Windows Analysis Report
5JbQqP8SDG.exe

Overview

General Information

Sample Name:	5JbQqP8SDG.exe
Analysis ID:	623788
MD5:	250d122f4af32b52435a02787689ebbd
SHA1:	39346c41bcb75109dac251320d4afea649538f85
SHA256:	14f5c3ab5cbad5d2f6e751e8b3d42204460b8b10a38285623734d631a2ceda09
Tags:	exeNanoCoreRAT
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Connects to many ports of the same IP (likely port scanning)

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: 5JbQqP8SDG.exe	Virustotal: Detection: 57%			Perma Link
Source: 5JbQqP8SDG.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\GryVAO.exe	ReversingLabs: Detection: 63%

Yara detected Nanocore RAT

Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Machine Learning detection for sample

Source: 5JbQqP8SDG.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\GryVAO.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack	Avira: Label: TR/NanoCore.fadte
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Uses 32bit PE files

Source: 5JbQqP8SDG.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 5JbQqP8SDG.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.19.85.175 ports 0,1,2,4,5,50421

Uses dynamic DNS services

Source: unknown

DNS query: name: lowspeed121.ddns.net

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49775 -> 185.19.85.175:50421

Source: 5JbQqP8SDG.exe, 00000000.00000003.438967518.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.440205423.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com=
Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 5JbQqP8SDG.exe, 00000000.00000003.455928032.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.p
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 5JbQqP8SDG.exe, 00000000.00000003.444977276.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.445248230.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.445508362.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comexc
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.co
Source: 5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com.
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 5JbQqP8SDG.exe, 00000000.00000003.450491433.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450590496.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450679414.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaK
Source: 5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaU
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450417445.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450417445.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comepko8
Source: 5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comf
Source: 5JbQqP8SDG.exe, 00000000.00000003.448954375.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comicTF
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comc
Source: 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comce
Source: 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comu
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.c
Source: 5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn=
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442824583.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnH
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442824583.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnU
Source: 5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-nFp0
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnsof
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 5JbQqP8SDG.exe, 00000000.00000003.454422256.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmc
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 5JbQqP8SDG.exe, 00000000.00000003.439756929.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439331188.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439537582.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439370513.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439404974.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439577851.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com=
Source: 5JbQqP8SDG.exe, 00000000.00000003.439756929.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439331188.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439537582.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439370513.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439404974.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439577851.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comK
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.441648603.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 5JbQqP8SDG.exe, 00000000.00000003.441648603.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr%
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440416859.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440348993.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440205423.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deX
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: lowspeed121.ddns.net

Creates a DirectInput object (often for capturing keystrokes)

Source: 5JbQqP8SDG.exe, 00000000.00000002.485929234.0000000000F30000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Installs a raw input device (often for capturing keystrokes)

Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Process information set: 01 00 00 00

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00792A9A	0_2_00792A9A
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00F2C084	0_2_00F2C084
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00F2E398	0_2_00F2E398
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00F2E388	0_2_00F2E388
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 6_2_007E2A9A	6_2_007E2A9A
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_001A2A9A	11_2_001A2A9A
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_00ABC084	11_2_00ABC084
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_00ABE388	11_2_00ABE388
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_00ABE398	11_2_00ABE398
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_00DA2A9A	14_2_00DA2A9A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_02F7E398	14_2_02F7E398
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_02F7E388	14_2_02F7E388
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_02F7C084	14_2_02F7C084
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80BB0	14_2_07E80BB0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E88B68	14_2_07E88B68
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89F70	14_2_07E89F70
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E81350	14_2_07E81350
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8A5F8	14_2_07E8A5F8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E82148	14_2_07E82148
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E83028	14_2_07E83028
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8D430	14_2_07E8D430
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E82FE6	14_2_07E82FE6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8A3D8	14_2_07E8A3D8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85780	14_2_07E85780
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85380	14_2_07E85380
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85370	14_2_07E85370
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85770	14_2_07E85770
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E81340	14_2_07E81340
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E88B58	14_2_07E88B58
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80B21	14_2_07E80B21
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E862C8	14_2_07E862C8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E862C3	14_2_07E862C3
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84AA0	14_2_07E84AA0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89698	14_2_07E89698
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84A90	14_2_07E84A90
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89696	14_2_07E89696
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8DE48	14_2_07E8DE48
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E855A0	14_2_07E855A0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84DA0	14_2_07E84DA0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84D90	14_2_07E84D90
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85593	14_2_07E85593
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8CD70	14_2_07E8CD70
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85148	14_2_07E85148
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E82142	14_2_07E82142
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8513A	14_2_07E8513A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8A8B0	14_2_07E8A8B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89068	14_2_07E89068
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80040	14_2_07E80040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8E430	14_2_07E8E430
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80006	14_2_07E80006
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E83007	14_2_07E83007
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E88C19	14_2_07E88C19

Source: 5JbQqP8SDG.exe, 00000000.00000002.491013592.0000000003290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000000.435226561.0000000000828000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.494434677.0000000007CF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.485929234.0000000000F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.492892204.00000000040CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000000.480282056.0000000000878000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.601550993.00000000071D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.597247908.0000000002C40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.580726200.0000000000238000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 5JbQqP8SDG.exe

