegAsm.exe, 00000003.00000002.618393953.0000000002F45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerHannh
Source: RegAsm.exe, 00000003.00000002.620297624.000000000340F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618393953.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.618664149.0000000002FDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\

Source: C:\Users\user\Desktop\gruopon.exe	Queries volume information: C:\Users\user\Desktop\gruopon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gruopon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Queries volume information: C:\Users\user\AppData\Roaming\jsdudg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Queries volume information: C:\Users\user\AppData\Roaming\jsdudg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jsdudg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gruopon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: RegAsm.exe, 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 00000003.00000002.618074252.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000003.00000002.618074252.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Source: Yara match	File source: 12.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e9457d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8ff54.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.3e8b11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.42f5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3737c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.377f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.37e5240.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6074629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.6070000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.422457d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.369f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421b11e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38db11e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.jsdudg.exe.3817c60.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38dff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.38e457d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.4327c60.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.421ff54.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.gruopon.exe.3705240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.jsdudg.exe.428f1d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3900, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	1 Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 Masquerading	21 Input Capture	1 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Side-Loading	312 Process Injection	1 Access Token Manipulation	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Remote Access Software	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Scheduled Task/Job	1 Disable or Modify Tools	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	312 Process Injection	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Deobfuscate/Decode Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	21 Obfuscated Files or Information	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	13 Software Packing	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 DLL Side-Loading	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gruopon.exe	47%	Virustotal		Browse
gruopon.exe	40%	ReversingLabs	ByteCode-MSIL.Backdoor.Crysan
gruopon.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\jsdudg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jsdudg.exe	47%	Virustotal		Browse
C:\Users\user\AppData\Roaming\jsdudg.exe	40%	ReversingLabs	ByteCode-MSIL.Backdoor.Crysan

Unpacked PE Files

Source	Detection	Scanner	Label	Download
30.0.RegAsm.exe.400000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
30.0.RegAsm.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
30.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
30.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.0.RegAsm.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.0.RegAsm.exe.400000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.2.RegAsm.exe.6070000.6.unpack	100%	Avira	TR/NanoCore.fadte	Download File
30.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.0.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
30.0.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
3.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
	0%	Avira URL Cloud	safe
20.91.192.34	0%	Virustotal		Browse
20.91.192.34	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
20.91.192.34	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.includehelp.com:8082/Article/CPrograms/	jsdudg.exe, jsdudg.exe, 0000001C.00000002.524002624.0000000003221000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.includehelp.com:8082/Article/CPrograms/1gmzbbBb9cJRFsuZUXOXWHw==AP12d9eB4sE/Ua3buASP	gruopon.exe, jsdudg.exe.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
20.91.192.34	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	561562
Start date:	27.01.2022
Start time:	16:12:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	gruopon.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@33/6@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.6% (good quality ratio 0.1%) Quality average: 15.1% Quality standard deviation: 26.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 113 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
16:13:51	API Interceptor	1x Sleep call for process: gruopon.exe modified
16:13:58	Task Scheduler	Run new task: Nania path: "C:\Users\user\AppData\Roaming\jsdudg.exe"
16:14:01	API Interceptor	958x Sleep call for process: RegAsm.exe modified
16:14:03	API Interceptor	2x Sleep call for process: jsdudg.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Sz3UuCg0px	Get hash	malicious	Browse	104.147.78.187
	U8aGf4OtLR	Get hash	malicious	Browse	40.85.254.44
	fKWEtqaAtA	Get hash	malicious	Browse	13.95.41.254
	eZITFZM4MJ	Get hash	malicious	Browse	20.36.90.130
	message_zdm.htm	Get hash	malicious	Browse	52.97.218.82
	IWdqQvHEF7	Get hash	malicious	Browse	20.106.255.165
	AN_NGOB32751400.doc	Get hash	malicious	Browse	20.51.217.113
	ua1oTmkw68.exe	Get hash	malicious	Browse	104.47.54.36
	Karau.html	Get hash	malicious	Browse	52.250.42.157
	loligang.arm7	Get hash	malicious	Browse	13.81.205.219
	hGX7v1zhOe	Get hash	malicious	Browse	20.219.235.211
	3Z6FoHYZcD	Get hash	malicious	Browse	72.154.232.250
	loligang.arm	Get hash	malicious	Browse	168.61.5.240
	sys.exe	Get hash	malicious	Browse	20.12.166.197
	42ySB8UkHN	Get hash	malicious	Browse	20.237.102.60
	lessie.arm7	Get hash	malicious	Browse	40.65.190.87
	mirai.x86	Get hash	malicious	Browse	40.114.236.117
	UAicb1MHGY	Get hash	malicious	Browse	20.18.207.33
	x86	Get hash	malicious	Browse	20.254.50.244
	L4J1KK3v10	Get hash	malicious	Browse	20.109.201.145

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gruopon.exe.log

Download File

Process:	C:\Users\user\Desktop\gruopon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.345981753770044
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:MLUE4K5E4Ks2wKDE4KhK3VZ9pKhk
MD5:	044A637E42FE9A819D7E43C8504CA769
SHA1:	6FCA27B1A571B73563C8424C84F4F64F3CBCBE2F
SHA-256:	E88E04654826CE00CC7A840745254164DDBD175066D6E4EA6858BF0FE463EBB4
SHA-512:	C9A74FA4154FA5E5951B0EEAC5330CA4BAC981FF9AD24C08575A76AD5D99CFB68556B9857C9C8209A1BFCB43F82E00F14962987A18A92A715F45AD0D4E4A718C
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsdudg.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\jsdudg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.345981753770044
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:MLUE4K5E4Ks2wKDE4KhK3VZ9pKhk
MD5:	044A637E42FE9A819D7E43C8504CA769
SHA1:	6FCA27B1A571B73563C8424C84F4F64F3CBCBE2F
SHA-256:	E88E04654826CE00CC7A840745254164DDBD175066D6E4EA6858BF0FE463EBB4
SHA-512:	C9A74FA4154FA5E5951B0EEAC5330CA4BAC981FF9AD24C08575A76AD5D99CFB68556B9857C9C8209A1BFCB43F82E00F14962987A18A92A715F45AD0D4E4A718C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:RBwWE8:wo
MD5:	4F63C92E941685D840E1F8C918DA040C
SHA1:	CC23DD55D88908CA02F832A5E847BC0D37AE3109
SHA-256:	BC5A282C96E4E148742AE3AE417F69DA08F3013C14A6BD0DD99050F445F7DE0A
SHA-512:	011DADAA70A1EC2708D62A9E822898F7B06A600166C8C245ECD53F2E9A12D30FD8D5FD99B9EDA83058957410EBD5BFE5B046C55B04EE77D3E82BF3B89EA87E36
Malicious:	true
Preview:	.....H

C:\Users\user\AppData\Roaming\jsdudg.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	4.092360282456018
Encrypted:	false
SSDEEP:	3072:cTEGnCEOwfiswpqNKhIrkWzJxDBvkYRZPhgmWwHEnSswFiP6XzDPFPmusk/d5Gfn:cFHOwfwp+0Ir/gYswSvMPRmRk1dP
MD5:	40D8F956A39A697E1AA509EFE0E167F5
SHA1:	45814F4A78C727A84C008232DE7672461C3BE706
SHA-256:	C46BA296E23895758E7BF5C515E10784E317C4754D53D3C308E0B71110B861AD
SHA-512:	4FF6767BE043B2612591CB48B979F8AC47DF86879767C1DC6E482DC8CF97ACCB1D31AB24B7223265B597F96C05737DA485D731463D68D5330A770C893FFDABE1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 47%, Browse Antivirus: ReversingLabs, Detection: 40%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.....................h......B.... ........@.. ..............................xh....@.....................................J........e........................................................................... ............... ..H............text...H.... ...................... ..`.rsrc....e.......f..................@..@.reloc...............>..............@..B................(.......H.......<n..tW..............H....m.......................................(3...(C....0..........(B...s......o.......0..x.......(.......(....r...p(......r...pr...p(.....r...p(....(....&..........r...pr...p(...........r...p.......r...p..(....(....&.0.......... 0u..(....r...pr...ps....&r...pr...p(.....r...ps......o....,.r...p(....+.r~..p(......r...p(......{.......(....&(....o....(....r...p(......(....r...p(....(....&.(.....(.....0...........(....s.........o....t......*....0..

C:\Users\user\AppData\Roaming\jsdudg.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.092360282456018
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	gruopon.exe
File size:	1048576
MD5:	40d8f956a39a697e1aa509efe0e167f5
SHA1:	45814f4a78c727a84c008232de7672461c3be706
SHA256:	c46ba296e23895758e7bf5c515e10784e317c4754d53d3c308e0b71110b861ad
SHA512:	4ff6767be043b2612591cb48b979f8ac47df86879767c1dc6e482dc8cf97accb1d31ab24b7223265b597f96c05737da485d731463d68d5330a770c893ffdabe1
SSDEEP:	3072:cTEGnCEOwfiswpqNKhIrkWzJxDBvkYRZPhgmWwHEnSswFiP6XzDPFPmusk/d5Gfn:cFHOwfwp+0Ir/gYswSvMPRmRk1dP
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.....................h......B.... ........@.. ..............................xh....@................................

File Icon


Icon Hash:	71e0d49292c07033

Static PE Info

General

Entrypoint:	0x43f442
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61F0A093 [Wed Jan 26 01:14:59 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f3f8	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x465c2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3d448	0x3d600	False	0.919158127546	data	7.86220693634	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0x465c2	0x46600	False	0.0908151087922	data	3.80490586802	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x88000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x40220	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x40688	0x10a8	data
RT_ICON	0x41730	0x25a8	data
RT_ICON	0x43cd8	0x42028	data
RT_DIALOG	0x85d00	0x11c	data	English	United States
RT_GROUP_ICON	0x85e1c	0x3e	data
RT_VERSION	0x85e5c	0x390	data
RT_MANIFEST	0x861ec	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
RT_MANIFEST	0x863d8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
LegalCopyright	TeamViewer Germany GmbH
InternalName	TeamViewer
FileVersion	15.25.8.0
CompanyName	TeamViewer Germany GmbH
PrivateBuild	TeamViewer Remote Control Application
LegalTrademarks	TeamViewer
ProductName	TeamViewer
ProductVersion	15.25.8.0
FileDescription	TeamViewer
OriginalFilename	TeamViewer.exe
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2022 16:14:03.481580973 CET	49755	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:03.520590067 CET	6422	49755	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:04.141484022 CET	49755	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:04.180322886 CET	6422	49755	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:04.750864983 CET	49755	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:04.791598082 CET	6422	49755	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:09.114737988 CET	49756	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:09.153383017 CET	6422	49756	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:09.751334906 CET	49756	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:09.789781094 CET	6422	49756	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:10.298145056 CET	49756	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:10.336327076 CET	6422	49756	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:14.362154007 CET	49757	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:14.400962114 CET	6422	49757	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:14.907911062 CET	49757	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:14.947107077 CET	6422	49757	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:15.454879999 CET	49757	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:15.494359016 CET	6422	49757	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:19.508656025 CET	49760	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:19.552504063 CET	6422	49760	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:20.189660072 CET	49760	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:20.232242107 CET	6422	49760	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:20.877394915 CET	49760	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:20.920118093 CET	6422	49760	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:24.925941944 CET	49761	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:24.964318991 CET	6422	49761	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:25.486973047 CET	49761	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:25.525273085 CET	6422	49761	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:26.190160036 CET	49761	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:26.228506088 CET	6422	49761	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:31.144836903 CET	49762	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:31.183727980 CET	6422	49762	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:31.690680981 CET	49762	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:31.729521036 CET	6422	49762	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:32.237577915 CET	49762	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:32.276534081 CET	6422	49762	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:36.286027908 CET	49764	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:36.328948975 CET	6422	49764	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:36.831656933 CET	49764	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:36.874859095 CET	6422	49764	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:37.378576040 CET	49764	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:37.421597004 CET	6422	49764	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:41.427139044 CET	49768	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:41.465615034 CET	6422	49768	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:41.972743988 CET	49768	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:42.011251926 CET	6422	49768	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:42.519690990 CET	49768	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:42.558180094 CET	6422	49768	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:46.568538904 CET	49771	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:46.611680984 CET	6422	49771	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:47.113739014 CET	49771	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:47.156301975 CET	6422	49771	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:47.660779953 CET	49771	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:47.703424931 CET	6422	49771	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:51.709007025 CET	49778	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:51.747689962 CET	6422	49778	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:52.442375898 CET	49778	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:52.480648041 CET	6422	49778	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:53.129972935 CET	49778	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:53.168431044 CET	6422	49778	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:57.228086948 CET	49787	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:57.270548105 CET	6422	49787	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:57.880299091 CET	49787	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:57.919070959 CET	6422	49787	20.91.192.34	192.168.2.6
Jan 27, 2022 16:14:58.567869902 CET	49787	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:14:58.606945038 CET	6422	49787	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:03.288552999 CET	49801	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:03.326960087 CET	6422	49801	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:03.943295956 CET	49801	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:03.981626987 CET	6422	49801	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:04.630893946 CET	49801	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:04.700164080 CET	6422	49801	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:08.714263916 CET	49821	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:08.757319927 CET	6422	49821	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:09.287698030 CET	49821	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:09.330332041 CET	6422	49821	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:09.881283045 CET	49821	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:09.923932076 CET	6422	49821	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:13.930715084 CET	49824	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:13.971927881 CET	6422	49824	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:14.570421934 CET	49824	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:14.609199047 CET	6422	49824	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:15.178658962 CET	49824	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:15.216936111 CET	6422	49824	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:19.244520903 CET	49828	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:19.283020020 CET	6422	49828	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:19.788497925 CET	49828	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:19.826865911 CET	6422	49828	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:20.335362911 CET	49828	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:20.373646975 CET	6422	49828	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:24.393471956 CET	49830	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:24.432435036 CET	6422	49830	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:25.030731916 CET	49830	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:25.069500923 CET	6422	49830	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:25.631659031 CET	49830	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:25.670325994 CET	6422	49830	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:29.688962936 CET	49832	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:29.727541924 CET	6422	49832	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:30.291636944 CET	49832	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:30.332921028 CET	6422	49832	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:30.840477943 CET	49832	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:30.880263090 CET	6422	49832	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:34.889707088 CET	49841	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:34.928414106 CET	6422	49841	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:35.481369972 CET	49841	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:35.520441055 CET	6422	49841	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:36.075177908 CET	49841	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:36.115710020 CET	6422	49841	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:40.140350103 CET	49858	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:40.179231882 CET	6422	49858	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:40.685051918 CET	49858	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:40.724018097 CET	6422	49858	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:41.231940031 CET	49858	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:41.271511078 CET	6422	49858	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:45.296178102 CET	49860	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:45.334826946 CET	6422	49860	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:45.841638088 CET	49860	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:45.880392075 CET	6422	49860	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:46.388623953 CET	49860	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:46.427495956 CET	6422	49860	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:50.437202930 CET	49861	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:50.476109982 CET	6422	49861	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:50.982676983 CET	49861	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:51.021534920 CET	6422	49861	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:51.529593945 CET	49861	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:51.568382025 CET	6422	49861	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:55.577996016 CET	49863	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:55.616211891 CET	6422	49863	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:56.123704910 CET	49863	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:56.162033081 CET	6422	49863	20.91.192.34	192.168.2.6
Jan 27, 2022 16:15:56.670665026 CET	49863	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:15:56.708894968 CET	6422	49863	20.91.192.34	192.168.2.6
Jan 27, 2022 16:16:00.718959093 CET	49864	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:16:00.757636070 CET	6422	49864	20.91.192.34	192.168.2.6
Jan 27, 2022 16:16:01.264955044 CET	49864	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:16:01.304119110 CET	6422	49864	20.91.192.34	192.168.2.6
Jan 27, 2022 16:16:01.812325954 CET	49864	6422	192.168.2.6	20.91.192.34
Jan 27, 2022 16:16:01.852289915 CET	6422	49864	20.91.192.34	192.168.2.6

Target ID:	1
Start time:	16:13:50
Start date:	27/01/2022
Path:	C:\Users\user\Desktop\gruopon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gruopon.exe"
Imagebase:	0x2e0000
File size:	1048576 bytes
MD5 hash:	40D8F956A39A697E1AA509EFE0E167F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.364995852.0000000003639000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	16:13:52
Start date:	27/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0xaf0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000002.616660623.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000000.354914710.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000000.354654523.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.622304121.0000000006070000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000002.620364814.0000000003E89000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000000.354407215.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000003.00000000.353836119.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000003.00000002.622103312.00000000058E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	16:13:55
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	16:13:56
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\Desktop\gruopon.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	16:13:56
Start date:	27/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	16:13:57
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Imagebase:	0x1070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	16:13:57
Start date:	27/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	16:14:01
Start date:	27/01/2022
Path:	C:\Users\user\AppData\Roaming\jsdudg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jsdudg.exe
Imagebase:	0x380000
File size:	1048576 bytes
MD5 hash:	40D8F956A39A697E1AA509EFE0E167F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.401676808.0000000003719000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, Virustotal, Browse Detection: 40%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	12
Start time:	16:14:09
Start date:	27/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0x5b0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.391198929.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.390187170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.418957983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.390440654.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.419442563.0000000003899000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.390876269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.419329024.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	16:14:12
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	16:14:13
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	16:14:13
Start date:	27/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	16:14:14
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Imagebase:	0x1070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	18
Start time:	16:14:14
Start date:	27/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	16:15:02
Start date:	27/01/2022
Path:	C:\Users\user\AppData\Roaming\jsdudg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jsdudg.exe
Imagebase:	0xe70000
File size:	1048576 bytes
MD5 hash:	40D8F956A39A697E1AA509EFE0E167F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001C.00000002.524101575.0000000004229000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>

Show Windows behavior

Target ID:	30
Start time:	16:15:04
Start date:	27/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0xe20000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000002.543378506.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000000.510638096.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000000.510140831.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000002.545333473.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000002.545542079.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000000.509750431.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000001E.00000000.509298666.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>

Show Windows behavior

Target ID:	33
Start time:	16:15:08
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	34
Start time:	16:15:09
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\AppData\Roaming\jsdudg.exe" "C:\Users\user\AppData\Roaming\jsdudg.exe
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	35
Start time:	16:15:10
Start date:	27/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	36
Start time:	16:15:10
Start date:	27/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\user\AppData\Roaming\jsdudg.exe'" /f
Imagebase:	0x1070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	16:15:11
Start date:	27/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Execution Graph

Execution Coverage:	17%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.6%
Total number of Nodes:	115
Total number of Limit Nodes:	6

Executed Functions

Function 024D8610 Relevance: 1.7, APIs: 1, Instructions: 240
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 024D884C

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: c5734b65a84a6f00b9868591956b217bd7526f072e45fbcdc136d6a150d0dc89
Instruction ID: 2501cc6452efb5f207b34232ba8dcb350fe8dceaf56400b5d05d4fedd5138ce3
Opcode Fuzzy Hash: c5734b65a84a6f00b9868591956b217bd7526f072e45fbcdc136d6a150d0dc89
Instruction Fuzzy Hash: D7915771D006199FDB10CFA9C951BEEBBB6FF48314F0481AAE858A3350DB709986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 024D4BF8 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede1f83adcd17eb36859457c6742f8af1c3177758cb52d8d4ed370c3383512dd
Instruction ID: 9e05be6e4c7139c927644f23f7320ea32f87cb196e5293e69fcb958900643b05
Opcode Fuzzy Hash: ede1f83adcd17eb36859457c6742f8af1c3177758cb52d8d4ed370c3383512dd
Instruction Fuzzy Hash: FA12C330B00215DFDB14DB68D8A0BAEB7F6BF85318F14852AE4069B795DB70EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 024D3018 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024D30A8
GetCurrentThread.KERNEL32 ref: 024D30E5
GetCurrentProcess.KERNEL32 ref: 024D3122
GetCurrentThreadId.KERNEL32 ref: 024D317B

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cd68b292e07b939a098971a863f99b4122ab07ab90cb1da3cd35ba10ce69417b
Instruction ID: 8fae7cbca1918d9c0803ace892190fa6ba38c8692b345485841c171177be3eb9
Opcode Fuzzy Hash: cd68b292e07b939a098971a863f99b4122ab07ab90cb1da3cd35ba10ce69417b
Instruction Fuzzy Hash: 7F5199B0E002858FDB05CFA9C5887DEBFF0AF49318F2484AAE009A7391D7745844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 024D3048 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024D30A8
GetCurrentThread.KERNEL32 ref: 024D30E5
GetCurrentProcess.KERNEL32 ref: 024D3122
GetCurrentThreadId.KERNEL32 ref: 024D317B

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1ab151e0e5bf04a84cc8be6af828368c6b858c4defccc89d9bbf96c74320f71d
Instruction ID: 6649d92afdbff7dd8e78e52ef2fd7f9234fcc8237d507c87fd60550e05e7cf44
Opcode Fuzzy Hash: 1ab151e0e5bf04a84cc8be6af828368c6b858c4defccc89d9bbf96c74320f71d
Instruction Fuzzy Hash: 925145B0E006498FDB14CFAAC6887DFBBF4EB49318F24859AE009A7294D7745844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 024D8604 Relevance: 1.8, APIs: 1, Instructions: 257
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 024D884C