Source: 5JbQqP8SDG.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: GryVAO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: unknown	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe "C:\Users\user\Desktop\5JbQqP8SDG.exe"
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe C:\Users\user\Desktop\5JbQqP8SDG.exe 0
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp3E23.tmp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp5777.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp58BF.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp3E23.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp5777.tmp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior

Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6652:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_01
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{3f629223-43f7-4f4e-b56f-3f91ee5e5e46}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_01

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen

Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07AF2224 push dword ptr [edx+ebp*2-75h]; iretd	14_2_07AF223F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07AF2142 push dword ptr [ebx+ebp-75h]; iretd	14_2_07AF214D
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E86710 push 93FFFFFEh; iretd	14_2_07E86715

Source: initial sample	Static PE information: section name: .text entropy: 7.65135197379
Source: initial sample	Static PE information: section name: .text entropy: 7.65135197379
Source: initial sample	Static PE information: section name: .text entropy: 7.65135197379

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File created: C:\Users\user\AppData\Roaming\GryVAO.exe			Jump to dropped file
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe			Jump to dropped file

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe TID: 7064	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe TID: 6556	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe TID: 632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Window / User API: threadDelayed 6415	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Window / User API: threadDelayed 2992	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Window / User API: foregroundWindowGot 705	Jump to behavior

Windows Analysis Report 5JbQqP8SDG.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
5JbQqP8SDG.exe

Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process token adjusted: Debug	Jump to behavior

Source: 5JbQqP8SDG.exe, 00000006.00000002.721142281.00000000060DB000.00000004.00000010.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.722065655.0000000006EDE000.00000004.00000010.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.716969758.0000000002CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 5JbQqP8SDG.exe, 00000006.00000002.719382712.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719096304.0000000002CED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerx
Source: 5JbQqP8SDG.exe, 00000006.00000002.719647422.0000000003012000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719382712.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719493359.0000000002F16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerL@
Source: 5JbQqP8SDG.exe, 00000006.00000002.716969758.0000000002CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert
Source: 5JbQqP8SDG.exe, 00000006.00000002.719647422.0000000003012000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager8%n2

Source: 5JbQqP8SDG.exe, 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: 5JbQqP8SDG.exe, 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost

ID:	623788
Product:	CloudBasic
Start time:	20:23:39
Start date:	10.05.2022
Sample:	5JbQqP8SDG.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	250d122f4af32b52435a02787689ebbd
SHA1:	39346c41bcb75109dac251320d4afea649538f85
SHA256:	14f5c3ab5cbad5d2f6e751e8b3d42204460b8b10a38285623734d631a2ceda09
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	250D122F4AF32B52435A02787689EBBD	39346C41BCB75109DAC251320D4AFEA649538F85	14F5C3AB5CBAD5D2F6E751E8B3D42204460B8B10A38285623734D631A2CEDA09
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5JbQqP8SDG.exe.log	ASCII text, with CRLF line terminators	69206D3AF7D6EFD08F4B4726998856D3	E778D4BF781F7712163CF5E2F5E7C15953E484CF	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log	ASCII text, with CRLF line terminators	69206D3AF7D6EFD08F4B4726998856D3	E778D4BF781F7712163CF5E2F5E7C15953E484CF	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
C:\Users\user\AppData\Local\Temp\tmp3E23.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	C6382A296ACE45E0D6C9A4A14FF67E89	319FCC78DEC52BCB03209FC3A9FFB4007602874D	13F650B6E05BB9EBA9D6AFAE4E792DF61FDF029DFBF87ABD0B9EE983FDB91286
C:\Users\user\AppData\Local\Temp\tmp5777.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	C6382A296ACE45E0D6C9A4A14FF67E89	319FCC78DEC52BCB03209FC3A9FFB4007602874D	13F650B6E05BB9EBA9D6AFAE4E792DF61FDF029DFBF87ABD0B9EE983FDB91286
C:\Users\user\AppData\Local\Temp\tmpBD8.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	5C2F41CFC6F988C859DA7D727AC2B62A	68999C85FC7E37BAB9216E0099836D40D4545C1C	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
C:\Users\user\AppData\Local\Temp\tmpBE25.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	C6382A296ACE45E0D6C9A4A14FF67E89	319FCC78DEC52BCB03209FC3A9FFB4007602874D	13F650B6E05BB9EBA9D6AFAE4E792DF61FDF029DFBF87ABD0B9EE983FDB91286
C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	397A97E4D9348E8C5A0A1AABCE2A141A	4165A2A21BB901CB63655774AD8E3B6F6B894FFF	FC8358E632BD6B1AD28318263F46F30F57022D6692F503212DA2123ED60294DA
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	data	ED8BF78CAA6512D8C4DE221FC892B8E7	0C2CFB8F84BA2873E0195BE895E3BFFD9DAA5A5D	D12CB0817649797E02AEBAC918FD4C3FDA757086CE726BBA9781FAF6D165AF0B
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat	ASCII text, with no line terminators	E123BF011BFA42FE28C547BEB8B24E19	C481D8D3A7E0AFA805432B15C37545B946149727	036BB6A73DF879739586F448D30FDC203B230C314FA7CFE57D9427B677CD19FA
C:\Users\user\AppData\Roaming\GryVAO.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	250D122F4AF32B52435A02787689EBBD	39346C41BCB75109DAC251320D4AFEA649538F85	14F5C3AB5CBAD5D2F6E751E8B3D42204460B8B10A38285623734D631A2CEDA09