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 5dd5ab193dee0f26eea98efbb866c0dec1e414b89cd605c79c65b621818535da
Instruction ID: 2b87f3e909c2b19f0221b061479a69a7a3b39082c88798f53135bc4e605337b0
Opcode Fuzzy Hash: 5dd5ab193dee0f26eea98efbb866c0dec1e414b89cd605c79c65b621818535da
Instruction Fuzzy Hash: E1A16A71D002198FDB10CFA9C951BEEBBB2FF48314F0485AAE858A7350DB719986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 024D8BB2 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 024D8C45

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d5d8d557ca25315543faf75be5f9adc444874263ca630d78abc4f89acae7fc61
Instruction ID: f9193c0c604f17a243b5dc6af9a37ac7a8a1fddc3c89e8c621bae21bb917380e
Opcode Fuzzy Hash: d5d8d557ca25315543faf75be5f9adc444874263ca630d78abc4f89acae7fc61
Instruction Fuzzy Hash: E62107B5901259DFCB10CF99C984BDEBBF4FB48324F14842AE518A3350D774A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 024D3268 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024D32F7

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9f85a417c04c8d28151c21210efa4809ae076653a3ddf59c2c7122bd4b9cd879
Instruction ID: e195100f9b8bdca7761fa5c998d2543850d60ca2134c6c7fef74d920b6a96005
Opcode Fuzzy Hash: 9f85a417c04c8d28151c21210efa4809ae076653a3ddf59c2c7122bd4b9cd879
Instruction Fuzzy Hash: 6921FFB5D012489FDB10CFAAD984AEEBFF8EB48324F14845AE955A3310C374A955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 024D8BB8 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 024D8C45

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bb17e8d8f7b33f6e71d94ceb192bfeddc7f3d2bc21a31c74b6f521ef2299d67d
Instruction ID: 53e82be2fd77f3c2023f24cca0d8e5ed1f63fd773c72d0de5617a8c093e4b4d7
Opcode Fuzzy Hash: bb17e8d8f7b33f6e71d94ceb192bfeddc7f3d2bc21a31c74b6f521ef2299d67d
Instruction Fuzzy Hash: 6E21E5B1901249DFCB10CF9AC985BDEBBF4FB48324F10842AE518A3250D774A555CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 024D8C88 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 024D8CEF

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ce626c1204935ed1fe302eddd5577c0f8422985669ebdbd880a5231b9a95553f
Instruction ID: fe4c9c9ac4bb0cad279eceea88434a4bda956307eda15e9ddeb032160dceac85
Opcode Fuzzy Hash: ce626c1204935ed1fe302eddd5577c0f8422985669ebdbd880a5231b9a95553f
Instruction Fuzzy Hash: DC2133B2901649CFDB10CF9AD954BEEFBF4FB48324F14846AD818A3640D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D3270 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024D32F7

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d2f9c6df8354444df769435fee1b2a5526b4175a6902f4e7aec607f62d3973f4
Instruction ID: f9a784f139ccdb2fd09f146b9918e2a344a2b9592b5002909784e422d07da133
Opcode Fuzzy Hash: d2f9c6df8354444df769435fee1b2a5526b4175a6902f4e7aec607f62d3973f4
Instruction Fuzzy Hash: 2521E2B5D002489FDB10CFAAD984ADEBFF8FB48324F14845AE914A3310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D8988 Relevance: 1.6, APIs: 1, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 024D8A07

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 3e70b8155f8e85cfc0b2d9ced7ec6ce2781e1faf29e5ace21afa8ab08a3d1d2f
Instruction ID: 2563f33761b40415a464a630a2e8049088171d79e9e327d86717c992643db85f
Opcode Fuzzy Hash: 3e70b8155f8e85cfc0b2d9ced7ec6ce2781e1faf29e5ace21afa8ab08a3d1d2f
Instruction Fuzzy Hash: 2A21F4B1E006199FCB10CF9AD9857EEFBF4BB48224F54816AE418B3740D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D8990 Relevance: 1.6, APIs: 1, Instructions: 58
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 024D8A07

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d8f3f8c2ecdec074415d23ac9ca2e2abbfb5353626230b64806983e8163d51a3
Instruction ID: fe2099d8be19443bd33697acb88b0cae696f6e21c6884ebf888333caa5ecc45e
Opcode Fuzzy Hash: d8f3f8c2ecdec074415d23ac9ca2e2abbfb5353626230b64806983e8163d51a3
Instruction Fuzzy Hash: 012108B1E006199FCB00CF9AC9857EEFBF4BB48224F54816AD418B3340D774A9458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D8A4A Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 024D8AC6

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ed5c2c84d6683ae28fc33acfdf5980a23669649c83a1ba168334055ff05db394
Instruction ID: fcf0d46c6ecfb252a791c307c75d1b6af71e54f1fc1a468d2d34db1f525dbcbe
Opcode Fuzzy Hash: ed5c2c84d6683ae28fc33acfdf5980a23669649c83a1ba168334055ff05db394
Instruction Fuzzy Hash: CD21E3B5900249DFCB10CF9AC984BDFBBF4FB48324F14842AE558A7250D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D8A50 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 024D8AC6

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 709e2a5e20dc5aa7aa12f66dfeab8574934046b7be8c476610f3753fa2c0d6f1
Instruction ID: a12d62931b17c4c324bb470f8e23136a5ba65d1072ff038a8454189c9d2543d3
Opcode Fuzzy Hash: 709e2a5e20dc5aa7aa12f66dfeab8574934046b7be8c476610f3753fa2c0d6f1
Instruction Fuzzy Hash: 6721D3B59002499FCB10CF9AC984BDFBBF8FB48324F14842AE958A7350D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D2EE5 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 024D484D

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 3019ec554b114c0a204febaee8f945e9d43e631ce795ae4ebdc802d89056faf4
Instruction ID: 77c5f0e236235ea669d228c97e496d589bace7ae25dca1e95e4223dc5c670e50
Opcode Fuzzy Hash: 3019ec554b114c0a204febaee8f945e9d43e631ce795ae4ebdc802d89056faf4
Instruction Fuzzy Hash: 801134B59046899FCB10DF9AC884BDFBFF8EB49324F14846AE558A7200C3746944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 024D8B08 Relevance: 1.6, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 024D8B7B

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eec3ca429431255bce6ece2dba69ddaee8c30c82f188714f68aa88429aa0f878
Instruction ID: 033f18a5a845028a41a84239fc4dfae995499ff33782c651357080cd01d0e43c
Opcode Fuzzy Hash: eec3ca429431255bce6ece2dba69ddaee8c30c82f188714f68aa88429aa0f878
Instruction Fuzzy Hash: 1C1102B5900248DFCB10DF99C984BDFBBF4FB48324F24841AE528A7210C375A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D2EEC Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 024D484D

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: b9b24b662c2f796e7d49e365d1576ef4aa19d479b3eff7e15db00786423e63a0
Instruction ID: 3da4072a5757315d37c4bf0fbc24fe3702259a28ccf52837c5b3fdd16583da4e
Opcode Fuzzy Hash: b9b24b662c2f796e7d49e365d1576ef4aa19d479b3eff7e15db00786423e63a0
Instruction Fuzzy Hash: 911125B59006489FCB10CF9AC884BDFBBF8EB48324F10842AE519A7200C374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 024D47E2 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 024D484D

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 3d6172faca86645e3a4628d7b5b7552c5da1b60d8aa26e6a335f7f913dd31c47
Instruction ID: e5e9bcccb7cb67bf78ff1cffb90f89f8fb0f8ceb51923745296cd439811ebcc0
Opcode Fuzzy Hash: 3d6172faca86645e3a4628d7b5b7552c5da1b60d8aa26e6a335f7f913dd31c47
Instruction Fuzzy Hash: 0E1116B59002898FCB50CF9AD484BDEBFF4EB48324F148459E559A7200C375A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 024D8B10 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 024D8B7B

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1c3c2fed19de0f11ea74f107f0c85339b361b78e6022b0ea2eb4b35210d09f66
Instruction ID: 96b2768bb9f3cf543e6da5ddf7420880f34dfbb530ffcfeb4675bfd4a3ba093d
Opcode Fuzzy Hash: 1c3c2fed19de0f11ea74f107f0c85339b361b78e6022b0ea2eb4b35210d09f66
Instruction Fuzzy Hash: 0611E0B59003499FCB10CF9AC884BDFBBF8FB48324F14841AE529A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024D8C90 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 024D8CEF

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5e271e8e8effaa1bb63bd735766bf283187bea19cfe63fd0da8dee2d12f222e3
Instruction ID: 7fb586559d659809f58f16503f1ad554647e746543252a7b5fef63e2f5c9d3ee
Opcode Fuzzy Hash: 5e271e8e8effaa1bb63bd735766bf283187bea19cfe63fd0da8dee2d12f222e3
Instruction Fuzzy Hash: C51112B19002488FCB10CF9AD888BDFBBF8EB48324F20845AD519A3240C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 024D3C58 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb130504e41e939ea733e59d7b1e4a56d4853ef1de92c7abdae7ba7082e9412
Instruction ID: 53b4ff48a9f3f4b9cf48af9fb0b26df8318dcb5e0f8a29f3779d750aa50b63ef
Opcode Fuzzy Hash: dfb130504e41e939ea733e59d7b1e4a56d4853ef1de92c7abdae7ba7082e9412
Instruction Fuzzy Hash: 6912D8F1C917468BD710CF56E8D818E3BA0B744328BD06A09D2631AAD9D7B815EEEF44

Uniqueness

Uniqueness Score: -1.00%

Function 024D3C48 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.364756338.00000000024D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_24d0000_gruopon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd5babe43aa98682d28e697d4675aa0aa6f17e25c22bcf8349c39c63b778993
Instruction ID: 825bb4d7d70df563376f430e9f7572d6533e4bf71764b5fb8f5abc43520ad586
Opcode Fuzzy Hash: 0cd5babe43aa98682d28e697d4675aa0aa6f17e25c22bcf8349c39c63b778993
Instruction Fuzzy Hash: 52C14CB1C917458BD710CF66E8D818E3BB1BB85328F906B09D1632B6D8D7B414EAEF44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6036, Parent PID: 5992COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	129
Total number of Limit Nodes:	5

Executed Functions

Function 06682A02 Relevance: 3.8, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%on, xrefs: 06682A38
%on, xrefs: 06682A6E
%on, xrefs: 06682A53

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID: %on$ %on$ %on
API String ID: 0-849424741
Opcode ID: ddbb6733e91742722c5883d8186e7283c8991b41f701be85543bf0bdbc762ace
Instruction ID: 421a40390d8c91a5cd2c821cfa9c0fe02ef2db131add4995e8bcff33b10a563a
Opcode Fuzzy Hash: ddbb6733e91742722c5883d8186e7283c8991b41f701be85543bf0bdbc762ace
Instruction Fuzzy Hash: 4A3185317013418FD751EBB0C4A02DEB7A7AFD2208B588D2EC0865F786DB71BC0A9B95

Uniqueness

Uniqueness Score: -1.00%

Function 066829D1 Relevance: 2.6, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%on, xrefs: 06682A6E
%on, xrefs: 06682A53

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID: %on$ %on
API String ID: 0-2029269471
Opcode ID: 746e16fd572f7e593acdbd0729df073857f543a427a7130ae0bb7aa9ab1c341f
Instruction ID: 7e3e10daa3c46edbcd111257779b327576d3b716a0eba5610e210229eb90006f
Opcode Fuzzy Hash: 746e16fd572f7e593acdbd0729df073857f543a427a7130ae0bb7aa9ab1c341f
Instruction Fuzzy Hash: 593172316013418FD750ABB0C4A06DAB7A6AFC2208B548D2AC1865F746DB71BC0ADB91

Uniqueness

Uniqueness Score: -1.00%

Function 012593E8 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0125962E

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ef70d508d841c429dd0e12006747e19359138a30f494411e1dc349ba7eb3b9dc
Instruction ID: 27e9fec821c8f84fa8ae80fc700a05f0c209906814152335ab8103390f1d88df
Opcode Fuzzy Hash: ef70d508d841c429dd0e12006747e19359138a30f494411e1dc349ba7eb3b9dc
Instruction Fuzzy Hash: A7714970A10B068FDB64DF6AD49075ABBF5FF88218F00892DD98AD7A40DB74E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0125FB98 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125FD0A

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 84fb20415f42a7059c7a348374b837ca0eed3d67f1ba37d210fed15627d848d9
Instruction ID: 4e20ccd78f56f113da5379c8f3a92bdab0e326ebd2e8f112a9d3daea4bf4e31a
Opcode Fuzzy Hash: 84fb20415f42a7059c7a348374b837ca0eed3d67f1ba37d210fed15627d848d9
Instruction Fuzzy Hash: 9B5100B1C14249EFDF01CFA9C980ADEBFB2BF49314F24816AE918AB221D7719955CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0125FB61 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125FD0A

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: db6a1f6a1187f297ceefa7ba6fab83f8003ca8509871f112c864d552fae81588
Instruction ID: 3d1b90f05ada1c441a3067b43ea6c2aee81d996c5c6632112a73437543bd662a
Opcode Fuzzy Hash: db6a1f6a1187f297ceefa7ba6fab83f8003ca8509871f112c864d552fae81588
Instruction Fuzzy Hash: 3C5100B1D103499FDF14CFA9D984ADEBFB5BF49314F24812AE818AB210D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0125DA04 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0125FD0A

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 47ee82aa285a38228581caa1d783a50e5fae0f7f93f745d53eab188ad5e02fa7
Instruction ID: fb90cc07422a7cdf9943bb20cb14db3b735037ba463fc5e4fc4062d2e024a813
Opcode Fuzzy Hash: 47ee82aa285a38228581caa1d783a50e5fae0f7f93f745d53eab188ad5e02fa7
Instruction Fuzzy Hash: 6451CEB1D10349DFDF14CFAAC984ADEBBB5BF48314F24812AE919AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0125A14C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0125BCC6,?,?,?,?,?), ref: 0125BD87

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9882b74b059aaaccec02b1f769666614733b0befade003e8ca4f96433740b24e
Instruction ID: 429e947abe2c460e84f98493f131f0a8ee885ee590102b1e5dd42642d3ec0d75
Opcode Fuzzy Hash: 9882b74b059aaaccec02b1f769666614733b0befade003e8ca4f96433740b24e
Instruction Fuzzy Hash: 9921E6B59012489FDB10CF9AD484AEEFBF5EB48324F14841AE954A3310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0125BCF9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0125BCC6,?,?,?,?,?), ref: 0125BD87

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4d8bf551734632243eb40c5eaaac840c4526ee8d6bc67bdf6e38c5621b761998
Instruction ID: e4fd1c8e353700fce4acdba8ab776a5f239046034f79b5bc258ad46166dc10cc
Opcode Fuzzy Hash: 4d8bf551734632243eb40c5eaaac840c4526ee8d6bc67bdf6e38c5621b761998
Instruction Fuzzy Hash: EB21E4B59012499FDB10CFAAD884ADEFFF9EF48324F14841AE958A3310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01258768 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,012596A9,00000800,00000000,00000000), ref: 012598BA

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2216cbb3de4ab05547c23feb717d9849a2fc8f57c15b5da2d4c223f3e17df37a
Instruction ID: 72e1c8ecc47e25bba24e436e7d1a3d1596cdba17f560043c5d10874c558fed85
Opcode Fuzzy Hash: 2216cbb3de4ab05547c23feb717d9849a2fc8f57c15b5da2d4c223f3e17df37a
Instruction Fuzzy Hash: 0711CFB6900249DFDB10CF9AC488BDEBBF4AB48324F14842AE919A7600C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01259849 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,012596A9,00000800,00000000,00000000), ref: 012598BA

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 68eb298c7e781e7a65d5d4281059f2b4c934f14784d403d34e1afdbb9444d5b5
Instruction ID: 7e773ddfbd0539f74c9de508ee132b10ee9afe3900f84e2608a852ff486045f7
Opcode Fuzzy Hash: 68eb298c7e781e7a65d5d4281059f2b4c934f14784d403d34e1afdbb9444d5b5
Instruction Fuzzy Hash: AF1114B6D00249DFDF10CFAAC488ADEFBF4AB49324F14842AE955A7600C774A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012595C8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0125962E

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2246c75249c8f6e964e61b02da4db394f46c5124d44ac8745fbb750db3de966c
Instruction ID: b95d38fea4f5ee6dd65dae60be9810ef1263a9ffbc6873536d5d4c8ca75599c1
Opcode Fuzzy Hash: 2246c75249c8f6e964e61b02da4db394f46c5124d44ac8745fbb750db3de966c
Instruction Fuzzy Hash: 2811E0B5D106498FDB10CF9AC484BDEFBF4AF89328F14842AD929A7600D374A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125DA3C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0125FE28,?,?,?,?), ref: 0125FE9D

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f2032382e0144debbc84b4406ee02050667e2a197b54216299df69e681df6533
Instruction ID: 4f4adf3f674f1c7f7fa3bc82fc9fbf4b80c2ed6515eeb3eab31a6ee29c560987
Opcode Fuzzy Hash: f2032382e0144debbc84b4406ee02050667e2a197b54216299df69e681df6533
Instruction Fuzzy Hash: CD1133B59002488FDB10CF9AC589BDFBBF8EB48724F20841AE919A3300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125FE38 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0125FE28,?,?,?,?), ref: 0125FE9D

Memory Dump Source

Source File: 00000003.00000002.617616065.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1250000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 0aefc0594756788a1ba92affaae0bd4e9893ad8dc08c20147a0a2bc954a8c23f
Instruction ID: a194159787eaf3053948b3d7c0b74683a04b90cbc3212afe2230fea0de4fce32
Opcode Fuzzy Hash: 0aefc0594756788a1ba92affaae0bd4e9893ad8dc08c20147a0a2bc954a8c23f
Instruction Fuzzy Hash: 6E1100B59002499FDB10CF9AD589BDFFBF8EB48724F20841AE959A7301C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06681AFA Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48aac9a166ad50fdb051648487dff9e195be5688e1cc4f3ce605dff8652c3cb0
Instruction ID: fb8e5a7334275ef3829d780381f0d81e90294ac83e1509f9a65638ee159488a4
Opcode Fuzzy Hash: 48aac9a166ad50fdb051648487dff9e195be5688e1cc4f3ce605dff8652c3cb0
Instruction Fuzzy Hash: 7EE0C23A01C710CFC3012B11B830745BF68EB57311F005962D2008A096AB24480ACAA5

Uniqueness

Uniqueness Score: -1.00%

Function 066830A8 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374ca47271ef81175c020785f700dd152cfc4fe324c836c453d7276fea89e21e
Instruction ID: ee0a018a01cd2ddd6896122ca7fb3860686fcab51cf5ce3423f34ea12f2d4b1c
Opcode Fuzzy Hash: 374ca47271ef81175c020785f700dd152cfc4fe324c836c453d7276fea89e21e
Instruction Fuzzy Hash: 90718C30A04204CFEB54EBB8C494BAAB7F2BF88B04F148659D456B7750DB76ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 066833C0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f168708ff0f00ffa8947c5eab8cbb1147612d9ba32d1a1a95021d36fd8fa7a
Instruction ID: 807cdb1756be551156df101a7e89f32a1b47444d48d36bde1b6b0ecd2edc5444
Opcode Fuzzy Hash: 45f168708ff0f00ffa8947c5eab8cbb1147612d9ba32d1a1a95021d36fd8fa7a
Instruction Fuzzy Hash: 2A315E30A05B40CFD779EFBAC45036ABBE1AF84605F14C96D809B96B60DB76E846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06682E85 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b416644d3777d628b97af37fd63a6e2890de4cabdf708d280bb513e0ecef2c
Instruction ID: 421557d4f76bd21966944cff8e9d9cc777994b480952ade53379f509331c51d9
Opcode Fuzzy Hash: c7b416644d3777d628b97af37fd63a6e2890de4cabdf708d280bb513e0ecef2c
Instruction Fuzzy Hash: 6F3148B1D012489FDB50DFE5D994ADEBBF5BF48314F24802AE809AB350DB349945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06682B6A Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0df968a5903d3bc748cbbbfab22eb4ed61436d55ebd293750dca7c8c8f8958
Instruction ID: 63c473bbfe0970b737033478403034002bbba1a9d7131d0a5e4767d830d69d3f
Opcode Fuzzy Hash: 1d0df968a5903d3bc748cbbbfab22eb4ed61436d55ebd293750dca7c8c8f8958
Instruction Fuzzy Hash: CE31AF706013048FD794EFB4D850AAEBBFAFF89700B50492AE446AB351DB31E945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06680880 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e7a726db3e3b0c01151fc3d614563d3409dc4308660eb81a3e4b62080cfa35
Instruction ID: d47adbb987055934259a3dd0f3cca56f1168280c8b78ab41de55e4f61e510248
Opcode Fuzzy Hash: e9e7a726db3e3b0c01151fc3d614563d3409dc4308660eb81a3e4b62080cfa35
Instruction Fuzzy Hash: 0E21F931B10114CFCB44DB78D884A6DB7B5FF89324B1586AAD519DB362CB30EC0ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 06681F18 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2307cc7b8f9af42abb4989b626bbd1c6f9dd9375d27a4eb222c9fdbbcbd420
Instruction ID: d4bf0faf61df6ec13091a429892c5c63d076006c2d8c5abaca3ac941f7d28436
Opcode Fuzzy Hash: ec2307cc7b8f9af42abb4989b626bbd1c6f9dd9375d27a4eb222c9fdbbcbd420
Instruction Fuzzy Hash: 46216930B102019FDB45ABB5E82D2AEFFE6ABC5304F00852AE016D7794DF348906DB92

Uniqueness

Uniqueness Score: -1.00%

Function 06682B80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbe5f6138576c1326e25604414f18605f05f790cccef11802a2fe80322fed06
Instruction ID: 343a4fc18477987d355ba77b294c652ddbac80a7cdab03aff55cfac1840f55fd
Opcode Fuzzy Hash: bcbe5f6138576c1326e25604414f18605f05f790cccef11802a2fe80322fed06
Instruction Fuzzy Hash: 2E31AD70B013048FD794EFB4C4506AEBBFAFF89200B50492AE4429B750DB31E946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06682E90 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5438720aa9a244d12101974e18931883a35ea6b865678d241384bb8901484e
Instruction ID: b4d2295b0fa5c01ca0109db0a4e830044dfa129549484bc898cb9d491ecd2101
Opcode Fuzzy Hash: 7d5438720aa9a244d12101974e18931883a35ea6b865678d241384bb8901484e
Instruction Fuzzy Hash: B1312670D012489FDB10DFAAC594ADEBBF5AF48314F24842AE419AB350DB749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06682888 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf7da4e1453ac78a833794d10f869ac22668f5010817853a71f18933c2200f5
Instruction ID: 05456f1bf26284476449f0d9b42a420d4177edaa7b31a69b59bdb6a794de763b
Opcode Fuzzy Hash: 9bf7da4e1453ac78a833794d10f869ac22668f5010817853a71f18933c2200f5
Instruction Fuzzy Hash: E421D871A04224DFDF55AB75C4206FDB7BAFB89301F00463AD446AB340DB359A5AC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 06681F28 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17aed57f790d762aae91f26665cb06af8e448eb28d1e48c8c87044ccef090f65
Instruction ID: cf2cd4ed3e267d33c3e1bb0d79aca425e9deedc55341baf98bc3f65335ca4fc7
Opcode Fuzzy Hash: 17aed57f790d762aae91f26665cb06af8e448eb28d1e48c8c87044ccef090f65
Instruction Fuzzy Hash: 4D216B30B103018FDB45ABB5E82D2AEFBE6AFC5305F00852AE416D7790DF349906DB92

Uniqueness

Uniqueness Score: -1.00%

Function 066834E0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed933abd996e0da9462c6bfddf5281abc6231b9c99034902f8ec16abad0b316d
Instruction ID: bce2300afc4aee7b5376e4c2516c69c9379a2e3097ebc26df66b5b3e16b1ce75
Opcode Fuzzy Hash: ed933abd996e0da9462c6bfddf5281abc6231b9c99034902f8ec16abad0b316d
Instruction Fuzzy Hash: EF318875D00308DFCB04DFA4D490A9DBBB1FF48714F20866AE405AB301D772A946CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06680EE0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22fcb6535a58c0b23dea82557774f0b7c8895bccb8d9874c08a7793e6a0d39e2
Instruction ID: 3d1ded0df36a766fcdffcb764fda6bf9d8e965a87d8a40b27f788656be61b61f
Opcode Fuzzy Hash: 22fcb6535a58c0b23dea82557774f0b7c8895bccb8d9874c08a7793e6a0d39e2
Instruction Fuzzy Hash: FC11B6303042418FD3546778D46026F77E6AFD1224794CE5EE45B8B644DF72A807C795

Uniqueness

Uniqueness Score: -1.00%

Function 06681138 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d725dab96223eeb020c684de99db7fbec8d7a9e67257fdf52ddbf9f87c1e73c9
Instruction ID: 072693c6c79f72596da5498a8a8c1eaa30b4da8e279e62fb970e802c23661ff5
Opcode Fuzzy Hash: d725dab96223eeb020c684de99db7fbec8d7a9e67257fdf52ddbf9f87c1e73c9
Instruction Fuzzy Hash: 5411E234700602AFC764E665D8D0D2AF3A6FFCA220B54C21AD49A83B84CB31BC03C790

Uniqueness

Uniqueness Score: -1.00%

Function 06680968 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017bdfde35857ea4bbb7e4d62119cf81ad242997288ac22102052fb37c2e8aff
Instruction ID: 0cdd3c7cb90e704cca999cbc55ab673cc2fe732e71acbe05c95eec4870c7942b
Opcode Fuzzy Hash: 017bdfde35857ea4bbb7e4d62119cf81ad242997288ac22102052fb37c2e8aff
Instruction Fuzzy Hash: 6911C174B043A49FE351EB24E0646967FF2EB09210F404A59E0A68B655CB30AC8ACBD4

Uniqueness

Uniqueness Score: -1.00%

Function 066826F0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95024de74dc55e83304f490d669f93926e3a55211800e7a0dd1297840528673a
Instruction ID: 4e2bc09379ebfd6c4ba4554664cfcdba0fb19af0650ed70bee10b7bdab26e9e9
Opcode Fuzzy Hash: 95024de74dc55e83304f490d669f93926e3a55211800e7a0dd1297840528673a
Instruction Fuzzy Hash: 8D01D131710250AFE7107B79A8699ABBBEAFB8C614741467EF50AD7300DE319C0A87E0

Uniqueness

Uniqueness Score: -1.00%

Function 06682700 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823d5e636ab2653c4cc446123d12045222ebfc4fbfc64d05e25f6b0f01880598
Instruction ID: e2d8bb7e3ce81a5c8544a93dbd6fb95b643ead713dc4cf573a75c4df9afdc16e
Opcode Fuzzy Hash: 823d5e636ab2653c4cc446123d12045222ebfc4fbfc64d05e25f6b0f01880598
Instruction Fuzzy Hash: 16F0C235710210AF97003B7AA8294AFBBEDEBCC610340453AF90BC7300DE319C0287E0

Uniqueness

Uniqueness Score: -1.00%

Function 06680959 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a28175ae3c24f5c313e7272ce215703df8384e08ed2e5f41df0e0415607a12a
Instruction ID: 1390ac6e425868057c0f2740b139a71e8901ee8488344493996bf4b2b7681420
Opcode Fuzzy Hash: 4a28175ae3c24f5c313e7272ce215703df8384e08ed2e5f41df0e0415607a12a
Instruction Fuzzy Hash: A801F574B003A09FE342EB34E0257617FF2EB0E220F454B99E0958B256CB309C8ACBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06682E30 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44103db6a7c2ce116595222d885348b9ed0609b6d6056f8979af23093ca3064e
Instruction ID: 087bbf6d26965070ea34bb620b8147bc8f2a4b48fc95a18408688ea9d25214cc
Opcode Fuzzy Hash: 44103db6a7c2ce116595222d885348b9ed0609b6d6056f8979af23093ca3064e
Instruction Fuzzy Hash: 0EE0E533B082E05EEB74317DA8AC7EAAA8CE7C4276F090277EA0EC775185514945C3E5

Uniqueness

Uniqueness Score: -1.00%

Function 06680218 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10149c995826f9c4d8ce8b59c7218fa85e089285f4aeb86f91b9d450a7d7b0c
Instruction ID: 620bc7afa901c1912cb86c7530355a94bbb407dfbb11ec9f08e9296174b7e3ec
Opcode Fuzzy Hash: a10149c995826f9c4d8ce8b59c7218fa85e089285f4aeb86f91b9d450a7d7b0c
Instruction Fuzzy Hash: 85F07436700A049F8364DA6EE444C57F7F9EFC9621315CA6AE59EC3B24D670F805CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06682DA0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd13b7983f63375cdbc6e1baac62e522b32d7efb893e11724a61a325c4328424
Instruction ID: 4c5b4e73c8e226b527931aa29fbcf42fc819e03189979ff0d9cb8a05a3da2080
Opcode Fuzzy Hash: bd13b7983f63375cdbc6e1baac62e522b32d7efb893e11724a61a325c4328424
Instruction Fuzzy Hash: FEF0E53A3042519FD351E668E83066ABBA9DFC5630B44852ED48A8B300CF61E90787E0

Uniqueness

Uniqueness Score: -1.00%

Function 06681128 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b766d9041b04e549a50b69f419799723bcfd9fbcfaa16c92a89910b0bb505439
Instruction ID: f1a0a27d955421ad05d1fa9be4c05c9a2e1f70834f8d553c3bf395fe16a72bf6
Opcode Fuzzy Hash: b766d9041b04e549a50b69f419799723bcfd9fbcfaa16c92a89910b0bb505439
Instruction Fuzzy Hash: E4E09232304502AFD3149656F890D67FBDAEBCA374B54C12AD51D87B00CA32AC03CA90

Uniqueness

Uniqueness Score: -1.00%

Function 066810DE Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659cd4ea8f646cc9f2795d1d8b3a3d22f810270373d4af23dd076c50f6f7c043
Instruction ID: 25f350654300a0d230abc7843bc818d826e2c3d045f2d77671ef8de8629146dc
Opcode Fuzzy Hash: 659cd4ea8f646cc9f2795d1d8b3a3d22f810270373d4af23dd076c50f6f7c043
Instruction Fuzzy Hash: 71E06832B0D2419FDB85B7B4A8306A47BB49F5F59170101CBE089CB2A2C9105C17C3D5

Uniqueness

Uniqueness Score: -1.00%

Function 06682DB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0e64cdaae8c9a6db7e911da690529fb91b27b5b771bfcf112ae4ea6abee0fc
Instruction ID: 2610173edff773df6048d6af0a8b5169ba6145b206a4170a5c3e3180a86ac295
Opcode Fuzzy Hash: ed0e64cdaae8c9a6db7e911da690529fb91b27b5b771bfcf112ae4ea6abee0fc
Instruction Fuzzy Hash: D0E0D8353005145F4251E668D83049AB79DDEC5524340852ED55A8B300DF61DD0387D0

Uniqueness

Uniqueness Score: -1.00%

Function 066810F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc69da10017526c52a5969a7f65c8c181868d91256c31ade62285c4bf61303f
Instruction ID: 9ef2f7768fab4bc2ae3abdf882f62c2bfbd18daea9760026efa3cbb96c37201d
Opcode Fuzzy Hash: ffc69da10017526c52a5969a7f65c8c181868d91256c31ade62285c4bf61303f
Instruction Fuzzy Hash: 06D0A531714016DF5B44F778A4644B8B3ED9B5F951300125AD18FCB350DD515C2383D5

Uniqueness

Uniqueness Score: -1.00%

Function 06683881 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76501796739ff01ddb3babf9c37c4adc901ee08a4bbb93f5260f097b136bb18
Instruction ID: a003dc50d3139cfd3223042b21dd12f736f9fc69ae5e813ee2ae3b4842840589
Opcode Fuzzy Hash: a76501796739ff01ddb3babf9c37c4adc901ee08a4bbb93f5260f097b136bb18
Instruction Fuzzy Hash: 77E0DF321087818FC380CF38D8A0982FBA4AB412107048A9E906A8B202C720B909CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06681AE8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b7ffeb3754679a6ed9bbe19306de05309f9f88e4b7991ff75c10d7de57ac6b
Instruction ID: 62e2acd60aef556d654285e4011a06de84ba9320944182ffcdfe2e4898694d3b
Opcode Fuzzy Hash: 47b7ffeb3754679a6ed9bbe19306de05309f9f88e4b7991ff75c10d7de57ac6b
Instruction Fuzzy Hash: 16D012715002109F8390EF68D45449AB7E5EB451143448E5E94AA9B300DB61AC068BD4

Uniqueness

Uniqueness Score: -1.00%

Function 06682E00 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acb9be2f1dd312a2bc42bdbfc9befdac759e899631a18584382994afcc0d326
Instruction ID: 772a653aaeac24cf9c77d6c5180c03371c5a7617d7eb667fa590ca4388a8cefd
Opcode Fuzzy Hash: 7acb9be2f1dd312a2bc42bdbfc9befdac759e899631a18584382994afcc0d326
Instruction Fuzzy Hash: 88D0C934208248CFD7946B70906C434B76CAB482093104669900B4B301CA23EAB3C7C8

Uniqueness

Uniqueness Score: -1.00%

Function 06682DF0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9711655f1afc0d4bafc1db12b52ce2532390f3326db9e2143dbb0437c8ecbecf
Instruction ID: b1a097f5619f4be01620b59d84a1379d775696ea484c714d865812e21eb50a14
Opcode Fuzzy Hash: 9711655f1afc0d4bafc1db12b52ce2532390f3326db9e2143dbb0437c8ecbecf
Instruction Fuzzy Hash: 9FD0C773956240CFC34B47A0D5554A17F31FF1975171B049FE44C8A255D66945178710

Uniqueness

Uniqueness Score: -1.00%

Function 06683604 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3352c2c693b27f5ec59c3d8e6b6d914666ec60a310fa775791c780c80d4ab604
Instruction ID: d8b158775c0cd61931f28103aff944237ee0738d4bef946be2bf1996962156d4
Opcode Fuzzy Hash: 3352c2c693b27f5ec59c3d8e6b6d914666ec60a310fa775791c780c80d4ab604
Instruction Fuzzy Hash: 18C04C36A041098EEB005BD4F4563ECFB64F780329F100167E61D525418675066686D2

Uniqueness

Uniqueness Score: -1.00%

Function 066838C1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d49769fe6255aede65972b1f9667edfdc871a8047224813e8591c6fb99391a8
Instruction ID: 37b4fc4443908355c96863aafe79af561f019da33f03e964f3fe32ebd17e088a
Opcode Fuzzy Hash: 7d49769fe6255aede65972b1f9667edfdc871a8047224813e8591c6fb99391a8
Instruction Fuzzy Hash: EAC080355082408FCE0477F0757D6A87F401F10216F55025DD40987690CF215C15C745

Uniqueness

Uniqueness Score: -1.00%

Function 06680EB0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a26ada5c3fef55105947d798d73d7bdb7234a7f73981ea9ac7e6ad98b580df
Instruction ID: 8b4d9ff230adbbb8b77d931651a7b12d981231cae99d9a823037e006d15353bc
Opcode Fuzzy Hash: f2a26ada5c3fef55105947d798d73d7bdb7234a7f73981ea9ac7e6ad98b580df
Instruction Fuzzy Hash: C8C048BD220254CBEB069B21F065B407FA1FB88366F0019A9E02289251DF39888ADF60

Uniqueness

Uniqueness Score: -1.00%

Function 06681DF0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1595ff41c97482bf42c4ea26bea2e7d065925c896352c879ae0456e52744efac
Instruction ID: c6b603a4a9b36bafe71a86c139ffeb97d18482873eab941201ae501201d9ba22
Opcode Fuzzy Hash: 1595ff41c97482bf42c4ea26bea2e7d065925c896352c879ae0456e52744efac
Instruction Fuzzy Hash: 4DB0923401C215DF9395BB62D926D9AFBADEA432017408A12E212450689BA5AA27C5E6

Uniqueness

Uniqueness Score: -1.00%

Function 066838D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.622520136.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6680000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5e79b875dea6c97b6e2cd66f596acf56840ada5208eed4f5128990423fa6e0
Instruction ID: c75de8c4a1c3164a0b461ee42eeda17b008484a10f36c98cc22c74bce2ab959a
Opcode Fuzzy Hash: fe5e79b875dea6c97b6e2cd66f596acf56840ada5208eed4f5128990423fa6e0
Instruction Fuzzy Hash: 7FB012305003084B4D8033F1292D06C7BCC1A402163C00615F80DC37409F267408449A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: jsdudg.exePID: 3448, Parent PID: 936COMMON

Execution Graph

Execution Coverage:	24.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	331
Total number of Limit Nodes:	5

Executed Functions

Function 04B73048 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04B730A8
GetCurrentThread.KERNEL32 ref: 04B730E5
GetCurrentProcess.KERNEL32 ref: 04B73122
GetCurrentThreadId.KERNEL32 ref: 04B7317B

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f8dcbd05847d68e0818449c747c0efd31317e9d3cd53eebe3fbfa4f334e63efb
Instruction ID: 4c99c54ed8be67c91901c8f0bcc6d54e0c3a1b5bb7c5e46a0d077d712830858c
Opcode Fuzzy Hash: f8dcbd05847d68e0818449c747c0efd31317e9d3cd53eebe3fbfa4f334e63efb
Instruction Fuzzy Hash: 155177B0A012488FDB10CFAAC5487DEBBF4EF48318F24849AE459B7350D775A840CF66

Uniqueness

Uniqueness Score: -1.00%

Function 04B78607 Relevance: 1.8, APIs: 1, Instructions: 253
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 04B7884C

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: b6014cebeac8fc103c89edb4f92cface7dde916f1aaaad19530f338ec08b6e19
Instruction ID: 443e11a1f8c043554d39a5dd8f2e3b98f972c32d3ceb070b5524d9b0391855b4
Opcode Fuzzy Hash: b6014cebeac8fc103c89edb4f92cface7dde916f1aaaad19530f338ec08b6e19
Instruction Fuzzy Hash: E6A16D71D002199FDF10DFA9C885BDEBBB2FF48314F0485A9E829A7250DB74A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B78610 Relevance: 1.7, APIs: 1, Instructions: 240
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 04B7884C

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 70558c98bb7b383298b7f95599a8cd5b96bc6e9133c0613ee1f09448790424c6
Instruction ID: fb2e5352af9dfc80739240b21d5413e6ab64ca9626003dc4427118856cd42fec
Opcode Fuzzy Hash: 70558c98bb7b383298b7f95599a8cd5b96bc6e9133c0613ee1f09448790424c6
Instruction Fuzzy Hash: 47917E71D002199FDF10DFA9C885BDEBBB2FF48314F0485A9E829A7250DB74A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B78BB3 Relevance: 1.6, APIs: 1, Instructions: 68
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04B78C45

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe36e0c282b74813cbce022010ac0e258760858e3caf0662a6869260ffa6576e
Instruction ID: 3854f958cc53e96919793ede46b0f9848c170bdc585bd92b3a810eb117f61d50
Opcode Fuzzy Hash: fe36e0c282b74813cbce022010ac0e258760858e3caf0662a6869260ffa6576e
Instruction Fuzzy Hash: 7A2116B19012499FCB10CFAAD985BDEBFF4FB48314F10842AE529A3250D774A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B78BB8 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04B78C45

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c1ca4310a342cc5f3ffa27445579fc108b95a4b18359ced732bd010c312a4377
Instruction ID: 5786c3b12dea816d30728a8ef1a7ad8cc3fb4d5c2aee9334721695c952499e1c
Opcode Fuzzy Hash: c1ca4310a342cc5f3ffa27445579fc108b95a4b18359ced732bd010c312a4377
Instruction Fuzzy Hash: 6021E6B19013499FCB10CFAAD885BDEBFF4FB48314F14842AE519A3240D774A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B73268 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04B732F7

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bd4e498d1ef3fb16b6a862f2d87e34aa583fa79ebdcdf126a97af1edb7decef9
Instruction ID: bb44073070d0d61ed6008258403e45d49f4f94c7b8b47e19466fc5494d2efb08
Opcode Fuzzy Hash: bd4e498d1ef3fb16b6a862f2d87e34aa583fa79ebdcdf126a97af1edb7decef9
Instruction Fuzzy Hash: 4021E4B6D00208AFDB10CF9AD584ADEBFF4EB48324F14841AE958A7310D774A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B73270 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04B732F7

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 38e85ff0d49ebb39c24a1ba8e14a5378d757b8185c2575ceb0a2794990df2659
Instruction ID: 57def6f4d16dd10f825795f130cb3c62549983931cea4fcbaae15c80f5eef075
Opcode Fuzzy Hash: 38e85ff0d49ebb39c24a1ba8e14a5378d757b8185c2575ceb0a2794990df2659
Instruction Fuzzy Hash: 5A21F5B5900208AFDB10CF9AD584ADEBFF8FB48324F14841AE914A3310C374A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B78C88 Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 04B78CEF

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8729a3cedba050469eaa6474f6ceffd8eeea936eef155ac7a63124d1164355ca
Instruction ID: fb5e7d5cabe1fa2cdf3d1194a637f8c4274f9f1adc1f655c2d05c5b0b3ceb0f2
Opcode Fuzzy Hash: 8729a3cedba050469eaa6474f6ceffd8eeea936eef155ac7a63124d1164355ca
Instruction Fuzzy Hash: CB2106B2900649CFDB10DF9AD449BDEFBF4FB48324F24846AD929A3240D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B7898B Relevance: 1.6, APIs: 1, Instructions: 61
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04B78A07

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7479282d07ca082fa09e94c9c8e4d805df11c192937e2d6958cf71dcacb09294
Instruction ID: 252efb4e0451e2770884dd70d651781613c6a5bee9342a2c6064e22338b72a3c
Opcode Fuzzy Hash: 7479282d07ca082fa09e94c9c8e4d805df11c192937e2d6958cf71dcacb09294
Instruction Fuzzy Hash: A421F7B1D006199FDB00CF9AD4857DEFBF4FB48224F14856AD428B7240D778A9458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B78A4B Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04B78AC6

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: aab32b80f39e80ad7deec1fd81031be14e6f62e4d7a7509cbbcfa0d9ec3d59ac
Instruction ID: 02cb894cac82ebcca3c7185da64fa823782d5133c6e771c1114d5e10aa56ec82
Opcode Fuzzy Hash: aab32b80f39e80ad7deec1fd81031be14e6f62e4d7a7509cbbcfa0d9ec3d59ac
Instruction Fuzzy Hash: 722106B29002499FCB10CF9AD884BDEFBF4FF48324F148429E529A7250D378A945DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B78990 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04B78A07

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: fcd8eff77f953e49487b75526057a37b067ede2f20cbc4c555aed7b050916b66
Instruction ID: 8c306a5f72fdb3cb38d6c714a5081da77e40a535b40f178e26256e259f43e44c
Opcode Fuzzy Hash: fcd8eff77f953e49487b75526057a37b067ede2f20cbc4c555aed7b050916b66
Instruction Fuzzy Hash: BD2106B1D006199FCB00CF9AC889BDEFBF4FB48324F54816AE418B3240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B78A50 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04B78AC6

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c46cab459c24b814ffb3a4d470ebc002f3c71448998aeed0398f93394febcc2a
Instruction ID: 8200d8d28198574b316ad56b4d3003bdb497c410d319360b95b49efb36635d94
Opcode Fuzzy Hash: c46cab459c24b814ffb3a4d470ebc002f3c71448998aeed0398f93394febcc2a
Instruction Fuzzy Hash: 5E21D6B29002499FCB10DF9AD884BDEBBF4FF48324F148429E569A7250D374A545DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B78B0B Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04B78B7B

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b58a24656bb978b7f93ecf0d6fce1bc155617ad146517e4429c272395f771a59
Instruction ID: 6498c4246545080272faa0d970a62ee3b7119cb48cb2e72cb3286d41b60d7757
Opcode Fuzzy Hash: b58a24656bb978b7f93ecf0d6fce1bc155617ad146517e4429c272395f771a59
Instruction Fuzzy Hash: E51113B29002499FCB10DF9AD888BDEBFF4FB48324F148819E529A7210C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B72EEC Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 04B7484D

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 33c679521e4dc7b480eb4d8bf0508f294f773462cd69bf6b7563fa10d0681881
Instruction ID: a0f761bdd91a9144b67879540fd31e8a144274439877edead0a019c771692c21
Opcode Fuzzy Hash: 33c679521e4dc7b480eb4d8bf0508f294f773462cd69bf6b7563fa10d0681881
Instruction Fuzzy Hash: C61106B59007489FCB10DF9AD888BDFBFF4EB48324F148469E529A7240D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B78B10 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04B78B7B

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c95e4a2f451b4e5b44af2779244f958458825dd5d74c8750da9bfd48984af02
Instruction ID: a4eef7a868bbfa748c7cdb90a01dd1a1426ed83d2f387465eee9df3bcf3ef2e8
Opcode Fuzzy Hash: 0c95e4a2f451b4e5b44af2779244f958458825dd5d74c8750da9bfd48984af02
Instruction Fuzzy Hash: 1911E3B69003499FCB10DF9AD888BDEBFF4EB48324F148419E529A7250C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B747E2 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 04B7484D

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 089f66b90da1fe3208c7b5cb57a128a3d7cdf498d22d2e5c04155fce5565a460
Instruction ID: 9955cb2af49981ed2681a8352c9b56bf577e002db129d618b1bc7913e2544550
Opcode Fuzzy Hash: 089f66b90da1fe3208c7b5cb57a128a3d7cdf498d22d2e5c04155fce5565a460
Instruction Fuzzy Hash: 8B1106B29002489FCB10DF9AD484BDEBFF4EB48324F248469D529A7240C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B78C90 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04B78CEF

Memory Dump Source

Source File: 0000000A.00000002.401928164.0000000004B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b70000_jsdudg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 66862ed8f068e4ee972acfdd4bad56656930f2dd875eaf3d3e6dff7cfff78132
Instruction ID: f353de427adaf354dd7b869ab156b30652af9c864fd79103c5d5e699faa90481
Opcode Fuzzy Hash: 66862ed8f068e4ee972acfdd4bad56656930f2dd875eaf3d3e6dff7cfff78132
Instruction Fuzzy Hash: 1C11E2B19002499FDB10DF9AD888BDEBBF8EB48324F24845AD529A7240D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 5684, Parent PID: 3448COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	4

Executed Functions

Function 0287FAA0 Relevance: 1.8, APIs: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0287FD0A

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6dcf74aad42c3a6e8df63c7e5d698c34cff2b8d9a00999ad884276aa78ca01c7
Instruction ID: 3cbb220eb4b582d766d9445c4d8e4544972fcc2ff1c4ed9beedb2c5bd017d8da
Opcode Fuzzy Hash: 6dcf74aad42c3a6e8df63c7e5d698c34cff2b8d9a00999ad884276aa78ca01c7
Instruction Fuzzy Hash: 1F917CB5C08388DFDB16DFA9C8909CDBFB1FF0A314F19819AE844AB162DB349955CB11

Uniqueness

Uniqueness Score: -1.00%

Function 028793E8 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0287962E

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 70abe337c45524a89d37b40ac3a998a1f989d243d388c6ba547993adad9cefa6
Instruction ID: 179c2dcdb5968b6cb11231e3d75ec3b2a2c58f659b83ea1cfe72f955169fa7d8
Opcode Fuzzy Hash: 70abe337c45524a89d37b40ac3a998a1f989d243d388c6ba547993adad9cefa6
Instruction Fuzzy Hash: 58713478A00B058FD724DF6AD44579ABBF1BF88318F008A2ED48AD7A50D734E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0287D9E8 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0287FD0A

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1fac88ac53f7eb7764f8c65b5254d202924b0f20cc364301a720cdebeda10208
Instruction ID: 9dcecf357b270efe44298b91ec644b31a94a0d9da7eb56e4ac0c34b3df13f7d5
Opcode Fuzzy Hash: 1fac88ac53f7eb7764f8c65b5254d202924b0f20cc364301a720cdebeda10208
Instruction Fuzzy Hash: 4851FEB5D003589FDF14CFAAC890ADEBFB5BF59314F24812AE819AB210D770A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0287DA04 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0287FD0A

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d8ad5d0a0076962cddef5d1c4d27e8ad47dc9d1005c2b204d9890820b4c4d81a
Instruction ID: 2b1520a62d536e04d9a8d18e88e75a60f32a935bfcf5e8f921048010d04e1576
Opcode Fuzzy Hash: d8ad5d0a0076962cddef5d1c4d27e8ad47dc9d1005c2b204d9890820b4c4d81a
Instruction Fuzzy Hash: 4E51CEB5D003199FDF14CF9AC884ADEBBB5BF58314F24812AE919AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0287FE03 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0287FE28,?,?,?,?), ref: 0287FE9D

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: df70ec6319b414a13942399b0e14caca332b50434e534d54895cbd0373e366b4
Instruction ID: 2caff76b5fc18df369d0af31378e400e6fb68ce0d7bc8b159af7604ba2c8db5a
Opcode Fuzzy Hash: df70ec6319b414a13942399b0e14caca332b50434e534d54895cbd0373e366b4
Instruction Fuzzy Hash: 86219AB9800248DFCB11CF99E484BCABBF4FF59318F14844AE948AB212D735A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0287BCF9 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0287BCC6,?,?,?,?,?), ref: 0287BD87

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1073f7ce893e4a189740e62e2627b812873478bd52a93e05759cb8118d0d2339
Instruction ID: 96f86a09719d9ee79e8bf4ba1f55de63f7d53d6b3f2696dacfa4f18641030a47
Opcode Fuzzy Hash: 1073f7ce893e4a189740e62e2627b812873478bd52a93e05759cb8118d0d2339
Instruction Fuzzy Hash: 1621E6B59002089FDF10CF9AD484ADEBFF5EB48324F14841AE958A3310D774A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0287A14C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0287BCC6,?,?,?,?,?), ref: 0287BD87

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6c2c12ea527e703b9642c1852efc189ea7ba7264f1d0f276fd4f38a01aa5b986
Instruction ID: f50a8819a16f1be0b9b0ba1fdce49bb298cb37aee7c6ba37e886e16e8e02cfcb
Opcode Fuzzy Hash: 6c2c12ea527e703b9642c1852efc189ea7ba7264f1d0f276fd4f38a01aa5b986
Instruction Fuzzy Hash: AD21E4B5900248AFDB10CF9AD884ADEBFF9EB48324F14841AE958B3310D374A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02879849 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,028796A9,00000800,00000000,00000000), ref: 028798BA

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8e26f796a64fd294b3f52dbd0111e2812211eb15522f1cae5bbaefd545bdf427
Instruction ID: d88dffbfce6b45a428a5ee2bdf2ad9627033d44051d4ba812bc31b2ff83bbaf8
Opcode Fuzzy Hash: 8e26f796a64fd294b3f52dbd0111e2812211eb15522f1cae5bbaefd545bdf427
Instruction Fuzzy Hash: 0911D3BA9002499FDB10CF9AD444ADEFBF4EB48328F14842EE959A7600C774A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02878768 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,028796A9,00000800,00000000,00000000), ref: 028798BA

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2d1fd4253aaaf447ba1c8f5a4bae7516e97e16d3a4ede7ce5e7be65977e09043
Instruction ID: b9e50694a882fda9fec73ecc85fc759e7026bfec27934dd073cfcb60d85bf549
Opcode Fuzzy Hash: 2d1fd4253aaaf447ba1c8f5a4bae7516e97e16d3a4ede7ce5e7be65977e09043
Instruction Fuzzy Hash: 4A1103BA9002098FDB10CF9AC444ADEFBF8EB48324F14842EE919B7600C374A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 028795C8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0287962E

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 871ea62b07d0f885815de86b052f4743c7569f58da4f14db0c9e816441afcd2d
Instruction ID: 736ab945dbdd59f1662e6d26f40ae90875bcc1ba31b94820569c365983b2ea31
Opcode Fuzzy Hash: 871ea62b07d0f885815de86b052f4743c7569f58da4f14db0c9e816441afcd2d
Instruction Fuzzy Hash: BA11E0B9D006498FDB20CF9AD444BDEFBF4AB88228F14852AD959A7600D374A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0287DA3C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0287FE28,?,?,?,?), ref: 0287FE9D

Memory Dump Source

Source File: 0000000C.00000002.419302510.0000000002870000.00000040.00000800.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2870000_RegAsm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 891c0c2075801c5ca605818ffa3b0348863926936dbfe2e7c1ab381880e3953c
Instruction ID: 8dd6baa903c0aeb6a0088b7edfd6b4067c159f2e80a76e296c03f9db6b81e901
Opcode Fuzzy Hash: 891c0c2075801c5ca605818ffa3b0348863926936dbfe2e7c1ab381880e3953c
Instruction Fuzzy Hash: 321136B59002488FDB10CF8AD484BDFBBF8EB58324F20841AEA19B7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: jsdudg.exePID: 6692, Parent PID: 936COMMON

Execution Graph

Execution Coverage:	16.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	4

Executed Functions

Function 01733018 Relevance: 6.1, APIs: 4, Instructions: 149
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017330A8
GetCurrentThread.KERNEL32 ref: 017330E5
GetCurrentProcess.KERNEL32 ref: 01733122
GetCurrentThreadId.KERNEL32 ref: 0173317B

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fe6489e1092355bfeb35b5135eedae07eec47344b263cd8bfc7548446d357c0e
Instruction ID: 1ccda66fd2b6fdd7af327fb6766315cbe8a7b9789d9161c1d7554d6e4f43ffb2
Opcode Fuzzy Hash: fe6489e1092355bfeb35b5135eedae07eec47344b263cd8bfc7548446d357c0e
Instruction Fuzzy Hash: ED61CFB09053888FDB15CFA9C9487CEFFF5BF4A318F14849AD049A7292D7745844CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01733048 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 017330A8
GetCurrentThread.KERNEL32 ref: 017330E5
GetCurrentProcess.KERNEL32 ref: 01733122
GetCurrentThreadId.KERNEL32 ref: 0173317B

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aabcbd844ca61dd423f02a1d206656577ad54c15a83b2cadefa285098a536453
Instruction ID: 34eee9b2e7b67d7858706a32d1841d484a7abb66bde4e5ee313ac177f6cbbd95
Opcode Fuzzy Hash: aabcbd844ca61dd423f02a1d206656577ad54c15a83b2cadefa285098a536453
Instruction Fuzzy Hash: 305167B0A016498FDB24CFAAC548BDEFBF5BF88318F208469E049A7391D7749844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01738604 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 0173884C

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 2ee74b61998c4624aaea5c07064f355f40ea9706bcb7ed1ff4e138a076ab69e4
Instruction ID: 587328ce52765fc07f66022fef7a15291bcc8ef04d9276ee552d2db25fdc99a5
Opcode Fuzzy Hash: 2ee74b61998c4624aaea5c07064f355f40ea9706bcb7ed1ff4e138a076ab69e4
Instruction Fuzzy Hash: 32A14B71D002198FDB11CFA9C8417DEFBB6BF88314F0486A9E858A7242DB759985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01738610 Relevance: 1.7, APIs: 1, Instructions: 240
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 0173884C

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: cd064495331ce06d36cbff694bdfb955ae61f8f8613b7593e33231457da591f4
Instruction ID: 1da22fa15d53d6aeea5ba8b42231bf0205d86647a75471ce2fdc8f7907e5dc21
Opcode Fuzzy Hash: cd064495331ce06d36cbff694bdfb955ae61f8f8613b7593e33231457da591f4
Instruction Fuzzy Hash: F3915C71D002198FDB11CFA9C841BDEFBB6FF88314F0482A9E858A7251DB759985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01733268 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017332F7

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aac1b033f4b6fe2e4b3009379f00e0f707468ef37294f444d9ba12d5ecd859e3
Instruction ID: 02448b87320415f83ebf314ddfe627eb6f605ae1580ea6e306199d4320a8dc28
Opcode Fuzzy Hash: aac1b033f4b6fe2e4b3009379f00e0f707468ef37294f444d9ba12d5ecd859e3
Instruction Fuzzy Hash: EF21D2B59012089FDB10CFAAD984AEEBBF4FB48324F14841AE955A7310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738BB3 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01738C45

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a1cb93aa4d1056aed41be8d7955c15ab27eccf954b3d5ec130522c65281b5e19
Instruction ID: a776bcc3c54ce756c03e93ad5e31b0f03791447a6178e17e7746d9c5ec06a1d2
Opcode Fuzzy Hash: a1cb93aa4d1056aed41be8d7955c15ab27eccf954b3d5ec130522c65281b5e19
Instruction Fuzzy Hash: DD2100B19013499FDB10CF9AC885BDEFBF4FB48324F54852AE918A3240D778A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738BB8 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01738C45

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4dd1b8862231d915e84e50e63de0b34496fbbe2e1557727990cf53fc4b56d342
Instruction ID: 7aa861b865fd066236b87269f9b296fd2f29f5f01812cf41f697e022d4b637c5
Opcode Fuzzy Hash: 4dd1b8862231d915e84e50e63de0b34496fbbe2e1557727990cf53fc4b56d342
Instruction Fuzzy Hash: 672112B19013499FDB10CF9AC884BDEFBF4FB48324F10852AE918A3240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738988 Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01738A07

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 52abdf2288286878d4841e061990721e6a784ea693e4901abae9692afb2b3d18
Instruction ID: d18074b4eefc59a913ddc4ccdc30aadeeff49bf0876dec5a0e1ca324300d8821
Opcode Fuzzy Hash: 52abdf2288286878d4841e061990721e6a784ea693e4901abae9692afb2b3d18
Instruction Fuzzy Hash: 7B213BB1D002199FDB10CF9AC5857DEFBF8BB49224F54812AE518B3341D778A945CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01733270 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017332F7

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9b5e0fd157f883ae97051c2003ebf48063ca230718c0971692cdcd68fff798a9
Instruction ID: 982dbec70dc3a57082e8dcedfb74fd02a06ef8104d865f607d4151fa4ee58991
Opcode Fuzzy Hash: 9b5e0fd157f883ae97051c2003ebf48063ca230718c0971692cdcd68fff798a9
Instruction Fuzzy Hash: 7321F3B59012089FDB10CFAAD984ADEFFF8FB48324F14841AE954A3310C378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738990 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01738A07

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: b9d63cf601c53e80e81c43614f427e624348cc20aada42586078555ab7f71eb2
Instruction ID: 138abcb8554505d095d90ddec925be4c18efdf61cffba521a9d6baa7814f782e
Opcode Fuzzy Hash: b9d63cf601c53e80e81c43614f427e624348cc20aada42586078555ab7f71eb2
Instruction Fuzzy Hash: 062117B1D006199FDB10CF9AC985BDEFBF4BB48624F54812AE418B3341D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738A4B Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01738AC6

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 84fbf214785430267bf6d7991024a1d4137409002db163b9ec4b9b9749ee3523
Instruction ID: f699dae14eda165d00b7205d94638bb59243d299aca5b04a1d90918ded68eb41
Opcode Fuzzy Hash: 84fbf214785430267bf6d7991024a1d4137409002db163b9ec4b9b9749ee3523
Instruction Fuzzy Hash: E421F4B29002499FCB10CF9AC884BDEFBF4FB48324F54842AE558A3251D378A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738A50 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01738AC6

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e9e7cce2c124565b592c5e21171373cb986ace2791c7486b2bbb8a2abb3220c5
Instruction ID: 01138790fd7f71669f0412244ade5de108688a42a4cf3c5b09e1fd8265f87f59
Opcode Fuzzy Hash: e9e7cce2c124565b592c5e21171373cb986ace2791c7486b2bbb8a2abb3220c5
Instruction Fuzzy Hash: C32106B19002499FCB10CF9AC884BDEFBF4FB48324F14842AE558A3250D378A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738B08 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01738B7B

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0296666c19b532d4ad2c7b1bc5f631dc868eec599e851906d86c50e394920b97
Instruction ID: f2e4e7c3aa2c2564a83232058682c36105fef47b89a4b3da09c0a74fffcac0ab
Opcode Fuzzy Hash: 0296666c19b532d4ad2c7b1bc5f631dc868eec599e851906d86c50e394920b97
Instruction Fuzzy Hash: 091104B59002499FCB24CF9AC984BDEFFF8FB88324F148419E568A7250C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01738C88 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 01738CEF

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7ca734f304f7596c87e6c4759d671f612c98417eeac1b3a074f4cbc50a42cb1b
Instruction ID: c6c4f994e357d22a874566aea459c5cb74d3620cdeac3d6a82eb3c756ea26b14
Opcode Fuzzy Hash: 7ca734f304f7596c87e6c4759d671f612c98417eeac1b3a074f4cbc50a42cb1b
Instruction Fuzzy Hash: 901155B19043488FCB10CF99C888BCEFFF4AB49324F14845AE568A3241D774A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 01732EEC Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 0173484D

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 953da3a266b42c1ec629e6b76af1db347872cb9ed85f7469607da67002a11067
Instruction ID: a883eccc66254e64dc000655d1a7cb69111412907fcbf40414b1b8bb7d1125b1
Opcode Fuzzy Hash: 953da3a266b42c1ec629e6b76af1db347872cb9ed85f7469607da67002a11067
Instruction Fuzzy Hash: 2511E3B59006499FDB10DF9AD884BDEFBF4EB88324F10842AE659A7241C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01738B10 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01738B7B

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2c1b11bf1f110be1ff5f44c8e2001448dd40c540b1f2d861b40f6a414902df39
Instruction ID: 22cc8a4e0e5d0ee6a24d8f3e12a220c0b477c222454ea17e566019843fc84b2f
Opcode Fuzzy Hash: 2c1b11bf1f110be1ff5f44c8e2001448dd40c540b1f2d861b40f6a414902df39
Instruction Fuzzy Hash: DC11E0B59003499FDB10CF9AC884BDEBFF8FB88324F14841AE569A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017347E3 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,?), ref: 0173484D

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 365e95c5e5998ab6657aca570b1a4597d1633eb8adc5570fd2b567398c51bd50
Instruction ID: ff0ae4870d5e1dc32d87823b723e1b5979886d41e42e0f9524608d40175e9e58
Opcode Fuzzy Hash: 365e95c5e5998ab6657aca570b1a4597d1633eb8adc5570fd2b567398c51bd50
Instruction Fuzzy Hash: 7E11E3B59002499FDB20DF9AD884BDEBBF4FB88324F148529D559A7344C374A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01738C90 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 01738CEF

Memory Dump Source

Source File: 0000001C.00000002.523708407.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_1730000_jsdudg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e575b22187c6d8f54da6cbaefcd17ca4a760c489f1817644662af1522c5cedea
Instruction ID: cd4416f4de91e68c21c60ff19c930e7263678cf09eb28e39b1e83c7a5c285d92
Opcode Fuzzy Hash: e575b22187c6d8f54da6cbaefcd17ca4a760c489f1817644662af1522c5cedea
Instruction Fuzzy Hash: D41115B19002498FDB10CF9AC488BDEFBF4EB48324F10841AE559A3240C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gruopon.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection

E-Banking Fraud

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Jbx Signature Overview

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gruopon.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsdudg.exe.log

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

C:\Users\user\AppData\Roaming\jsdudg.exe

C:\Users\user\AppData\Roaming\jsdudg.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
gruopon.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre