Edit tour

Windows Analysis Report
5JbQqP8SDG.exe

Overview

General Information

Sample Name:	5JbQqP8SDG.exe
Analysis ID:	623788
MD5:	250d122f4af32b52435a02787689ebbd
SHA1:	39346c41bcb75109dac251320d4afea649538f85
SHA256:	14f5c3ab5cbad5d2f6e751e8b3d42204460b8b10a38285623734d631a2ceda09
Tags:	exeNanoCoreRAT
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Connects to many ports of the same IP (likely port scanning)

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

5JbQqP8SDG.exe (PID: 7036 cmdline: "C:\Users\user\Desktop\5JbQqP8SDG.exe" MD5: 250D122F4AF32B52435A02787689EBBD)

schtasks.exe (PID: 6368 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

5JbQqP8SDG.exe (PID: 4676 cmdline: {path} MD5: 250D122F4AF32B52435A02787689EBBD)

schtasks.exe (PID: 1408 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5564 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

5JbQqP8SDG.exe (PID: 5976 cmdline: C:\Users\user\Desktop\5JbQqP8SDG.exe 0 MD5: 250D122F4AF32B52435A02787689EBBD)

schtasks.exe (PID: 4536 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp3E23.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

5JbQqP8SDG.exe (PID: 7040 cmdline: {path} MD5: 250D122F4AF32B52435A02787689EBBD)

dhcpmon.exe (PID: 6388 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: 250D122F4AF32B52435A02787689EBBD)

schtasks.exe (PID: 4176 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp5777.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 4788 cmdline: {path} MD5: 250D122F4AF32B52435A02787689EBBD)

dhcpmon.exe (PID: 6700 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: 250D122F4AF32B52435A02787689EBBD)

schtasks.exe (PID: 7052 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp58BF.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 2260 cmdline: {path} MD5: 250D122F4AF32B52435A02787689EBBD)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69463:$a: NanoCore 0x694bc:$a: NanoCore 0x694f9:$a: NanoCore 0x69572:$a: NanoCore 0x6ed2a:$a: NanoCore 0x6ed74:$a: NanoCore 0x6ef5e:$a: NanoCore 0x694c5:$b: ClientPlugin 0x69502:$b: ClientPlugin 0x69e00:$b: ClientPlugin 0x69e0d:$b: ClientPlugin 0x6eac3:$b: ClientPlugin 0x6ed33:$b: ClientPlugin 0x6ed7d:$b: ClientPlugin 0x6f295:$c: ProjectData 0x5d01c:$e: KeepAlive 0x6994d:$g: LogClientMessage 0x6f188:$g: LogClientMessage 0x698cd:$i: get_Connected 0x5d0bf:$j: #=q 0x5d0ef:$j: #=q
00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x16a6:$i3: IClientNetwork 0x1660:$i6: IClientLoggingHost 0x13df:$s1: ClientPlugin 0x1699:$s1: ClientPlugin
00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4859d:$a: NanoCore 0x485f6:$a: NanoCore 0x48633:$a: NanoCore 0x486ac:$a: NanoCore 0x4dc41:$a: NanoCore 0x4dc8b:$a: NanoCore 0x4de75:$a: NanoCore 0x61794:$a: NanoCore 0x617a9:$a: NanoCore 0x617de:$a: NanoCore 0x7a733:$a: NanoCore 0x7a748:$a: NanoCore 0x7a77d:$a: NanoCore 0x485ff:$b: ClientPlugin 0x4863c:$b: ClientPlugin 0x48f3a:$b: ClientPlugin 0x48f47:$b: ClientPlugin 0x4d9da:$b: ClientPlugin 0x4dc4a:$b: ClientPlugin 0x4dc94:$b: ClientPlugin 0x61550:$b: ClientPlugin
0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x198615:$x1: NanoCore.ClientPluginHost 0x1ccc35:$x1: NanoCore.ClientPluginHost 0x198652:$x2: IClientNetworkHost 0x1ccc72:$x2: IClientNetworkHost 0x19c185:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d07a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19837d:$a: NanoCore 0x19838d:$a: NanoCore 0x1985c1:$a: NanoCore 0x1985d5:$a: NanoCore 0x198615:$a: NanoCore 0x1cc99d:$a: NanoCore 0x1cc9ad:$a: NanoCore 0x1ccbe1:$a: NanoCore 0x1ccbf5:$a: NanoCore 0x1ccc35:$a: NanoCore 0x1983dc:$b: ClientPlugin 0x1985de:$b: ClientPlugin 0x19861e:$b: ClientPlugin 0x1cc9fc:$b: ClientPlugin 0x1ccbfe:$b: ClientPlugin 0x1ccc3e:$b: ClientPlugin 0xe8f0b:$c: ProjectData 0x198503:$c: ProjectData 0x1ccb23:$c: ProjectData 0x198f0a:$d: DESCrypto 0x1cd52a:$d: DESCrypto
00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x110bf5:$x1: NanoCore.ClientPluginHost 0x1da635:$x1: NanoCore.ClientPluginHost 0x110c32:$x2: IClientNetworkHost 0x1da672:$x2: IClientNetworkHost 0x114765:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1de1a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11095d:$a: NanoCore 0x11096d:$a: NanoCore 0x110ba1:$a: NanoCore 0x110bb5:$a: NanoCore 0x110bf5:$a: NanoCore 0x1da39d:$a: NanoCore 0x1da3ad:$a: NanoCore 0x1da5e1:$a: NanoCore 0x1da5f5:$a: NanoCore 0x1da635:$a: NanoCore 0x1109bc:$b: ClientPlugin 0x110bbe:$b: ClientPlugin 0x110bfe:$b: ClientPlugin 0x1da3fc:$b: ClientPlugin 0x1da5fe:$b: ClientPlugin 0x1da63e:$b: ClientPlugin 0x110ae3:$c: ProjectData 0x1bd2f0:$c: ProjectData 0x1da523:$c: ProjectData 0x1114ea:$d: DESCrypto 0x1daf2a:$d: DESCrypto
00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4859d:$a: NanoCore 0x485f6:$a: NanoCore 0x48633:$a: NanoCore 0x486ac:$a: NanoCore 0x4dc41:$a: NanoCore 0x4dc8b:$a: NanoCore 0x4de75:$a: NanoCore 0x61794:$a: NanoCore 0x617a9:$a: NanoCore 0x617de:$a: NanoCore 0x7a733:$a: NanoCore 0x7a748:$a: NanoCore 0x7a77d:$a: NanoCore 0x485ff:$b: ClientPlugin 0x4863c:$b: ClientPlugin 0x48f3a:$b: ClientPlugin 0x48f47:$b: ClientPlugin 0x4d9da:$b: ClientPlugin 0x4dc4a:$b: ClientPlugin 0x4dc94:$b: ClientPlugin 0x61550:$b: ClientPlugin
0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x198615:$x1: NanoCore.ClientPluginHost 0x1ccc35:$x1: NanoCore.ClientPluginHost 0x198652:$x2: IClientNetworkHost 0x1ccc72:$x2: IClientNetworkHost 0x19c185:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d07a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19837d:$a: NanoCore 0x19838d:$a: NanoCore 0x1985c1:$a: NanoCore 0x1985d5:$a: NanoCore 0x198615:$a: NanoCore 0x1cc99d:$a: NanoCore 0x1cc9ad:$a: NanoCore 0x1ccbe1:$a: NanoCore 0x1ccbf5:$a: NanoCore 0x1ccc35:$a: NanoCore 0x1983dc:$b: ClientPlugin 0x1985de:$b: ClientPlugin 0x19861e:$b: ClientPlugin 0x1cc9fc:$b: ClientPlugin 0x1ccbfe:$b: ClientPlugin 0x1ccc3e:$b: ClientPlugin 0xe8f0b:$c: ProjectData 0x198503:$c: ProjectData 0x1ccb23:$c: ProjectData 0x198f0a:$d: DESCrypto 0x1cd52a:$d: DESCrypto
0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69463:$a: NanoCore 0x694bc:$a: NanoCore 0x694f9:$a: NanoCore 0x69572:$a: NanoCore 0x6ed2a:$a: NanoCore 0x6ed74:$a: NanoCore 0x6ef5e:$a: NanoCore 0x694c5:$b: ClientPlugin 0x69502:$b: ClientPlugin 0x69e00:$b: ClientPlugin 0x69e0d:$b: ClientPlugin 0x6eac3:$b: ClientPlugin 0x6ed33:$b: ClientPlugin 0x6ed7d:$b: ClientPlugin 0x6f295:$c: ProjectData 0x5d01c:$e: KeepAlive 0x6994d:$g: LogClientMessage 0x6f188:$g: LogClientMessage 0x698cd:$i: get_Connected 0x5d0bf:$j: #=q 0x5d0ef:$j: #=q
0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x198615:$x1: NanoCore.ClientPluginHost 0x1ccc35:$x1: NanoCore.ClientPluginHost 0x198652:$x2: IClientNetworkHost 0x1ccc72:$x2: IClientNetworkHost 0x19c185:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d07a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19837d:$a: NanoCore 0x19838d:$a: NanoCore 0x1985c1:$a: NanoCore 0x1985d5:$a: NanoCore 0x198615:$a: NanoCore 0x1cc99d:$a: NanoCore 0x1cc9ad:$a: NanoCore 0x1ccbe1:$a: NanoCore 0x1ccbf5:$a: NanoCore 0x1ccc35:$a: NanoCore 0x1983dc:$b: ClientPlugin 0x1985de:$b: ClientPlugin 0x19861e:$b: ClientPlugin 0x1cc9fc:$b: ClientPlugin 0x1ccbfe:$b: ClientPlugin 0x1ccc3e:$b: ClientPlugin 0xe8f0b:$c: ProjectData 0x198503:$c: ProjectData 0x1ccb23:$c: ProjectData 0x198f0a:$d: DESCrypto 0x1cd52a:$d: DESCrypto
00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x859d:$a: NanoCore 0x85f6:$a: NanoCore 0x8633:$a: NanoCore 0x86ac:$a: NanoCore 0xdc41:$a: NanoCore 0xdc8b:$a: NanoCore 0xde75:$a: NanoCore 0x21794:$a: NanoCore 0x217a9:$a: NanoCore 0x217de:$a: NanoCore 0x3a733:$a: NanoCore 0x3a748:$a: NanoCore 0x3a77d:$a: NanoCore 0x85ff:$b: ClientPlugin 0x863c:$b: ClientPlugin 0x8f3a:$b: ClientPlugin 0x8f47:$b: ClientPlugin 0xd9da:$b: ClientPlugin 0xdc4a:$b: ClientPlugin 0xdc94:$b: ClientPlugin 0x21550:$b: ClientPlugin
00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4859d:$a: NanoCore 0x485f6:$a: NanoCore 0x48633:$a: NanoCore 0x486ac:$a: NanoCore 0x4dc41:$a: NanoCore 0x4dc8b:$a: NanoCore 0x4de75:$a: NanoCore 0x61794:$a: NanoCore 0x617a9:$a: NanoCore 0x617de:$a: NanoCore 0x7a733:$a: NanoCore 0x7a748:$a: NanoCore 0x7a77d:$a: NanoCore 0x485ff:$b: ClientPlugin 0x4863c:$b: ClientPlugin 0x48f3a:$b: ClientPlugin 0x48f47:$b: ClientPlugin 0x4d9da:$b: ClientPlugin 0x4dc4a:$b: ClientPlugin 0x4dc94:$b: ClientPlugin 0x61550:$b: ClientPlugin
00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69367:$a: NanoCore 0x693c0:$a: NanoCore 0x693fd:$a: NanoCore 0x69476:$a: NanoCore 0x6ec2e:$a: NanoCore 0x6ec78:$a: NanoCore 0x6ee62:$a: NanoCore 0x693c9:$b: ClientPlugin 0x69406:$b: ClientPlugin 0x69d04:$b: ClientPlugin 0x69d11:$b: ClientPlugin 0x6e9c7:$b: ClientPlugin 0x6ec37:$b: ClientPlugin 0x6ec81:$b: ClientPlugin 0x6f199:$c: ProjectData 0x5cf20:$e: KeepAlive 0x69851:$g: LogClientMessage 0x6f08c:$g: LogClientMessage 0x697d1:$i: get_Connected 0x5cfc3:$j: #=q 0x5cff3:$j: #=q
00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
Process Memory Space: 5JbQqP8SDG.exe PID: 7036	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x428fe:$x1: NanoCore.ClientPluginHost 0x4293b:$x2: IClientNetworkHost 0x4642c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x514b2:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6001b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 5JbQqP8SDG.exe PID: 7036	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 5JbQqP8SDG.exe PID: 7036	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 5JbQqP8SDG.exe PID: 7036	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x425cb:$a: NanoCore 0x425db:$a: NanoCore 0x4269a:$a: NanoCore 0x426a9:$a: NanoCore 0x428aa:$a: NanoCore 0x428be:$a: NanoCore 0x428fe:$a: NanoCore 0x4db1c:$a: NanoCore 0x4db2e:$a: NanoCore 0x4db6a:$a: NanoCore 0x5c685:$a: NanoCore 0x5c697:$a: NanoCore 0x5c6d3:$a: NanoCore 0x4262a:$b: ClientPlugin 0x426f3:$b: ClientPlugin 0x428c7:$b: ClientPlugin 0x42907:$b: ClientPlugin 0x4db37:$b: ClientPlugin 0x4db73:$b: ClientPlugin 0x5c6a0:$b: ClientPlugin 0x5c6dc:$b: ClientPlugin
Process Memory Space: 5JbQqP8SDG.exe PID: 4676	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x83bb:$x1: NanoCore.ClientPluginHost 0x5424d:$x1: NanoCore.ClientPluginHost 0x84f58:$x1: NanoCore.ClientPluginHost 0x83f8:$x2: IClientNetworkHost 0x54267:$x2: IClientNetworkHost 0x84f72:$x2: IClientNetworkHost 0xbee9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x16f6f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 5JbQqP8SDG.exe PID: 4676	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 5JbQqP8SDG.exe PID: 4676	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8088:$a: NanoCore 0x8098:$a: NanoCore 0x8157:$a: NanoCore 0x8166:$a: NanoCore 0x8367:$a: NanoCore 0x837b:$a: NanoCore 0x83bb:$a: NanoCore 0x135d9:$a: NanoCore 0x135eb:$a: NanoCore 0x13627:$a: NanoCore 0x49c9f:$a: NanoCore 0x49cfa:$a: NanoCore 0x49d6d:$a: NanoCore 0x541b7:$a: NanoCore 0x54210:$a: NanoCore 0x5424d:$a: NanoCore 0x542c6:$a: NanoCore 0x54b63:$a: NanoCore 0x54bb6:$a: NanoCore 0x54bef:$a: NanoCore 0x54c62:$a: NanoCore
Process Memory Space: 5JbQqP8SDG.exe PID: 5976	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1864e:$x1: NanoCore.ClientPluginHost 0x1868b:$x2: IClientNetworkHost 0x1bccb:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x26aa4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x32e1a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 5JbQqP8SDG.exe PID: 5976	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 5JbQqP8SDG.exe PID: 5976	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 5JbQqP8SDG.exe PID: 5976	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x183fd:$a: NanoCore 0x1840d:$a: NanoCore 0x1845e:$a: NanoCore 0x1846d:$a: NanoCore 0x185fa:$a: NanoCore 0x1860e:$a: NanoCore 0x1864e:$a: NanoCore 0x2310e:$a: NanoCore 0x23120:$a: NanoCore 0x2315c:$a: NanoCore 0x2f484:$a: NanoCore 0x2f496:$a: NanoCore 0x2f4d2:$a: NanoCore 0x18421:$b: ClientPlugin 0x184b7:$b: ClientPlugin 0x18617:$b: ClientPlugin 0x18657:$b: ClientPlugin 0x23129:$b: ClientPlugin 0x23165:$b: ClientPlugin 0x2f49f:$b: ClientPlugin 0x2f4db:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 6388	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2d858:$x1: NanoCore.ClientPluginHost 0x2d895:$x2: IClientNetworkHost 0x30ed5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3bcae:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x47e92:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6388	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 6388	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6388	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2d607:$a: NanoCore 0x2d617:$a: NanoCore 0x2d668:$a: NanoCore 0x2d677:$a: NanoCore 0x2d804:$a: NanoCore 0x2d818:$a: NanoCore 0x2d858:$a: NanoCore 0x38318:$a: NanoCore 0x3832a:$a: NanoCore 0x38366:$a: NanoCore 0x444fc:$a: NanoCore 0x4450e:$a: NanoCore 0x4454a:$a: NanoCore 0x2d62b:$b: ClientPlugin 0x2d6c1:$b: ClientPlugin 0x2d821:$b: ClientPlugin 0x2d861:$b: ClientPlugin 0x38333:$b: ClientPlugin 0x3836f:$b: ClientPlugin 0x44517:$b: ClientPlugin 0x44553:$b: ClientPlugin
Click to see the 107 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x40a6:$x1: NanoCore.ClientPluginHost
6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x40a6:$x2: NanoCore.ClientPluginHost 0x4184:$s4: PipeCreated 0x40c0:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x40f0:$x2: NanoCore.ClientPlugin 0x40a6:$x3: NanoCore.ClientPluginHost 0x4106:$i3: IClientNetwork 0x40c0:$i6: IClientLoggingHost 0x3e3f:$s1: ClientPlugin 0x40f9:$s1: ClientPlugin
11.2.5JbQqP8SDG.exe.37c1488.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.5JbQqP8SDG.exe.37c1488.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.2.5JbQqP8SDG.exe.37c1488.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.5JbQqP8SDG.exe.37c1488.2.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
11.2.5JbQqP8SDG.exe.37c1488.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
6.0.5JbQqP8SDG.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.5JbQqP8SDG.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.0.5JbQqP8SDG.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.5JbQqP8SDG.exe.400000.10.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.5JbQqP8SDG.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
6.0.5JbQqP8SDG.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.5JbQqP8SDG.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.0.5JbQqP8SDG.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.5JbQqP8SDG.exe.400000.12.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.5JbQqP8SDG.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
0.2.5JbQqP8SDG.exe.3d89a68.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.5JbQqP8SDG.exe.3d89a68.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.5JbQqP8SDG.exe.3d89a68.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.5JbQqP8SDG.exe.3d89a68.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.2.5JbQqP8SDG.exe.3d89a68.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x447ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x447ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4831d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x44525:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x447ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x45de6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x45dda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x46c8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ca42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x447d7:$s5: IClientLoggingHost
11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x44515:$x1: NanoCore Client 0x44525:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x4476d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x447ad:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x44762:$i1: IClientApp 0x10163:$i2: IClientData 0x44783:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x4478f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x4479e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x447c7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x447d7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost
11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x44515:$a: NanoCore 0x44525:$a: NanoCore 0x44759:$a: NanoCore 0x4476d:$a: NanoCore 0x447ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x44574:$b: ClientPlugin 0x44776:$b: ClientPlugin 0x447b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4469b:$c: ProjectData 0x10a82:$d: DESCrypto 0x450a2:$d: DESCrypto 0x1844e:$e: KeepAlive
6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost 0x151e3:$x1: NanoCore.ClientPluginHost 0x2e182:$x1: NanoCore.ClientPluginHost 0x15210:$x2: IClientNetworkHost 0x2e1af:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x151e3:$x2: NanoCore.ClientPluginHost 0x2e182:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x162be:$s4: PipeCreated 0x2f25d:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost 0x151fd:$s5: IClientLoggingHost 0x2e19c:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x151ae:$x2: NanoCore.ClientPlugin 0x2e14d:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x151e3:$x3: NanoCore.ClientPluginHost 0x2e182:$x3: NanoCore.ClientPluginHost 0x151a2:$i2: IClientData 0x2e141:$i2: IClientData 0x16a6:$i3: IClientNetwork 0x151c4:$i3: IClientNetwork 0x2e163:$i3: IClientNetwork 0x151d3:$i5: IClientDataHost 0x2e172:$i5: IClientDataHost 0x1660:$i6: IClientLoggingHost 0x151fd:$i6: IClientLoggingHost 0x2e19c:$i6: IClientLoggingHost 0x15210:$i7: IClientNetworkHost 0x2e1af:$i7: IClientNetworkHost 0x15223:$i8: IClientUIHost 0x2e1c2:$i8: IClientUIHost 0x15231:$i9: IClientNameObjectCollection
6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1646:$a: NanoCore 0x1690:$a: NanoCore 0x187a:$a: NanoCore 0x15199:$a: NanoCore 0x151ae:$a: NanoCore 0x151e3:$a: NanoCore 0x2e138:$a: NanoCore 0x2e14d:$a: NanoCore 0x2e182:$a: NanoCore 0x13df:$b: ClientPlugin 0x164f:$b: ClientPlugin 0x1699:$b: ClientPlugin 0x14f55:$b: ClientPlugin 0x14f70:$b: ClientPlugin 0x14fa0:$b: ClientPlugin 0x151b7:$b: ClientPlugin 0x151ec:$b: ClientPlugin 0x2def4:$b: ClientPlugin 0x2df0f:$b: ClientPlugin 0x2df3f:$b: ClientPlugin 0x2e156:$b: ClientPlugin
6.2.5JbQqP8SDG.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.2.5JbQqP8SDG.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.2.5JbQqP8SDG.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
6.0.5JbQqP8SDG.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.5JbQqP8SDG.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.0.5JbQqP8SDG.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.5JbQqP8SDG.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.42e1488.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.42e1488.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
6.0.5JbQqP8SDG.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.5JbQqP8SDG.exe.400000.6.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.5JbQqP8SDG.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
6.0.5JbQqP8SDG.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.42e1488.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.5JbQqP8SDG.exe.400000.4.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.5JbQqP8SDG.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
14.2.dhcpmon.exe.42e1488.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
14.2.dhcpmon.exe.42e1488.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
6.2.5JbQqP8SDG.exe.53e0000.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.53e0000.9.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.53e0000.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.53e0000.9.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
6.2.5JbQqP8SDG.exe.3c707be.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4083:$x1: NanoCore.ClientPluginHost
6.2.5JbQqP8SDG.exe.3c707be.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4083:$x2: NanoCore.ClientPluginHost 0x4161:$s4: PipeCreated 0x409d:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.3c707be.6.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x40cd:$x2: NanoCore.ClientPlugin 0x4083:$x3: NanoCore.ClientPluginHost 0x40e3:$i3: IClientNetwork 0x409d:$i6: IClientLoggingHost 0x3e1c:$s1: ClientPlugin 0x40d6:$s1: ClientPlugin
6.0.5JbQqP8SDG.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.5JbQqP8SDG.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.0.5JbQqP8SDG.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.5JbQqP8SDG.exe.400000.8.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.5JbQqP8SDG.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0xd9bcd:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0xd9c0a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xdd73d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0xd9935:$x1: NanoCore Client 0xd9945:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0xd9b8d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0xd9bcd:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0xd9b82:$i1: IClientApp 0x10163:$i2: IClientData 0xd9ba3:$i2: IClientData 0x1016f:$i3: IClientNetwork 0xd9baf:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0xd9bbe:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0xd9be7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0xd9bf7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost
0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xd9935:$a: NanoCore 0xd9945:$a: NanoCore 0xd9b79:$a: NanoCore 0xd9b8d:$a: NanoCore 0xd9bcd:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0xd9994:$b: ClientPlugin 0xd9b96:$b: ClientPlugin 0xd9bd6:$b: ClientPlugin 0x1007b:$c: ProjectData 0xbc888:$c: ProjectData 0xd9abb:$c: ProjectData 0x10a82:$d: DESCrypto 0xda4c2:$d: DESCrypto
6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x6483:$x1: NanoCore.ClientPluginHost 0x1a020:$x1: NanoCore.ClientPluginHost 0x32fbf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x1a04d:$x2: IClientNetworkHost 0x32fec:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x6483:$x2: NanoCore.ClientPluginHost 0x1a020:$x2: NanoCore.ClientPluginHost 0x32fbf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x6561:$s4: PipeCreated 0x1b0fb:$s4: PipeCreated 0x3409a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x649d:$s5: IClientLoggingHost 0x1a03a:$s5: IClientLoggingHost 0x32fd9:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x64cd:$x2: NanoCore.ClientPlugin 0x19feb:$x2: NanoCore.ClientPlugin 0x32f8a:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x6483:$x3: NanoCore.ClientPluginHost 0x1a020:$x3: NanoCore.ClientPluginHost 0x32fbf:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x19fdf:$i2: IClientData 0x32f7e:$i2: IClientData 0xe29:$i3: IClientNetwork 0x64e3:$i3: IClientNetwork 0x1a001:$i3: IClientNetwork 0x32fa0:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x1a010:$i5: IClientDataHost 0x32faf:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost
6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x6483:$a: NanoCore 0x64cd:$a: NanoCore 0x66b7:$a: NanoCore 0x19fd6:$a: NanoCore 0x19feb:$a: NanoCore 0x1a020:$a: NanoCore 0x32f75:$a: NanoCore 0x32f8a:$a: NanoCore 0x32fbf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x621c:$b: ClientPlugin 0x648c:$b: ClientPlugin 0x64d6:$b: ClientPlugin 0x19d92:$b: ClientPlugin
6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x2874c:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x28779:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x2874c:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29827:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28766:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x28717:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x2874c:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x2870b:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x2872d:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x2873c:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x28766:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x28779:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x2878c:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x2879a:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x287b6:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
6.2.5JbQqP8SDG.exe.3c7b031.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.3c7b031.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.3c7b031.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.5JbQqP8SDG.exe.3c7b031.5.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x16a6:$i3: IClientNetwork 0x1660:$i6: IClientLoggingHost 0x13df:$s1: ClientPlugin 0x1699:$s1: ClientPlugin
14.2.dhcpmon.exe.41bc1d8.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13543d:$x1: NanoCore.ClientPluginHost 0x169a5d:$x1: NanoCore.ClientPluginHost 0x13547a:$x2: IClientNetworkHost 0x169a9a:$x2: IClientNetworkHost 0x138fad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x16d5cd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.41bc1d8.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.41bc1d8.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1351a5:$x1: NanoCore Client 0x1351b5:$x1: NanoCore Client 0x1697c5:$x1: NanoCore Client 0x1697d5:$x1: NanoCore Client 0x1353fd:$x2: NanoCore.ClientPlugin 0x169a1d:$x2: NanoCore.ClientPlugin 0x13543d:$x3: NanoCore.ClientPluginHost 0x169a5d:$x3: NanoCore.ClientPluginHost 0x1353f2:$i1: IClientApp 0x169a12:$i1: IClientApp 0x135413:$i2: IClientData 0x169a33:$i2: IClientData 0x13541f:$i3: IClientNetwork 0x169a3f:$i3: IClientNetwork 0x13542e:$i4: IClientAppHost 0x169a4e:$i4: IClientAppHost 0x135457:$i5: IClientDataHost 0x169a77:$i5: IClientDataHost 0x135467:$i6: IClientLoggingHost 0x169a87:$i6: IClientLoggingHost 0x13547a:$i7: IClientNetworkHost
14.2.dhcpmon.exe.41bc1d8.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1351a5:$a: NanoCore 0x1351b5:$a: NanoCore 0x1353e9:$a: NanoCore 0x1353fd:$a: NanoCore 0x13543d:$a: NanoCore 0x1697c5:$a: NanoCore 0x1697d5:$a: NanoCore 0x169a09:$a: NanoCore 0x169a1d:$a: NanoCore 0x169a5d:$a: NanoCore 0x135204:$b: ClientPlugin 0x135406:$b: ClientPlugin 0x135446:$b: ClientPlugin 0x169824:$b: ClientPlugin 0x169a26:$b: ClientPlugin 0x169a66:$b: ClientPlugin 0x85d33:$c: ProjectData 0x13532b:$c: ProjectData 0x16994b:$c: ProjectData 0x135d32:$d: DESCrypto 0x16a352:$d: DESCrypto
14.2.dhcpmon.exe.42e1488.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x447ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x447ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4831d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.42e1488.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x44525:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x447ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x45de6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x45dda:$s2: FileCommand 0x1266b:$s3: PipeExists 0x46c8b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4ca42:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x447d7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.42e1488.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.42e1488.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x44515:$x1: NanoCore Client 0x44525:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x4476d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x447ad:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x44762:$i1: IClientApp 0x10163:$i2: IClientData 0x44783:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x4478f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x4479e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x447c7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x447d7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost
14.2.dhcpmon.exe.42e1488.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x44515:$a: NanoCore 0x44525:$a: NanoCore 0x44759:$a: NanoCore 0x4476d:$a: NanoCore 0x447ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x44574:$b: ClientPlugin 0x44776:$b: ClientPlugin 0x447b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4469b:$c: ProjectData 0x10a82:$d: DESCrypto 0x450a2:$d: DESCrypto 0x1844e:$e: KeepAlive
6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x64a6:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x64a6:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x6584:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x64c0:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x64f0:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x64a6:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0x6506:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x64c0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x623f:$s1: ClientPlugin 0x64f9:$s1: ClientPlugin
0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xa53ad:$x1: NanoCore.ClientPluginHost 0xa53ea:$x2: IClientNetworkHost 0xa8f1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xa5115:$x1: NanoCore Client 0xa5125:$x1: NanoCore Client 0xa536d:$x2: NanoCore.ClientPlugin 0xa53ad:$x3: NanoCore.ClientPluginHost 0xa5362:$i1: IClientApp 0xa5383:$i2: IClientData 0xa538f:$i3: IClientNetwork 0xa539e:$i4: IClientAppHost 0xa53c7:$i5: IClientDataHost 0xa53d7:$i6: IClientLoggingHost 0xa53ea:$i7: IClientNetworkHost 0xa53fd:$i8: IClientUIHost 0xa540b:$i9: IClientNameObjectCollection 0xa5427:$i10: IClientReadOnlyNameObjectCollection 0xa5174:$s1: ClientPlugin 0xa5376:$s1: ClientPlugin 0xa586a:$s2: EndPoint 0xa5873:$s3: IPAddress 0xa587d:$s4: IPEndPoint 0xa72b3:$s6: get_ClientSettings 0xa7857:$s7: get_Connected
0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xa5115:$a: NanoCore 0xa5125:$a: NanoCore 0xa5359:$a: NanoCore 0xa536d:$a: NanoCore 0xa53ad:$a: NanoCore 0xa5174:$b: ClientPlugin 0xa5376:$b: ClientPlugin 0xa53b6:$b: ClientPlugin 0x88068:$c: ProjectData 0xa529b:$c: ProjectData 0xa5ca2:$d: DESCrypto 0xad66e:$e: KeepAlive 0xab65c:$g: LogClientMessage 0xa7857:$i: get_Connected 0xa5fd8:$j: #=q 0xa6008:$j: #=q 0xa6024:$j: #=q 0xa6054:$j: #=q 0xa6070:$j: #=q 0xa608c:$j: #=q 0xa60bc:$j: #=q
0.2.5JbQqP8SDG.exe.2cc21a8.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2b633c:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2b6380:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b63c8:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b6654:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2b66b8:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2b6710:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2b6768:$s4: Set-MpPreference -DisableScriptScanning $true 0x2b67b4:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2b67f4:$s6: Set-MpPreference -MAPSReporting 0 0x2b6840:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2b6898:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2b68e8:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2b6938:$s10: Set-MpPreference -SevereThreatDefaultAction 6
11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13543d:$x1: NanoCore.ClientPluginHost 0x169a5d:$x1: NanoCore.ClientPluginHost 0x13547a:$x2: IClientNetworkHost 0x169a9a:$x2: IClientNetworkHost 0x138fad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x16d5cd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1351a5:$x1: NanoCore Client 0x1351b5:$x1: NanoCore Client 0x1697c5:$x1: NanoCore Client 0x1697d5:$x1: NanoCore Client 0x1353fd:$x2: NanoCore.ClientPlugin 0x169a1d:$x2: NanoCore.ClientPlugin 0x13543d:$x3: NanoCore.ClientPluginHost 0x169a5d:$x3: NanoCore.ClientPluginHost 0x1353f2:$i1: IClientApp 0x169a12:$i1: IClientApp 0x135413:$i2: IClientData 0x169a33:$i2: IClientData 0x13541f:$i3: IClientNetwork 0x169a3f:$i3: IClientNetwork 0x13542e:$i4: IClientAppHost 0x169a4e:$i4: IClientAppHost 0x135457:$i5: IClientDataHost 0x169a77:$i5: IClientDataHost 0x135467:$i6: IClientLoggingHost 0x169a87:$i6: IClientLoggingHost 0x13547a:$i7: IClientNetworkHost
11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1351a5:$a: NanoCore 0x1351b5:$a: NanoCore 0x1353e9:$a: NanoCore 0x1353fd:$a: NanoCore 0x13543d:$a: NanoCore 0x1697c5:$a: NanoCore 0x1697d5:$a: NanoCore 0x169a09:$a: NanoCore 0x169a1d:$a: NanoCore 0x169a5d:$a: NanoCore 0x135204:$b: ClientPlugin 0x135406:$b: ClientPlugin 0x135446:$b: ClientPlugin 0x169824:$b: ClientPlugin 0x169a26:$b: ClientPlugin 0x169a66:$b: ClientPlugin 0x85d33:$c: ProjectData 0x13532b:$c: ProjectData 0x16994b:$c: ProjectData 0x135d32:$d: DESCrypto 0x16a352:$d: DESCrypto
6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x16a6:$i3: IClientNetwork 0x1660:$i6: IClientLoggingHost 0x13df:$s1: ClientPlugin 0x1699:$s1: ClientPlugin
14.2.dhcpmon.exe.31921e8.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2b633c:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2b6380:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b63c8:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b6654:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2b66b8:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2b6710:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2b6768:$s4: Set-MpPreference -DisableScriptScanning $true 0x2b67b4:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2b67f4:$s6: Set-MpPreference -MAPSReporting 0 0x2b6840:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2b6898:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2b68e8:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2b6938:$s10: Set-MpPreference -SevereThreatDefaultAction 6
11.2.5JbQqP8SDG.exe.26721a8.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2b633c:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2b6380:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b63c8:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b6654:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2b66b8:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2b6710:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2b6768:$s4: Set-MpPreference -DisableScriptScanning $true 0x2b67b4:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2b67f4:$s6: Set-MpPreference -MAPSReporting 0 0x2b6840:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2b6898:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2b68e8:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2b6938:$s10: Set-MpPreference -SevereThreatDefaultAction 6
Click to see the 117 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\5JbQqP8SDG.exe, ProcessId: 4676, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\5JbQqP8SDG.exe, ProcessId: 4676, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\5JbQqP8SDG.exe, ProcessId: 4676, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\5JbQqP8SDG.exe, ProcessId: 4676, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5JbQqP8SDG.exe	Virustotal: Detection: 57%			Perma Link
Source: 5JbQqP8SDG.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\GryVAO.exe	ReversingLabs: Detection: 63%

Yara detected Nanocore RAT

Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Machine Learning detection for sample

Source: 5JbQqP8SDG.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\GryVAO.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Joe Sandbox ML: detected

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack	Avira: Label: TR/NanoCore.fadte
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: 5JbQqP8SDG.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 5JbQqP8SDG.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.19.85.175 ports 0,1,2,4,5,50421

Uses dynamic DNS services

Source: unknown

DNS query: name: lowspeed121.ddns.net

Source: global traffic

TCP traffic: 192.168.2.5:49775 -> 185.19.85.175:50421

Source: 5JbQqP8SDG.exe, 00000000.00000003.438967518.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.440205423.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com=
Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 5JbQqP8SDG.exe, 00000000.00000003.455928032.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.p
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 5JbQqP8SDG.exe, 00000000.00000003.444977276.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.445248230.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.445508362.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comexc
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.co
Source: 5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com.
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 5JbQqP8SDG.exe, 00000000.00000003.450491433.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450590496.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450679414.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaK
Source: 5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaU
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450417445.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450417445.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comepko8
Source: 5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comf
Source: 5JbQqP8SDG.exe, 00000000.00000003.448954375.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comicTF
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comc
Source: 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comce
Source: 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comu
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.c
Source: 5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn=
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442824583.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnH
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442824583.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnU
Source: 5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-nFp0
Source: 5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnsof
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 5JbQqP8SDG.exe, 00000000.00000003.454422256.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmc
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 5JbQqP8SDG.exe, 00000000.00000003.439756929.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439331188.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439537582.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439370513.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439404974.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439577851.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com=
Source: 5JbQqP8SDG.exe, 00000000.00000003.439756929.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439331188.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439537582.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439370513.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439404974.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439577851.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comK
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.441648603.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 5JbQqP8SDG.exe, 00000000.00000003.441648603.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr%
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440416859.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440348993.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440205423.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deX
Source: 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: lowspeed121.ddns.net

Source: 5JbQqP8SDG.exe, 00000000.00000002.485929234.0000000000F30000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.5JbQqP8SDG.exe.2cc21a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 14.2.dhcpmon.exe.31921e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 11.2.5JbQqP8SDG.exe.26721a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: 5JbQqP8SDG.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.5230000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.5400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.2c55fe0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.5JbQqP8SDG.exe.2cc21a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.5JbQqP8SDG.exe.2c5ae40.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 14.2.dhcpmon.exe.31921e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 11.2.5JbQqP8SDG.exe.26721a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00792A9A	0_2_00792A9A
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00F2C084	0_2_00F2C084
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00F2E398	0_2_00F2E398
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 0_2_00F2E388	0_2_00F2E388
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 6_2_007E2A9A	6_2_007E2A9A
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_001A2A9A	11_2_001A2A9A
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_00ABC084	11_2_00ABC084
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_00ABE388	11_2_00ABE388
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Code function: 11_2_00ABE398	11_2_00ABE398
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_00DA2A9A	14_2_00DA2A9A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_02F7E398	14_2_02F7E398
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_02F7E388	14_2_02F7E388
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_02F7C084	14_2_02F7C084
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80BB0	14_2_07E80BB0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E88B68	14_2_07E88B68
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89F70	14_2_07E89F70
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E81350	14_2_07E81350
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8A5F8	14_2_07E8A5F8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E82148	14_2_07E82148
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E83028	14_2_07E83028
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8D430	14_2_07E8D430
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E82FE6	14_2_07E82FE6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8A3D8	14_2_07E8A3D8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85780	14_2_07E85780
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85380	14_2_07E85380
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85370	14_2_07E85370
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85770	14_2_07E85770
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E81340	14_2_07E81340
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E88B58	14_2_07E88B58
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80B21	14_2_07E80B21
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E862C8	14_2_07E862C8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E862C3	14_2_07E862C3
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84AA0	14_2_07E84AA0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89698	14_2_07E89698
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84A90	14_2_07E84A90
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89696	14_2_07E89696
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8DE48	14_2_07E8DE48
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E855A0	14_2_07E855A0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84DA0	14_2_07E84DA0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E84D90	14_2_07E84D90
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85593	14_2_07E85593
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8CD70	14_2_07E8CD70
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E85148	14_2_07E85148
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E82142	14_2_07E82142
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8513A	14_2_07E8513A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8A8B0	14_2_07E8A8B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E89068	14_2_07E89068
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80040	14_2_07E80040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E8E430	14_2_07E8E430
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E80006	14_2_07E80006
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E83007	14_2_07E83007
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E88C19	14_2_07E88C19

Source: 5JbQqP8SDG.exe, 00000000.00000002.491013592.0000000003290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000000.435226561.0000000000828000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.494434677.0000000007CF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.485929234.0000000000F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000000.00000002.492892204.00000000040CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000000.480282056.0000000000878000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.601550993.00000000071D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.597247908.0000000002C40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.580726200.0000000000238000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeawGGIn.exe@ vs 5JbQqP8SDG.exe
Source: 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 5JbQqP8SDG.exe

Source: 5JbQqP8SDG.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: GryVAO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 5JbQqP8SDG.exe	Virustotal: Detection: 57%
Source: 5JbQqP8SDG.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File read: C:\Users\user\Desktop\5JbQqP8SDG.exe

Jump to behavior

Source: 5JbQqP8SDG.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe "C:\Users\user\Desktop\5JbQqP8SDG.exe"
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe C:\Users\user\Desktop\5JbQqP8SDG.exe 0
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp3E23.tmp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp5777.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp58BF.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp3E23.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp5777.tmp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File created: C:\Users\user\AppData\Roaming\GryVAO.exe

Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBE25.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@28/12@9/1

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6652:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_01
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{3f629223-43f7-4f4e-b56f-3f91ee5e5e46}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_01

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 5JbQqP8SDG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5JbQqP8SDG.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07AF2224 push dword ptr [edx+ebp*2-75h]; iretd	14_2_07AF223F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07AF2142 push dword ptr [ebx+ebp-75h]; iretd	14_2_07AF214D
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 14_2_07E86710 push 93FFFFFEh; iretd	14_2_07E86715

Source: initial sample	Static PE information: section name: .text entropy: 7.65135197379
Source: initial sample	Static PE information: section name: .text entropy: 7.65135197379
Source: initial sample	Static PE information: section name: .text entropy: 7.65135197379

Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File created: C:\Users\user\AppData\Roaming\GryVAO.exe			Jump to dropped file
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

File opened: C:\Users\user\Desktop\5JbQqP8SDG.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe TID: 7064	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe TID: 6556	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe TID: 632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Window / User API: threadDelayed 6415	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Window / User API: threadDelayed 2992	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Window / User API: foregroundWindowGot 705	Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Memory written: C:\Users\user\Desktop\5JbQqP8SDG.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp3E23.tmp	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Process created: C:\Users\user\Desktop\5JbQqP8SDG.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmp5777.tmp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior

Source: 5JbQqP8SDG.exe, 00000006.00000002.721142281.00000000060DB000.00000004.00000010.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.722065655.0000000006EDE000.00000004.00000010.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.716969758.0000000002CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 5JbQqP8SDG.exe, 00000006.00000002.719382712.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719096304.0000000002CED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerx
Source: 5JbQqP8SDG.exe, 00000006.00000002.719647422.0000000003012000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719382712.0000000002E9F000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000006.00000002.719493359.0000000002F16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerL@
Source: 5JbQqP8SDG.exe, 00000006.00000002.716969758.0000000002CA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert
Source: 5JbQqP8SDG.exe, 00000006.00000002.719647422.0000000003012000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager8%n2

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Users\user\Desktop\5JbQqP8SDG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Users\user\Desktop\5JbQqP8SDG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Users\user\Desktop\5JbQqP8SDG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5JbQqP8SDG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\5JbQqP8SDG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: 5JbQqP8SDG.exe, 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: 5JbQqP8SDG.exe, 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: 5JbQqP8SDG.exe, 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: 5JbQqP8SDG.exe, 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.37c1488.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c755fb.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e4629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.53e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.5JbQqP8SDG.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3d89a68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c707be.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.5JbQqP8SDG.exe.3c7b031.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.41bc1d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.42e1488.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5JbQqP8SDG.exe.3dbe288.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.5JbQqP8SDG.exe.369c1d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.617062843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.579285516.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.577242348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.580041619.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616000849.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.611605376.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.580256144.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.578004077.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.578446288.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619221810.0000000003FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576978758.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.578970542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.582121238.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.616272773.0000000004189000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.584750033.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.612651273.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.619026955.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.605683107.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614606624.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.614187578.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.577728547.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.576249632.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 4676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5JbQqP8SDG.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6388, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	2 Masquerading	21 Input Capture	21 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Remote Access Software	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	11 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	13 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5JbQqP8SDG.exe	58%	Virustotal		Browse
5JbQqP8SDG.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AveMariaRAT
5JbQqP8SDG.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\GryVAO.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AveMariaRAT
C:\Users\user\AppData\Roaming\GryVAO.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AveMariaRAT

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.5JbQqP8SDG.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
6.0.5JbQqP8SDG.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
6.0.5JbQqP8SDG.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
6.0.5JbQqP8SDG.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
6.2.5JbQqP8SDG.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
6.2.5JbQqP8SDG.exe.53e0000.9.unpack	100%	Avira	TR/NanoCore.fadte	Download File
6.0.5JbQqP8SDG.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.comepko8	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnU	0%	URL Reputation	safe
http://www.sajatypeworks.com=	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn=	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr%	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnH	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.comK	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htmc	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.agfamonotype.p	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.fonts.comu	0%	Avira URL Cloud	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.urwpp.deX	0%	Avira URL Cloud	safe
http://www.carterandcone.comexc	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.founder.com.c	0%	URL Reputation	safe
http://www.fontbureau.co	0%	URL Reputation	safe
http://www.fontbureau.comaU	0%	Avira URL Cloud	safe
http://www.fontbureau.comicTF	0%	Avira URL Cloud	safe
http://www.fontbureau.comaK	0%	Avira URL Cloud	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comf	0%	URL Reputation	safe
http://fontfabrik.com=	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.founder.com.cn/cnl-nFp0	0%	Avira URL Cloud	safe
http://www.fonts.comce	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnsof	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
lowspeed121.ddns.net	185.19.85.175	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comepko8	5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450417445.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnU	5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442824583.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com=	5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440416859.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440348993.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.440205423.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn=	5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr%	5JbQqP8SDG.exe, 00000000.00000003.441648603.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cnH	5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442824583.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	5JbQqP8SDG.exe, 00000000.00000003.439756929.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439331188.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439537582.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439370513.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439404974.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439577851.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comK	5JbQqP8SDG.exe, 00000000.00000003.439756929.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439331188.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439537582.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439370513.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439404974.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439577851.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439246890.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htmc	5JbQqP8SDG.exe, 00000000.00000003.454422256.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com.	5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agfamonotype.p	5JbQqP8SDG.exe, 00000000.00000003.455928032.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.441648603.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comu	5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de	5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	5JbQqP8SDG.exe, 00000000.00000002.487043671.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 0000000B.00000002.585122976.0000000002631000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 0000000E.00000002.594285014.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deX	5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.comexc	5JbQqP8SDG.exe, 00000000.00000003.444977276.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.445248230.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.445508362.0000000005ADD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.comc	5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.c	5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.co	5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comaU	5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comicTF	5JbQqP8SDG.exe, 00000000.00000003.448954375.0000000005AD8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comaK	5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comd	5JbQqP8SDG.exe, 00000000.00000003.450011274.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450417445.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w	5JbQqP8SDG.exe, 00000000.00000003.438967518.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.442475364.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comf	5JbQqP8SDG.exe, 00000000.00000002.493627346.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.485024316.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	5JbQqP8SDG.exe, 00000000.00000003.450491433.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450590496.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.450679414.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fontfabrik.com=	5JbQqP8SDG.exe, 00000000.00000003.440205423.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	5JbQqP8SDG.exe, 00000000.00000002.494046111.0000000006DC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comals	5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comalic	5JbQqP8SDG.exe, 00000000.00000003.451055165.0000000005AD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnl-nFp0	5JbQqP8SDG.exe, 00000000.00000003.442457599.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comce	5JbQqP8SDG.exe, 00000000.00000003.439615586.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp, 5JbQqP8SDG.exe, 00000000.00000003.439692572.0000000005AEB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnsof	5JbQqP8SDG.exe, 00000000.00000003.442704852.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.19.85.175	lowspeed121.ddns.net	Switzerland		48971	DATAWIRE-ASCH	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	623788
Start date and time: 10/05/202220:23:39	2022-05-10 20:23:39 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	5JbQqP8SDG.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@28/12@9/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 4.3% (good quality ratio 2.1%) Quality average: 31.5% Quality standard deviation: 39.4%
HCA Information:	Successful, ratio: 95% Number of executed functions: 73 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing behavior and disassembly information.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:25:06	API Interceptor	711x Sleep call for process: 5JbQqP8SDG.exe modified
20:25:20	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
20:25:23	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\Desktop\5JbQqP8SDG.exe" s>$(Arg0)
20:25:25	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
20:25:41	API Interceptor	4x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	611328
Entropy (8bit):	7.644650096826273
Encrypted:	false
SSDEEP:	12288:LgjjSrFL2yMrcIqrxggKI3Ab2zBFW1iR011EaSvq/gK0ncptnxwTFMtRXZk6m:LgjjgAcIqrcIwb2zTb01m
MD5:	250D122F4AF32B52435A02787689EBBD
SHA1:	39346C41BCB75109DAC251320D4AFEA649538F85
SHA-256:	14F5C3AB5CBAD5D2F6E751E8B3D42204460B8B10A38285623734D631A2CEDA09
SHA-512:	36D7E91588D98689C76646AE237C84E1797D3371BB54640793E09C23E545CF5BC454779051853C196F7CA6F58FDA3DC080591BA1F86FF81B61928067C84E5488
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Umxb..............P..L..........>k... ........@.. ....................................@..................................j..W.................................................................................... ............... ..H............text...DK... ...L.................. ..`.rsrc................N..............@..@.reloc...............R..............@..B................ k......H.......`................Q...1.............................................(#.....($....s%........s&........s'........s(........s).........~....o....~....o+....~....o,....~....o-....~....o....R.......o1............(2...6..($...(%.....(&.........(......('...b..{....(...+}.....{....b..{....(...+}.....{....b..{....(...+}.....{....b..{....(...+}.....{.......{.......,.rq..p((...z..\|....(...+...{.......,.rq..p((...z..\|....(...+...{.......,.rq..p((...z..\|....(.

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5JbQqP8SDG.exe.log

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

Download File

Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp3E23.tmp

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.168687909215862
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBbtn:cbhC7ZlNQF/rydbz9I3YODOLNdq3X
MD5:	C6382A296ACE45E0D6C9A4A14FF67E89
SHA1:	319FCC78DEC52BCB03209FC3A9FFB4007602874D
SHA-256:	13F650B6E05BB9EBA9D6AFAE4E792DF61FDF029DFBF87ABD0B9EE983FDB91286
SHA-512:	C500C66CBCDC85C485427DA11D54066BD092EE556A78075CA0F575EDAF1B5B98F6B75532252901766B46126D38D147B6742A80B640434F4DA140C20BC6849FC8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Local\Temp\tmp5777.tmp

Download File

Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.168687909215862
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBbtn:cbhC7ZlNQF/rydbz9I3YODOLNdq3X
MD5:	C6382A296ACE45E0D6C9A4A14FF67E89
SHA1:	319FCC78DEC52BCB03209FC3A9FFB4007602874D
SHA-256:	13F650B6E05BB9EBA9D6AFAE4E792DF61FDF029DFBF87ABD0B9EE983FDB91286
SHA-512:	C500C66CBCDC85C485427DA11D54066BD092EE556A78075CA0F575EDAF1B5B98F6B75532252901766B46126D38D147B6742A80B640434F4DA140C20BC6849FC8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Local\Temp\tmpBD8.tmp

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpBE25.tmp

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.168687909215862
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBbtn:cbhC7ZlNQF/rydbz9I3YODOLNdq3X
MD5:	C6382A296ACE45E0D6C9A4A14FF67E89
SHA1:	319FCC78DEC52BCB03209FC3A9FFB4007602874D
SHA-256:	13F650B6E05BB9EBA9D6AFAE4E792DF61FDF029DFBF87ABD0B9EE983FDB91286
SHA-512:	C500C66CBCDC85C485427DA11D54066BD092EE556A78075CA0F575EDAF1B5B98F6B75532252901766B46126D38D147B6742A80B640434F4DA140C20BC6849FC8
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.121610238297834
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0PdxXxtn:cbk4oL600QydbQxIYODOLedq3SXj
MD5:	397A97E4D9348E8C5A0A1AABCE2A141A
SHA1:	4165A2A21BB901CB63655774AD8E3B6F6B894FFF
SHA-256:	FC8358E632BD6B1AD28318263F46F30F57022D6692F503212DA2123ED60294DA
SHA-512:	BD41A5CC77A6ABB91838FE1DABB979B8790E5357ED9444877A047B9FAD06B0282FF646B4BCC2882DD8D2ACAA1FCA89313DD2DB54FC8829DD6E701D65C6594F0D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:y6ln:y6ln
MD5:	ED8BF78CAA6512D8C4DE221FC892B8E7
SHA1:	0C2CFB8F84BA2873E0195BE895E3BFFD9DAA5A5D
SHA-256:	D12CB0817649797E02AEBAC918FD4C3FDA757086CE726BBA9781FAF6D165AF0B
SHA-512:	6613AA1FE39368D7188788359E1D2C33862ACAFB19DB9E9ACA2AA902DC9A1D6BF91E8C5B3348AAF457128B96C48D0F5976E1F67A250659219641E5612C3F23C7
Malicious:	true
Reputation:	unknown
Preview:	.....2.H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.511085408180429
Encrypted:	false
SSDEEP:	3:oNUWJRWQvH9BACn:oNNJAQvH92Cn
MD5:	E123BF011BFA42FE28C547BEB8B24E19
SHA1:	C481D8D3A7E0AFA805432B15C37545B946149727
SHA-256:	036BB6A73DF879739586F448D30FDC203B230C314FA7CFE57D9427B677CD19FA
SHA-512:	FFB39A79260DC8F91EF5EE98C145D888DA3EC5187014C9E28F60C1419FFBEED4F8F46F8C19DC283EB2ED810D7CA9F74E0F3E4B8FA4FB67EDFDD25A0DB111B3B2
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\Desktop\5JbQqP8SDG.exe

C:\Users\user\AppData\Roaming\GryVAO.exe

Download File

Process:	C:\Users\user\Desktop\5JbQqP8SDG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	611328
Entropy (8bit):	7.644650096826273
Encrypted:	false
SSDEEP:	12288:LgjjSrFL2yMrcIqrxggKI3Ab2zBFW1iR011EaSvq/gK0ncptnxwTFMtRXZk6m:LgjjgAcIqrcIwb2zTb01m
MD5:	250D122F4AF32B52435A02787689EBBD
SHA1:	39346C41BCB75109DAC251320D4AFEA649538F85
SHA-256:	14F5C3AB5CBAD5D2F6E751E8B3D42204460B8B10A38285623734D631A2CEDA09
SHA-512:	36D7E91588D98689C76646AE237C84E1797D3371BB54640793E09C23E545CF5BC454779051853C196F7CA6F58FDA3DC080591BA1F86FF81B61928067C84E5488
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Umxb..............P..L..........>k... ........@.. ....................................@..................................j..W.................................................................................... ............... ..H............text...DK... ...L.................. ..`.rsrc................N..............@..@.reloc...............R..............@..B................ k......H.......`................Q...1.............................................(#.....($....s%........s&........s'........s(........s).........~....o....~....o+....~....o,....~....o-....~....o....R.......o1............(2...6..($...(%.....(&.........(......('...b..{....(...+}.....{....b..{....(...+}.....{....b..{....(...+}.....{....b..{....(...+}.....{.......{.......,.rq..p((...z..\|....(...+...{.......,.rq..p((...z..\|....(...+...{.......,.rq..p((...z..\|....(.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.644650096826273
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	5JbQqP8SDG.exe
File size:	611328
MD5:	250d122f4af32b52435a02787689ebbd
SHA1:	39346c41bcb75109dac251320d4afea649538f85
SHA256:	14f5c3ab5cbad5d2f6e751e8b3d42204460b8b10a38285623734d631a2ceda09
SHA512:	36d7e91588d98689c76646ae237c84e1797d3371bb54640793e09c23e545cf5bc454779051853c196f7ca6f58fda3dc080591ba1f86ff81b61928067c84e5488
SSDEEP:	12288:LgjjSrFL2yMrcIqrxggKI3Ab2zBFW1iR011EaSvq/gK0ncptnxwTFMtRXZk6m:LgjjgAcIqrcIwb2zTb01m
TLSH:	D5D47B9CB110759EF45BD4B2CA686C64A691776B431F42039433E7AE9E2E5F3CE40CA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Umxb..............P..L..........>k... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x496b3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x62786D55 [Mon May 9 01:24:37 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x96ae4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x98000	0x398	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x94b44	0x94c00	False	0.799832589286	data	7.65135197379	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x98000	0x398	0x400	False	0.376953125	data	2.97811845606	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x98058	0x33c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright CPT185
Assembly Version	1.2.0.0
InternalName	eawGGIn.exe
FileVersion	1.2.0.0
CompanyName	CPT185
LegalTrademarks
Comments
ProductName	CPT185_Homework
ProductVersion	1.2.0.0
FileDescription	CPT185_Homework
OriginalFilename	eawGGIn.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2022 20:25:32.728507042 CEST	49775	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:32.746197939 CEST	50421	49775	185.19.85.175	192.168.2.5
May 10, 2022 20:25:33.344623089 CEST	49775	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:33.403633118 CEST	50421	49775	185.19.85.175	192.168.2.5
May 10, 2022 20:25:34.032136917 CEST	49775	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:34.062242985 CEST	50421	49775	185.19.85.175	192.168.2.5
May 10, 2022 20:25:38.412297964 CEST	49778	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:38.474441051 CEST	50421	49778	185.19.85.175	192.168.2.5
May 10, 2022 20:25:39.032617092 CEST	49778	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:39.072555065 CEST	50421	49778	185.19.85.175	192.168.2.5
May 10, 2022 20:25:39.641993046 CEST	49778	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:39.672367096 CEST	50421	49778	185.19.85.175	192.168.2.5
May 10, 2022 20:25:44.898557901 CEST	49781	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:44.916450024 CEST	50421	49781	185.19.85.175	192.168.2.5
May 10, 2022 20:25:45.533144951 CEST	49781	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:45.552731991 CEST	50421	49781	185.19.85.175	192.168.2.5
May 10, 2022 20:25:46.110516071 CEST	49781	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:46.154194117 CEST	50421	49781	185.19.85.175	192.168.2.5
May 10, 2022 20:25:51.772958040 CEST	49784	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:51.814470053 CEST	50421	49784	185.19.85.175	192.168.2.5
May 10, 2022 20:25:52.346168041 CEST	49784	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:52.372033119 CEST	50421	49784	185.19.85.175	192.168.2.5
May 10, 2022 20:25:52.951143980 CEST	49784	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:52.990546942 CEST	50421	49784	185.19.85.175	192.168.2.5
May 10, 2022 20:25:57.005374908 CEST	49787	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:57.063580990 CEST	50421	49787	185.19.85.175	192.168.2.5
May 10, 2022 20:25:57.637762070 CEST	49787	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:57.657197952 CEST	50421	49787	185.19.85.175	192.168.2.5
May 10, 2022 20:25:58.239928007 CEST	49787	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:25:58.265409946 CEST	50421	49787	185.19.85.175	192.168.2.5
May 10, 2022 20:26:02.305550098 CEST	49789	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:02.337171078 CEST	50421	49789	185.19.85.175	192.168.2.5
May 10, 2022 20:26:03.002831936 CEST	49789	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:03.029366970 CEST	50421	49789	185.19.85.175	192.168.2.5
May 10, 2022 20:26:03.691318035 CEST	49789	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:03.709923983 CEST	50421	49789	185.19.85.175	192.168.2.5
May 10, 2022 20:26:10.671817064 CEST	49791	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:10.701931953 CEST	50421	49791	185.19.85.175	192.168.2.5
May 10, 2022 20:26:11.323120117 CEST	49791	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:11.343614101 CEST	50421	49791	185.19.85.175	192.168.2.5
May 10, 2022 20:26:12.019603968 CEST	49791	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:12.039122105 CEST	50421	49791	185.19.85.175	192.168.2.5
May 10, 2022 20:26:16.140109062 CEST	49797	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:16.159164906 CEST	50421	49797	185.19.85.175	192.168.2.5
May 10, 2022 20:26:16.738403082 CEST	49797	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:16.756925106 CEST	50421	49797	185.19.85.175	192.168.2.5
May 10, 2022 20:26:17.288614988 CEST	49797	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:17.306202888 CEST	50421	49797	185.19.85.175	192.168.2.5
May 10, 2022 20:26:21.410116911 CEST	49801	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:21.428174019 CEST	50421	49801	185.19.85.175	192.168.2.5
May 10, 2022 20:26:22.004448891 CEST	49801	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:22.033843994 CEST	50421	49801	185.19.85.175	192.168.2.5
May 10, 2022 20:26:22.694041014 CEST	49801	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:22.711700916 CEST	50421	49801	185.19.85.175	192.168.2.5
May 10, 2022 20:26:26.726931095 CEST	49803	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:26.754028082 CEST	50421	49803	185.19.85.175	192.168.2.5
May 10, 2022 20:26:27.348707914 CEST	49803	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:27.366638899 CEST	50421	49803	185.19.85.175	192.168.2.5
May 10, 2022 20:26:28.036252022 CEST	49803	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:28.063142061 CEST	50421	49803	185.19.85.175	192.168.2.5
May 10, 2022 20:26:32.088620901 CEST	49804	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:32.106316090 CEST	50421	49804	185.19.85.175	192.168.2.5
May 10, 2022 20:26:32.645987988 CEST	49804	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:32.663572073 CEST	50421	49804	185.19.85.175	192.168.2.5
May 10, 2022 20:26:33.349282980 CEST	49804	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:33.368165970 CEST	50421	49804	185.19.85.175	192.168.2.5
May 10, 2022 20:26:37.387248993 CEST	49805	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:37.404926062 CEST	50421	49805	185.19.85.175	192.168.2.5
May 10, 2022 20:26:38.005887032 CEST	49805	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:38.023646116 CEST	50421	49805	185.19.85.175	192.168.2.5
May 10, 2022 20:26:38.693451881 CEST	49805	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:38.711137056 CEST	50421	49805	185.19.85.175	192.168.2.5
May 10, 2022 20:26:42.812170029 CEST	49807	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:42.844466925 CEST	50421	49807	185.19.85.175	192.168.2.5
May 10, 2022 20:26:43.350069046 CEST	49807	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:43.368793964 CEST	50421	49807	185.19.85.175	192.168.2.5
May 10, 2022 20:26:44.026642084 CEST	49807	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:44.061487913 CEST	50421	49807	185.19.85.175	192.168.2.5
May 10, 2022 20:26:49.824131966 CEST	49809	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:49.848602057 CEST	50421	49809	185.19.85.175	192.168.2.5
May 10, 2022 20:26:50.350656986 CEST	49809	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:50.368242025 CEST	50421	49809	185.19.85.175	192.168.2.5
May 10, 2022 20:26:51.038208961 CEST	49809	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:51.055838108 CEST	50421	49809	185.19.85.175	192.168.2.5
May 10, 2022 20:26:55.132627964 CEST	49815	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:55.150667906 CEST	50421	49815	185.19.85.175	192.168.2.5
May 10, 2022 20:26:55.741739988 CEST	49815	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:55.759327888 CEST	50421	49815	185.19.85.175	192.168.2.5
May 10, 2022 20:26:56.351227999 CEST	49815	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:26:56.381736994 CEST	50421	49815	185.19.85.175	192.168.2.5
May 10, 2022 20:27:00.384252071 CEST	49841	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:00.401876926 CEST	50421	49841	185.19.85.175	192.168.2.5
May 10, 2022 20:27:00.945350885 CEST	49841	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:00.970081091 CEST	50421	49841	185.19.85.175	192.168.2.5
May 10, 2022 20:27:01.476583004 CEST	49841	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:01.496156931 CEST	50421	49841	185.19.85.175	192.168.2.5
May 10, 2022 20:27:05.512118101 CEST	49850	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:05.541635036 CEST	50421	49850	185.19.85.175	192.168.2.5
May 10, 2022 20:27:06.133254051 CEST	49850	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:06.173866034 CEST	50421	49850	185.19.85.175	192.168.2.5
May 10, 2022 20:27:06.742738008 CEST	49850	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:06.760603905 CEST	50421	49850	185.19.85.175	192.168.2.5
May 10, 2022 20:27:10.790426016 CEST	49853	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:10.808140039 CEST	50421	49853	185.19.85.175	192.168.2.5
May 10, 2022 20:27:11.358550072 CEST	49853	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:11.377403021 CEST	50421	49853	185.19.85.175	192.168.2.5
May 10, 2022 20:27:11.946223974 CEST	49853	50421	192.168.2.5	185.19.85.175
May 10, 2022 20:27:11.963841915 CEST	50421	49853	185.19.85.175	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2022 20:25:32.594398022 CEST	54322	53	192.168.2.5	8.8.8.8
May 10, 2022 20:25:32.613013983 CEST	53	54322	8.8.8.8	192.168.2.5
May 10, 2022 20:25:38.359194040 CEST	63712	53	192.168.2.5	8.8.8.8
May 10, 2022 20:25:38.380553007 CEST	53	63712	8.8.8.8	192.168.2.5
May 10, 2022 20:25:44.221904993 CEST	62466	53	192.168.2.5	8.8.8.8
May 10, 2022 20:25:44.240909100 CEST	53	62466	8.8.8.8	192.168.2.5
May 10, 2022 20:26:08.134268999 CEST	57352	53	192.168.2.5	8.8.8.8
May 10, 2022 20:26:08.155194998 CEST	53	57352	8.8.8.8	192.168.2.5
May 10, 2022 20:26:16.115792990 CEST	63241	53	192.168.2.5	8.8.8.8
May 10, 2022 20:26:16.137823105 CEST	53	63241	8.8.8.8	192.168.2.5
May 10, 2022 20:26:21.373483896 CEST	57809	53	192.168.2.5	8.8.8.8
May 10, 2022 20:26:21.391987085 CEST	53	57809	8.8.8.8	192.168.2.5
May 10, 2022 20:26:42.791327953 CEST	62680	53	192.168.2.5	8.8.8.8
May 10, 2022 20:26:42.808203936 CEST	53	62680	8.8.8.8	192.168.2.5
May 10, 2022 20:26:49.778464079 CEST	49407	53	192.168.2.5	8.8.8.8
May 10, 2022 20:26:49.799529076 CEST	53	49407	8.8.8.8	192.168.2.5
May 10, 2022 20:26:55.111569881 CEST	54463	53	192.168.2.5	8.8.8.8
May 10, 2022 20:26:55.130059958 CEST	53	54463	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 10, 2022 20:25:32.594398022 CEST	192.168.2.5	8.8.8.8	0x70e8	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:25:38.359194040 CEST	192.168.2.5	8.8.8.8	0x9d84	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:25:44.221904993 CEST	192.168.2.5	8.8.8.8	0xae7	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:26:08.134268999 CEST	192.168.2.5	8.8.8.8	0xb5df	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:26:16.115792990 CEST	192.168.2.5	8.8.8.8	0x41e3	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:26:21.373483896 CEST	192.168.2.5	8.8.8.8	0x946	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:26:42.791327953 CEST	192.168.2.5	8.8.8.8	0xb453	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:26:49.778464079 CEST	192.168.2.5	8.8.8.8	0xa12	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)
May 10, 2022 20:26:55.111569881 CEST	192.168.2.5	8.8.8.8	0x20a2	Standard query (0)	lowspeed121.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 10, 2022 20:25:32.613013983 CEST	8.8.8.8	192.168.2.5	0x70e8	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:25:38.380553007 CEST	8.8.8.8	192.168.2.5	0x9d84	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:25:44.240909100 CEST	8.8.8.8	192.168.2.5	0xae7	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:26:08.155194998 CEST	8.8.8.8	192.168.2.5	0xb5df	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:26:16.137823105 CEST	8.8.8.8	192.168.2.5	0x41e3	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:26:21.391987085 CEST	8.8.8.8	192.168.2.5	0x946	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:26:42.808203936 CEST	8.8.8.8	192.168.2.5	0xb453	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:26:49.799529076 CEST	8.8.8.8	192.168.2.5	0xa12	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)
May 10, 2022 20:26:55.130059958 CEST	8.8.8.8	192.168.2.5	0x20a2	No error (0)	lowspeed121.ddns.net	185.19.85.175	A (IP address)	IN (0x0001)

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 5JbQqP8SDG.exePID: 7036, Parent PID: 4932

General

Target ID:	0
Start time:	20:24:53
Start date:	10/05/2022
Path:	C:\Users\user\Desktop\5JbQqP8SDG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5JbQqP8SDG.exe"
Imagebase:	0x790000
File size:	611328 bytes
MD5 hash:	250D122F4AF32B52435A02787689EBBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.491093919.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6368, Parent PID: 7036

General

Target ID:	4
Start time:	20:25:13
Start date:	10/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GryVAO" /XML "C:\Users\user\AppData\Local\Temp\tmpBE25.tmp
Imagebase:	0xd30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6348, Parent PID: 6368

General

Target ID:	5
Start time:	20:25:13
Start date:	10/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 5JbQqP8SDG.exePID: 4676, Parent PID: 7036

General

Target ID:	6
Start time:	20:25:14
Start date:	10/05/2022
Path:	C:\Users\user\Desktop\5JbQqP8SDG.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x7e0000
File size:	611328 bytes
MD5 hash:	250D122F4AF32B52435A02787689EBBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000000.483728850.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.720577614.0000000005400000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000000.482077079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.720534425.00000000053E0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000000.482642247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000002.706388161.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.720461431.0000000005230000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.712205262.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000002.719803754.0000000003C69000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000000.483222299.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 1408, Parent PID: 4676

General

Target ID:	9
Start time:	20:25:20
Start date:	10/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp
Imagebase:	0xd30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6608, Parent PID: 1408

General

Target ID:	10
Start time:	20:25:21
Start date:	10/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 5JbQqP8SDG.exePID: 5976, Parent PID: 1040

General

Target ID:	11
Start time:	20:25:23
Start date:	10/05/2022
Path:	C:\Users\user\Desktop\5JbQqP8SDG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\5JbQqP8SDG.exe 0
Imagebase:	0x1a0000
File size:	611328 bytes
MD5 hash:	250D122F4AF32B52435A02787689EBBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.597428271.0000000003639000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5564, Parent PID: 4676

General

Target ID:	12
Start time:	20:25:23
Start date:	10/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBD8.tmp
Imagebase:	0xd30000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6652, Parent PID: 5564

General

Target ID:	13
Start time:	20:25:24
Start date:	10/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: dhcpmon.exePID: 6388, Parent PID: 1040

General

Target ID:	14
Start time:	20:25:26
Start date:	10/05/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Imagebase:	0xda0000
File size:	611328 bytes
MD5 hash:	250D122F4AF32B52435A02787689EBBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000E.00000002.604549457.0000000004159000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 5JbQqP8SDG.exePID: 7036, Parent PID: 4932COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	7

Executed Functions

Function 00F2B5F0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F2B650
GetCurrentThread.KERNEL32 ref: 00F2B68D
GetCurrentProcess.KERNEL32 ref: 00F2B6CA
GetCurrentThreadId.KERNEL32 ref: 00F2B723

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b5c39be1af28e425dc00fe74da60be7a1737b30602c5f6644c6cd40f218c903a
Instruction ID: 26cc23af25f6b71e022942c6352a08afdb554d22d84a4a7b570686d872faa2a5
Opcode Fuzzy Hash: b5c39be1af28e425dc00fe74da60be7a1737b30602c5f6644c6cd40f218c903a
Instruction Fuzzy Hash: 185143B09002098FDB14CFAAE548BEEBBF5FF48314F248869E459A7250DB75A844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F292F0 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F29536

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e4991ffaadd807f105ac54c4fadbd5f88525acdb9015bfdb10e87e1a1568e583
Instruction ID: b0156e227910c1f83144f75d40b1ef3c19bfd6a48cc04d5009b899df221650e7
Opcode Fuzzy Hash: e4991ffaadd807f105ac54c4fadbd5f88525acdb9015bfdb10e87e1a1568e583
Instruction Fuzzy Hash: B0712470A04B158FDB24DF6AE4517AAB7F5BF88314F00892DD48AD7A40DB75E80ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2FB18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F2FC2A

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 479fab018da14fe5b3e8fd618688455e22e90fd7aa491c4dd8f3285e61c5c52b
Instruction ID: 13b277fd233c7367d0623a3f422f13a3064fb04f5b821d87b724874522370505
Opcode Fuzzy Hash: 479fab018da14fe5b3e8fd618688455e22e90fd7aa491c4dd8f3285e61c5c52b
Instruction Fuzzy Hash: A341E0B1D10319DFDB14CF99D884ADEBBB5BF88314F24812AE818AB210D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B818 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F2B89F

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 39c749f4746739b566ea6e0120c3fed4c299fec9c6a63aa85a8ecbef5fe378f1
Instruction ID: 7c97dbb171ce0b197d1f8ddab25951ab10be02ba5ccd2e7bbc658d52de1ccadb
Opcode Fuzzy Hash: 39c749f4746739b566ea6e0120c3fed4c299fec9c6a63aa85a8ecbef5fe378f1
Instruction Fuzzy Hash: 9821C6B5D012189FDB10CFA9D484AEEBBF8FF48324F14841AE954A7350D378A955CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F28DC0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F295B1,00000800,00000000,00000000), ref: 00F297C2

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 64ed7ba055595da09121a3dfe25f905ed379d19f4b416a99bfbcf0db4c0f1703
Instruction ID: 268b54cc6b13f563a5047b70455e9b6f9ba73abb867c35e62a829fc0214d2f99
Opcode Fuzzy Hash: 64ed7ba055595da09121a3dfe25f905ed379d19f4b416a99bfbcf0db4c0f1703
Instruction Fuzzy Hash: 0D1117B6D042188FCB10CF9AD444ADEFBF4FF48320F14842AD455A7600C7B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F294D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F29536

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 900cab0bf229ab807a4804f723f5eaae54ec8583eb0478f936c258d78da9de5c
Instruction ID: 9cd684705e404ae91cb1932b79280802ba8095c8978918c0a2a9c08505316ff4
Opcode Fuzzy Hash: 900cab0bf229ab807a4804f723f5eaae54ec8583eb0478f936c258d78da9de5c
Instruction Fuzzy Hash: A81102B5D002198FCB10CF9AD444ADEFBF4AF88324F14841AD419A7200D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2FD60 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 00F2FDBD

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f10bf803b26315e5912a4b1d25277e88fad92cc4c8b6f827e4a74d09c68e6859
Instruction ID: 30ff89b789ac0bf20004bc802117265b28fc329062445db12a96a74595515635
Opcode Fuzzy Hash: f10bf803b26315e5912a4b1d25277e88fad92cc4c8b6f827e4a74d09c68e6859
Instruction Fuzzy Hash: C311E5B58002199FDB10DF99D484BDFBBF8FB48324F54841AD955A7740D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485755896.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58fed137343121db3f99a4a12776eabd8bf3fbcf67cb7083cb45b4c4d03c0e9
Instruction ID: 8b3f338ccf3bf0b1affd5a7040ab254503a1cc7f24095d2378c35565d281e2e1
Opcode Fuzzy Hash: d58fed137343121db3f99a4a12776eabd8bf3fbcf67cb7083cb45b4c4d03c0e9
Instruction Fuzzy Hash: 09212871504244DFDB04CF50D8C0FA6BBA6FB88324F28C569E8460B246D336E856C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485755896.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0726b9705d81396a3caf246c06661114b62413764f7668eb83eb20b678bd4112
Instruction ID: 718e7211c414c5edd42651c220fe7636a79b10aa1f41b58469c1fe319c4e7149
Opcode Fuzzy Hash: 0726b9705d81396a3caf246c06661114b62413764f7668eb83eb20b678bd4112
Instruction Fuzzy Hash: 9B212871504244DFDB15CF54D8C0FA6BFA6FB88328F288569E9060B246D336D855CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DCD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485783188.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644da72b07a81f28dd16b59415afa805d61d5a3fb9a02003ba7ac38b03a09eec
Instruction ID: 320684a4733f219a1cf6af5c6d64ea8a6258ae996dac8593a073269bf64ab151
Opcode Fuzzy Hash: 644da72b07a81f28dd16b59415afa805d61d5a3fb9a02003ba7ac38b03a09eec
Instruction Fuzzy Hash: 1921C175504245DFDB14CF68D8C4F26BBA6FB88314F24C97DE84A4B246C336D846DA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DCD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485783188.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e77ec8a55c324d4e55fa36452f076048ed9d2e63486281c6ed1dd8f14d25171
Instruction ID: 584c82f7fe7048ad694491e4168da929de8c193d335e00d7a2671b5eec615712
Opcode Fuzzy Hash: 7e77ec8a55c324d4e55fa36452f076048ed9d2e63486281c6ed1dd8f14d25171
Instruction Fuzzy Hash: 5C21C171504245AFDB05DF60D9C4F26FBA6FB88318F28CA7DE8494B245C336D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00DCD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485783188.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffa6940868cd707a4296afe863c998faeaddd9bba80a2deb0d1aca15c12c74f
Instruction ID: 4e1154c32bcf3b0367557c0e07786aea856e5eea3fca398f346d414717baef81
Opcode Fuzzy Hash: 6ffa6940868cd707a4296afe863c998faeaddd9bba80a2deb0d1aca15c12c74f
Instruction Fuzzy Hash: D82180755093C08FCB02CF24D994B15BF71EB46314F28C5EED8498B697C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485755896.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction ID: e4c0389afe00be2551171b3120cf51fb0601ed0498af378391faac31f81d50ae
Opcode Fuzzy Hash: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction Fuzzy Hash: 2711E676504280CFCF12CF14D5C4B56BFB2FB85328F28C6A9D9050B656D33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485755896.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction ID: b19bd4e34e21711a9c92ab716c63273e05881f05cd411d67af9a9b283c1be9b9
Opcode Fuzzy Hash: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction Fuzzy Hash: D4110876404280CFCF11CF10D5C4B56BF72FB94324F28C6A9D8450B656D33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DCD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485783188.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc4167c3c97515e31d18ccee52d8336f50c7ccc6e38931adc408a7337d2e844
Instruction ID: 3c4619c3adb80cbb1ccdbc084a14284a9c1ce5e5cdb780a213481140a47bbad5
Opcode Fuzzy Hash: bbc4167c3c97515e31d18ccee52d8336f50c7ccc6e38931adc408a7337d2e844
Instruction Fuzzy Hash: 1F119075504280DFCB11CF10D9C4B15FB72FB84314F28C6AED8494B656C33AD85ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485755896.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cd503f57643ac4f68d76731bfea2b120f05d814e69470aa5831d05fc1faa87
Instruction ID: f2047205647181688f2f08ac9d9f99177a366753026a6a86047d3ce92503412c
Opcode Fuzzy Hash: 75cd503f57643ac4f68d76731bfea2b120f05d814e69470aa5831d05fc1faa87
Instruction Fuzzy Hash: 7D01F771008340DAE7104E62CC84BE7BB9CEF45364F18895AED471A246FB79D844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485755896.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c32604c7e11ca05021e50a0971a8f45522e79a6014790d134aa31fe56c1155
Instruction ID: ac86b0ca22fe99d6dd1bfdead445ea77c9e45f8be8d573e42d6549712e2ed3c0
Opcode Fuzzy Hash: b8c32604c7e11ca05021e50a0971a8f45522e79a6014790d134aa31fe56c1155
Instruction Fuzzy Hash: 67F062714052449EE7108E15CCC4BA3FF98EF45774F18C45AED095B286E779AC44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00792A9A Relevance: 3.0, Instructions: 2972
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00792A9A(signed int __eax, signed int __ecx, signed int __edx, void* __edi, signed int __esi, void* __fp0) {
				signed int _t1080;
				signed int _t1081;
				signed int _t1082;
				signed int* _t1083;
				signed char _t1085;
				signed int _t1087;
				signed int _t1088;
				intOrPtr* _t1089;
				signed int* _t1090;
				signed int _t1091;
				signed char _t1092;
				signed int* _t1277;
				intOrPtr* _t1278;
				void* _t1279;
				intOrPtr* _t1280;
				signed int _t1282;
				signed char _t1283;
				signed int _t1284;
				signed int _t1286;
				signed int _t1287;
				signed char _t1288;
				signed int _t1289;
				intOrPtr* _t1291;
				signed int _t1293;
				signed char _t1295;
				intOrPtr* _t1314;
				signed char _t1315;
				signed int _t1316;
				void* _t1318;
				void* _t1319;
				void* _t1320;
				void* _t1321;
				void* _t1322;
				void* _t1323;
				void* _t1324;
				void* _t1325;
				void* _t1326;
				void* _t1327;
				void* _t1328;
				signed char _t1329;
				void* _t1330;
				signed char _t1332;
				signed char _t1333;
				signed char _t1334;
				void* _t1335;
				signed char _t1336;
				signed char _t1337;
				signed char _t1680;
				signed char _t1681;
				signed char _t1683;
				signed char _t1684;
				void* _t1688;
				signed int _t1691;
				void* _t1692;
				signed char _t1694;
				void* _t1696;
				signed char _t1697;
				void* _t1741;
				signed int* _t1744;
				intOrPtr* _t1745;
				signed int _t1749;
				intOrPtr* _t1750;
				signed int _t1757;
				intOrPtr* _t1758;
				signed int _t1770;
				signed int _t1815;
				intOrPtr _t1870;
				void* _t2017;

				_t2017 = __fp0;
				_t1749 = __esi;
				_t1691 = __edx;
				_t1314 = __ecx;
				_t1078 = __eax;
				_t1744 = __edi + __esi;
				asm("adc [esi], esp");
				if(_t1744 < 0) {
					L5:
					_t2017 = _t2017 +  *_t1691;
					_t1080 = (_t1078 |  *_t1749) -  *(_t1078 |  *_t1749);
					 *_t1080 =  *_t1080 + _t1080;
					 *((intOrPtr*)(_t1080 + _t1080)) =  *((intOrPtr*)(_t1080 + _t1080)) + _t1293;
					 *_t1314 =  *_t1314 + _t1080;
					 *((intOrPtr*)(_t1080 + _t1080 + 8)) =  *((intOrPtr*)(_t1080 + _t1080 + 8)) + _t1314;
					_t1081 = _t1757;
					_t1757 = _t1080;
					 *_t1293 =  *_t1293 + _t1314;
					if ( *_t1293 == 0) goto L6;
					 *_t1081 =  *_t1081 + _t1081;
					_t1082 = _t1081 +  *_t1081;
					asm("insb");
					 *((intOrPtr*)(_t1082 + _t1082 * 8)) =  *((intOrPtr*)(_t1082 + _t1082 * 8)) + _t1691;
					asm("adc eax, 0x0");
					asm("adc esi, [eax]");
					 *_t1082 =  *_t1082 + _t1082;
					asm("adc al, 0x0");
					 *_t1082 =  *_t1082 + _t1082;
					_t1083 = _t1082 +  *_t1082;
					 *_t1314 =  *_t1314 + _t1691;
					_t1315 = _t1314 +  *((intOrPtr*)( &(_t1083[0xb46c000]) + _t1749));
					 *_t1083 =  *_t1083 | _t1315;
					 *_t1083 = _t1083 +  *_t1083;
					 *_t1293 =  *_t1293 + _t1315;
					_t1316 = _t1315 |  *_t1293;
					_t1085 = _t1083 +  *_t1691 |  *_t1749;
					_t1692 = _t1691 -  *_t1293;
					 *_t1749 =  *_t1749 ^ _t1085;
					 *_t1085 =  *_t1085 + _t1293;
					 *_t1085 =  *_t1085 + _t1085;
					_t1078 = _t1085 +  *_t1085;
					 *_t1316 =  *_t1316 + _t1692;
					 *_t1078 =  *_t1078 - _t1316;
					 *_t1749 =  *_t1749 + _t1078;
					ss = es;
					asm("salc");
					_t1694 = _t1692 +  *_t1744 +  *_t1749;
					 *_t1078 =  *_t1078 - _t1316;
					 *_t1749 =  *_t1749 + _t1078;
					_pop(ss);
					asm("salc");
					if( *_t1749 < 0) {
						 *_t1078 =  *_t1078 + _t1078;
						_t1316 = _t1316 |  *_t1694;
						_t1691 = _t1694 +  *_t1749;
						 *_t1078 =  *_t1078 - _t1316;
						goto L8;
					}
				} else {
					 *__eax =  *__eax + __eax;
					if( *__eax >= 0) {
						_t1293 = __ecx;
						 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __eax;
						_t1078 = __eax & 0x20280716;
						 *_t1078 =  *_t1078 + _t1078;
						_push(es);
						 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) - _t1078;
						 *_t1078 =  *_t1078 + _t1078;
						_push(es);
						 *0x1b28 = _t1078;
					}
					es = es;
					 *_t1078 =  *_t1078 - _t1078;
					 *_t1078 =  *_t1078 + _t1078;
					_push(es);
					 *_t1691 =  *_t1691 - _t1078;
					 *_t1078 =  *_t1078 + _t1078;
					_push(es);
					if( *_t1078 != 0) {
						L8:
						_t1288 = _t1078 - 1;
						 *_t1288 =  *_t1288 + _t1288;
						_push(es);
						_t1289 = _t1288 | 0x0000002b;
						_t1694 = (_t1691 |  *_t1749) +  *[cs:edi];
						 *_t1289 =  *_t1289 - _t1316;
						 *_t1749 =  *_t1749 + _t1289;
						asm("sbb [esi], al");
						 *_t1316 =  *_t1316 | _t1694;
						_t1291 = (_t1289 | 0x2b041316) + 3;
						asm("adc [eax+ecx], eax");
						 *_t1291 =  *_t1291 - _t1316;
						 *_t1694 =  *_t1694 + _t1316;
						 *_t1316 =  *_t1316 - _t1316;
						 *_t1694 =  *_t1694 + _t1316;
						asm("adc [edi+edx], eax");
						asm("salc");
						asm("adc eax, [ecx+edx]");
						_t1293 = _t1293 ^ _t1770;
						 *_t1744 =  *_t1744 | _t1694;
						asm("salc");
						_t1078 = _t1291 + 0x00000009 | 0x00000008;
						L9:
						 *_t1744 =  *_t1744 | _t1078;
						_t1749 = _t1749 ^ _t1316;
						_push(es);
						_t1694 = _t1694 -  *_t1293;
						 *_t1078 =  *_t1078 ^ _t1316;
					} else {
						_push(es);
						 *_t1078 =  *_t1078 + _t1078;
						_t1078 = _t1078 + 0xd0;
						_push(es);
						 *_t1078 =  *_t1078 + _t1078;
						asm("sbb ebp, [eax]");
						asm("sbb [eax], eax");
						 *_t1749 =  *_t1749 + _t1078;
						 *_t1293 =  *_t1293 - _t1078;
						 *_t1078 =  *_t1078 + _t1078;
						goto L5;
					}
				}
				 *((intOrPtr*)(_t1293 + 0x3000000)) =  *((intOrPtr*)(_t1293 + 0x3000000)) + _t1694;
				 *_t1078 =  *_t1078 + _t1078;
				asm("adc [ebx], eax");
				do {
					_t1694 = _t1694 +  *_t1744;
					asm("ficom dword [edi]");
					asm("salc");
					_t1078 = _t1078 + 0x17;
					asm("ficom dword [edi]");
					asm("salc");
					if(_t1078 < 0) {
						 *_t1078 =  *_t1078 + _t1078;
						_t1316 = _t1316 |  *_t1694;
						_push(es);
						_push(ss);
						 *_t1757 =  *_t1757 - _t1316;
						 *_t1749 =  *_t1749 + _t1078;
						_t1694 = _t1694 |  *_t1749;
						_t1284 = _t1078 | 0x0000002b;
						if(_t1284 < 0) {
							_pop(ss);
							 *_t1757 =  *_t1757 - _t1316;
							 *_t1749 =  *_t1749 + _t1284;
						}
						_push(es);
						 *_t1316 =  *_t1316 | _t1694;
						_t1286 = (_t1284 | 0x2b041316) + 0x1b;
						_t1293 = _t1316;
						 *_t1316 =  *_t1316 + _t1286;
						_t1287 = _t1286 & 0x01057216;
						 *((intOrPtr*)(_t1287 - 0x5e)) =  *((intOrPtr*)(_t1287 - 0x5e)) + _t1694;
						_t1078 = _t1287 & 0x4e280817;
						 *_t1078 =  *_t1078 + _t1078;
						_push(es);
						 *0x2b721825 = _t1078;
						 *_t1078 =  *_t1078 + _t1078;
						if( *_t1078 < 0) {
							goto L9;
						} else {
							_t1078 = _t1078 & 0x28041119;
							_t1749 = _t1749 - 1;
							 *_t1078 =  *_t1078 + _t1078;
						}
					}
					 *_t1749 =  *_t1749 + _t1078;
					 *0x33721a25 = _t1078;
					 *_t1078 =  *_t1078 + _t1078;
				} while ( *_t1078 < 0);
				 *_t1744 =  *_t1744 - _t1316;
				 *_t1749 =  *_t1749 + _t1078;
				if( *_t1749 < 0) {
					L20:
					 *_t1757 =  *_t1757 - _t1316;
					 *_t1749 =  *_t1749 + _t1078;
					_t1694 = _t1694 +  *_t1749 |  *_t1749;
					_t1757 = _t1757 |  *_t1293;
					_pop(ss);
					 *_t1757 =  *_t1757 - _t1316;
					 *_t1749 =  *_t1749 + _t1078;
					_t1087 = _t1078 | 0x703203f;
					 *_t1087 =  *_t1087 | _t1757;
					_t1088 = _t1087 - 1;
					 *_t1088 =  *_t1088 + _t1088;
					_t1316 = _t1316 |  *_t1088;
					_t1749 = _t1749 - 1;
					 *_t1088 =  *_t1088 + _t1088;
					_push(es);
					if( *_t1088 >= 0) {
						 *_t1088 =  *_t1088 + _t1088;
						if( *_t1088 >= 0) {
							_push(_t1694);
							 *_t1088 =  *_t1088 + _t1088;
							_push(es);
							 *_t1293 =  *_t1293 - _t1694;
							 *_t1749 =  *_t1749 + _t1088;
							 *_t1744 =  *_t1744 | _t1694;
							asm("salc");
							_t1078 = _t1088 | 0xdc310809;
							goto L23;
						}
						goto L24;
					}
				} else {
					 *_t1078 =  *_t1078 + _t1078;
					if( *_t1078 < 0) {
						L23:
						asm("fsubr qword [eax]");
						 *_t1078 =  *_t1078 + _t1078;
						es = es;
						ss = _t1770;
						asm("salc");
						_t1282 = _t1078 |  *_t1744;
						_push(es);
						_t1293 = _t1293 ^ _t1282;
						_t1088 = _t1282 -  *_t1282;
						 *_t1293 =  *_t1293 + _t1293;
						 *_t1694 =  *_t1694 ^ _t1088;
						 *_t1316 =  *_t1316 + _t1088;
						 *_t1088 =  *_t1088 + _t1088;
						L24:
						 *_t1088 =  *_t1088 + _t1088;
						 *_t1088 =  *_t1088 + _t1088;
						 *_t1293 =  *_t1293 + _t1088;
						_t1280 = _t1088 - 0x13;
						_t1293 = _t1293 +  *((intOrPtr*)(_t1293 + 0x12));
						 *_t1280 =  *_t1280 + _t1280;
						_t1088 = _t1280 + 0x0000002c |  *_t1694;
						_t1815 = _t1088;
					} else {
						 *((intOrPtr*)(_t1078 + 0x15)) =  *((intOrPtr*)(_t1078 + 0x15)) + _t1694;
						asm("adc eax, 0x5028");
						_push(es);
						 *_t1316 =  *_t1316 - _t1694;
						 *_t1749 =  *_t1749 + _t1078;
						 *_t1316 =  *_t1316 - _t1316;
						 *_t1694 =  *_t1694 + _t1316;
						asm("adc [edi+edx], eax");
						asm("salc");
						asm("adc eax, [ecx+edx]");
						_t1283 = _t1078 + 9;
						 *(_t1283 + 0xcd61708) =  *(_t1283 + 0xcd61708) ^ _t1770;
						 *_t1744 =  *_t1744 | _t1283;
						 *(_t1293 + 0x13002a06) =  *(_t1293 + 0x13002a06) ^ _t1316;
						 *_t1293 =  *_t1293 ^ _t1283;
						 *_t1694 =  *_t1694 + _t1316;
						 *_t1283 =  *_t1283 + _t1283;
						_t1078 = _t1283;
						 *_t1316 =  *_t1316 + _t1694;
						goto L20;
					}
				}
				if(_t1815 == 0) {
					 *_t1088 =  *_t1088 + _t1088;
					_t1279 = _t1088 + 0x28;
					if (_t1279 == 0) goto L27;
					 *_t1749 =  *_t1749 + _t1279;
					asm("fimul word [eax]");
					_t1088 = _t1279 +  *_t1293;
					 *((intOrPtr*)(_t1088 + _t1088)) =  *((intOrPtr*)(_t1088 + _t1088)) - _t1088;
					 *_t1694 =  *_t1694 + _t1316;
					asm("fsubr qword [edx]");
				}
				_t1089 = _t1088 -  *_t1088;
				 *_t1089 =  *_t1089 + _t1089;
				 *_t1089 =  *_t1089 + _t1694;
				 *_t1089 =  *_t1089 + _t1089;
				_t1090 = _t1089 +  *_t1089;
				 *_t1090 = _t1090 +  *_t1090;
				asm("sbb [eax], bl");
				 *_t1090 =  *_t1090 + _t1316;
				 *_t1090 = _t1090 +  *_t1090;
				 *_t1090 = _t1090 +  *_t1090;
				asm("adc esi, [eax]");
				 *((intOrPtr*)(_t1757 + 7)) =  *((intOrPtr*)(_t1757 + 7)) + _t1090;
				 *_t1090 = _t1090 +  *_t1090;
				 *_t1090 = _t1090 +  *_t1090;
				 *_t1090 = _t1090 +  *_t1090;
				if (_t1316 +  *_t1090 != 0) goto L29;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				_t1318 = es;
				 *_t1090 = _t1090 +  *_t1090;
				_t1319 = _t1318 +  *_t1090;
				if (_t1319 != 0) goto L30;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				_t1295 = es;
				 *_t1090 = _t1090 +  *_t1090;
				_t1320 = _t1319 +  *_t1090;
				if (_t1320 != 0) goto L31;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				_t1758 = es;
				 *_t1090 = _t1090 +  *_t1090;
				_t1321 = _t1320 +  *_t1090;
				if (_t1321 != 0) goto L32;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				_t1745 = es;
				 *_t1090 = _t1090 +  *_t1090;
				_push(es);
				_t1322 = _t1321 +  *_t1090;
				if (_t1322 <= 0) goto L33;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				asm("popad");
				 *_t1090 = _t1090 +  *_t1090;
				_push(es);
				_t1323 = _t1322 +  *_t1090;
				if (_t1323 > 0) goto L34;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				asm("arpl [eax], ax");
				 *_t1749 = _t1090 +  *_t1749;
				_t1324 = _t1323 +  *_t1090;
				if (_t1324 > 0) goto L35;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				 *[gs:eax] =  *[gs:eax] + _t1090;
				_push(es);
				_t1325 = _t1324 +  *_t1090;
				if (_t1325 < 0) goto L36;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				 *((intOrPtr*)(_t1295 + _t1749)) =  *((intOrPtr*)(_t1295 + _t1749)) + _t1090;
				_push(es);
				_t1326 = _t1325 +  *_t1090;
				if (_t1326 != 0) goto L37;
				 *_t1749 = _t1090 +  *_t1749;
				asm("outsd");
				_t1091 =  *_t1090 * 0x28020600;
				if (_t1091 >= 0) goto L38;
				 *_t1749 =  *_t1749 + _t1091;
				asm("outsd");
				_t1092 =  *_t1091 * 0;
				_push(es);
				_t1327 = _t1326 +  *_t1092;
				if (_t1327 >= 0) goto L39;
				 *_t1749 =  *_t1749 + _t1092;
				asm("outsd");
				asm("insd");
				 *_t1092 =  *_t1092 + _t1092;
				_push(es);
				_t1328 = _t1327 +  *_t1092;
				if (_t1328 >= 0) goto L40;
				 *_t1749 =  *_t1749 + _t1092;
				asm("outsd");
				asm("outsd");
				 *_t1092 =  *_t1092 + _t1092;
				_push(es);
				_t1329 = _t1328 +  *((intOrPtr*)(_t1745 + 0x60));
				 *_t1092 =  *_t1092 + _t1092;
				_push(es);
				 *_t1694 =  *_t1694 - _t1295;
				 *_t1749 =  *_t1749 + _t1092;
				do {
					_push(es);
					_t1330 = _t1329 +  *_t1092;
					if (_t1330 != 0) goto L42;
					 *_t1749 =  *_t1749 + _t1092;
					 *_t1092 =  *_t1092 + _t1092;
					ss = es;
					 *((intOrPtr*)(_t1092 + _t1092)) =  *((intOrPtr*)(_t1092 + _t1092)) - _t1295;
					_push(es);
					_t1332 = _t1330 +  *((intOrPtr*)(_t1745 + 0x58)) +  *((intOrPtr*)(_t1745 + 0x58));
					 *_t1092 =  *_t1092 + _t1092;
					_push(es);
					if( *_t1092 < 0) {
						L49:
						_t1092 = _t1092 +  *_t1092;
						 *_t1745 =  *_t1745 + _t1295;
						asm("aaa");
						if( *_t1745 >= 0) {
							goto L58;
						} else {
							 *_t1092 =  *_t1092 + _t1092;
							_t1329 = _t1332 |  *_t1092;
							 *_t1092 =  *_t1092 + 0x6f020600;
							_pop(_t1278);
							 *_t1278 =  *_t1278 + _t1278;
							_push(es);
							_push(ss);
							 *((intOrPtr*)(_t1694 + 0x2060000)) =  *((intOrPtr*)(_t1694 + 0x2060000)) - _t1278;
							goto L51;
						}
					} else {
						 *_t1092 =  *_t1092 + _t1092;
						if( *_t1092 >= 0) {
							 *_t1092 =  *_t1092 + _t1092;
							_pop(ss);
							asm("sbb [esi], edx");
							 *_t1758 =  *_t1758 - _t1295;
							 *_t1749 =  *_t1749 + _t1092;
							 *_t1749 =  *_t1749 - _t1295;
							 *_t1749 =  *_t1749 + _t1092;
							 *_t1092 =  *_t1092 + _t1092;
							ds = es;
							ds = _t1092;
							_t1092 = _t1092 - 0x5373;
							_t1332 = _t1332 + 0x00000001 +  *((intOrPtr*)(_t1745 + 0x58)) |  *_t1092;
							if (_t1332 > 0) goto L46;
						}
						 *_t1092 =  *_t1092 + _t1092;
						 *_t1749 =  *_t1749 + _t1092;
						_t1332 = _t1332 +  *((intOrPtr*)(_t1745 + 0x58));
						 *_t1092 =  *_t1092 + _t1092;
						_push(es);
						if( *_t1092 < 0) {
							L58:
							_t1333 = _t1332 - 1;
							 *(_t1295 + 0x73000000) =  *(_t1295 + 0x73000000) & _t1092;
							_push(_t1295);
							 *_t1092 =  *_t1092 + _t1092;
							L59:
							_t1334 = _t1333 |  *_t1092;
							if (_t1334 > 0) goto L60;
							 *_t1749 =  *_t1749 + _t1092;
							_t1335 = _t1334 +  *((intOrPtr*)(_t1745 + 0x5a));
							 *_t1092 =  *_t1092 + _t1092;
							_push(es);
							if( *_t1092 < 0) {
								L54:
								asm("outsd");
								_pop(_t1696);
								 *_t1092 =  *_t1092 + _t1092;
								ss = es;
								 *((intOrPtr*)(_t1092 + _t1092)) =  *((intOrPtr*)(_t1092 + _t1092)) - _t1295;
								_push(es);
								_t1333 = _t1335 +  *((intOrPtr*)(_t1745 + 0x5a));
								 *_t1092 =  *_t1092 + _t1092;
								_push(es);
								if( *_t1092 < 0) {
									goto L64;
								} else {
									 *_t1092 =  *_t1092 + _t1092;
									if( *_t1092 >= 0) {
										 *_t1092 =  *_t1092 + _t1092;
										_t1092 = _t1092 + 1;
										_t1688 = _t1333 + 1;
										_push(ss);
										asm("sbb [esi], edx");
										 *_t1758 =  *_t1758 - _t1295;
										 *_t1749 =  *_t1749 + _t1092;
										L57:
										 *_t1749 =  *_t1749 - _t1295;
										 *_t1749 =  *_t1749 + _t1092;
										_t1332 = _t1688 +  *((intOrPtr*)(_t1745 + 0x5a));
										 *_t1092 =  *_t1092 + _t1092;
										ds = es;
										goto L58;
									}
									goto L59;
								}
							} else {
								 *_t1092 =  *_t1092 + _t1092;
								if( *_t1092 < 0) {
									L66:
									asm("outsd");
									_pop(_t1697);
									 *_t1092 =  *_t1092 + _t1092;
									_push(es);
									if( *_t1092 < 0) {
										goto L63;
									} else {
										 *_t1092 =  *_t1092 + _t1092;
										if( *_t1092 < 0) {
											L71:
											 *_t1749 =  *_t1749 - _t1295;
											 *_t1749 =  *_t1749 + _t1092;
											_t1333 = _t1333 +  *((intOrPtr*)(_t1745 + 0x5c));
											 *_t1092 =  *_t1092 + _t1092;
											_push(es);
											 *(_t1758 + 0x20000000) =  *(_t1758 + 0x20000000) & _t1092;
											goto L72;
										} else {
											 *_t1092 =  *_t1092;
											_push(es);
											 *_t1092 =  *_t1092 + _t1092;
											ss = es;
											 *((intOrPtr*)(_t1092 + _t1092)) =  *((intOrPtr*)(_t1092 + _t1092)) - _t1295;
											_push(es);
											_t1336 = _t1333 +  *((intOrPtr*)(_t1745 + 0x5c)) +  *((intOrPtr*)(_t1745 + 0x5c));
											 *_t1092 =  *_t1092 + _t1092;
											_push(es);
											if( *_t1092 < 0) {
												_pop(_t1770);
												 *_t1092 =  *_t1092 + _t1092;
												_t1295 = _t1295 & _t1295;
												 *_t1092 =  *_t1092 + _t1092;
												 *_t1745 =  *_t1745 + _t1295;
												ds = es;
												if( *_t1745 >= 0) {
													L90:
													asm("adc al, [ecx]");
													 *_t1092 =  *_t1092 + _t1092;
													_t1697 = _t1697 & _t1092;
													 *_t1092 =  *_t1092 + _t1092;
													 *((intOrPtr*)(_t1295 + 0x53)) =  *((intOrPtr*)(_t1295 + 0x53)) + _t1697;
													goto L91;
												} else {
													 *_t1092 =  *_t1092 + _t1092;
													_t1683 = _t1336 |  *_t1092;
													 *_t1092 =  *_t1092 + 0x6f020600;
													 *_t1092 =  *_t1092 + _t1092;
													_push(es);
													asm("sbb [eax], ch");
													L80:
													 *_t1092 =  *_t1092;
													_t1683 = _t1683 +  *((intOrPtr*)(_t1745 + 0x5c));
													asm("outsd");
													_t1770 = es;
													 *_t1092 =  *_t1092 + _t1092;
													_push(es);
													if( *_t1092 < 0) {
														L95:
														_t1092 = _t1092 +  *_t1092;
														if(_t1092 < 0) {
															goto L99;
														} else {
															 *_t1092 =  *_t1092;
															_push(es);
															_t1336 = _t1683 +  *((intOrPtr*)(_t1745 + 0x5e));
															goto L97;
														}
													} else {
														_t1092 = _t1092 +  *_t1092;
														if(_t1092 < 0) {
															L89:
															 *_t1749 =  *_t1749 - _t1295;
															 *_t1749 =  *_t1749 + _t1092;
															_t1336 = _t1683 +  *((intOrPtr*)(_t1745 + 0x5e));
															 *_t1092 =  *_t1092 + _t1092;
															_push(es);
															 *_t1697 =  *_t1697 & _t1697;
															goto L90;
														} else {
															 *_t1092 =  *_t1092;
															_push(es);
															_t1333 = _t1683 +  *((intOrPtr*)(_t1745 + 0x5e));
															 *_t1092 =  *_t1092 + _t1092;
															ss = es;
															_t68 = _t1092 + _t1092;
															 *_t68 =  *((intOrPtr*)(_t1092 + _t1092)) - _t1295;
															_t1870 =  *_t68;
															if (_t1870 < 0) goto L86;
															 *_t1749 =  *_t1749 + _t1092;
															_t1336 = _t1333 +  *((intOrPtr*)(_t1745 + 0x5e));
															 *_t1092 =  *_t1092 + _t1092;
															_push(es);
															if( *_t1092 < 0) {
																L97:
																_pop(_t1750);
																 *_t1092 =  *_t1092 + _t1092;
																_t77 = _t1750 + 0x1f000000;
																 *_t77 =  *(_t1750 + 0x1f000000) & _t1092;
																ds = es;
																if( *_t77 < 0) {
																	 *_t1092 =  *_t1092 + _t1092;
																	 *_t1092 =  *_t1092 + 0x6f020600;
																	 *_t1092 =  *_t1092 + _t1092;
																	_push(es);
																	asm("sbb [eax], ebp");
																	 *_t1092 =  *_t1092;
																	_push(es);
																	_t1683 = (_t1336 |  *_t1092) +  *((intOrPtr*)(_t1745 + 0x5e));
																	L99:
																	asm("outsd");
																	_pop(_t1749);
																	 *_t1092 =  *_t1092 + _t1092;
																	_push(es);
																	if( *_t1092 < 0) {
																		_t1683 = _t1683 +  *((intOrPtr*)(_t1745 + 0x5e));
																		 *_t1092 =  *_t1092 + _t1092;
																		_push(es);
																		if( *_t1092 < 0) {
																			goto L80;
																		} else {
																			goto L95;
																		}
																	} else {
																		_t1092 = _t1092 +  *_t1092;
																		if(_t1092 >= 0) {
																			 *_t1092 =  *_t1092;
																			_push(es);
																			_t1684 = _t1683 +  *((intOrPtr*)(_t1745 + 0x60));
																			 *_t1092 =  *_t1092 + _t1092;
																			_push(es);
																			 *_t1758 =  *_t1758 - _t1697;
																			 *_t1092 =  *_t1092 + _t1092;
																			 *_t1749 =  *_t1749 + _t1092;
																			_t1683 = (_t1684 |  *_t1092) +  *((intOrPtr*)(_t1745 + 0x60));
																			 *_t1092 =  *_t1092 + _t1092;
																			_push(es);
																			 *((intOrPtr*)(_t1758 + 0x2060000)) =  *((intOrPtr*)(_t1758 + 0x2060000)) - _t1092;
																			asm("outsd");
																			asm("bound eax, [eax]");
																			 *_t1749 =  *_t1749 + _t1092;
																			 *((intOrPtr*)(_t1749 + 0x2060000)) =  *((intOrPtr*)(_t1749 + 0x2060000)) - _t1092;
																		}
																		 *_t1749 =  *_t1749 + _t1092;
																		_t1336 = _t1683 +  *((intOrPtr*)(_t1745 + 0x60));
																		 *_t1092 =  *_t1092 + _t1092;
																		_push(es);
																		 *((intOrPtr*)(_t1758 + 0x2060000)) =  *((intOrPtr*)(_t1758 + 0x2060000)) - _t1092;
																	}
																}
															} else {
																 *_t1092 =  *_t1092 + _t1092;
																if( *_t1092 >= 0) {
																	 *_t1092 =  *_t1092 + _t1092;
																	_t1092 = _t1092 &  *(_t1336 + 0x17);
																	asm("sbb [esi], edx");
																	 *_t1758 =  *_t1758 - _t1295;
																	 *_t1749 =  *_t1749 + _t1092;
																	goto L89;
																}
																L91:
																_push(_t1295);
															}
														}
													}
												}
											} else {
												 *_t1092 =  *_t1092 + _t1092;
												if( *_t1092 >= 0) {
													 *_t1092 =  *_t1092 + _t1092;
													_t1092 = _t1092 &  *(_t1336 + 0x16);
													asm("sbb [esi], edx");
													 *_t1758 =  *_t1758 - _t1295;
													 *_t1749 =  *_t1749 + _t1092;
													goto L71;
												}
												goto L73;
											}
										}
									}
								} else {
									 *_t1092 =  *_t1092;
									_push(es);
									_t1333 = _t1335 +  *((intOrPtr*)(_t1745 + 0x5a));
									L63:
									_pop(_t1696);
									 *_t1092 =  *_t1092 + _t1092;
									L64:
									 *(_t1758 + 2) =  *(_t1758 + 2) & _t1092;
									 *_t1092 =  *_t1092 + _t1092;
									ds = es;
									_t1697 = _t1696 - 1;
									if(_t1697 >= 0) {
										L72:
										asm("movsd");
										 *_t1092 =  *_t1092 + _t1092;
										 *_t1092 =  *_t1092 + _t1092;
										_t1092 = _t1092 +  *_t1333;
										 *_t1092 =  *_t1092 + _t1092;
										if ( *_t1092 >= 0) goto L85;
										L73:
										_push(_t1295);
									} else {
										 *_t1092 =  *_t1092 + _t1092;
										_t1333 = _t1333 |  *_t1092;
										 *_t1092 =  *_t1092 + 0x6f020600;
										_pop(_t1741);
										 *_t1092 =  *_t1092 + _t1092;
										ss = es;
										 *((intOrPtr*)(_t1741 + 0x2060000)) =  *((intOrPtr*)(_t1741 + 0x2060000)) - _t1092;
										goto L66;
									}
								}
							}
						} else {
							 *_t1092 =  *_t1092 + _t1092;
							if( *_t1092 < 0) {
								goto L51;
							} else {
								 *_t1092 =  *_t1092;
								_push(es);
								_t1332 = _t1332 +  *((intOrPtr*)(_t1745 + 0x58));
								 *_t1092 =  *_t1092 + _t1092;
								_push(es);
								 *(_t1745 + 0x1f000002) =  *(_t1745 + 0x1f000002) & _t1694;
								goto L49;
							}
						}
					}
					L104:
					_push(es);
					_t1337 = _t1336 +  *((intOrPtr*)(_t1745 + 0x64));
					 *_t1092 =  *_t1092 + _t1092;
					_push(es);
					 *((intOrPtr*)(_t1750 + 0x2060000)) =  *((intOrPtr*)(_t1750 + 0x2060000)) - _t1092;
					while(1) {
						asm("outsd");
						asm("pushad");
						 *_t1092 =  *_t1092 + _t1092;
						_push(es);
						_t1697 = _t1697 & _t1697;
						 *_t1092 =  *_t1092 + _t1092;
						 *_t1092 =  *_t1092 + _t1092;
						 *_t1092 =  *_t1092 + _t1092;
						if( *_t1092 >= 0) {
							break;
						}
						 *_t1092 =  *_t1092 + _t1092;
						_t1680 = _t1337 |  *_t1092;
						if (_t1680 > 0) goto L107;
						 *_t1750 =  *_t1750 + _t1092;
						_t1337 = _t1680 +  *((intOrPtr*)(_t1745 + 0x60));
						 *_t1092 =  *_t1092 + _t1092;
						_push(es);
						if( *_t1092 < 0) {
							continue;
						} else {
							_t1277 = _t1092 +  *_t1092;
							if(_t1277 >= 0) {
								 *_t1277 =  *_t1277;
								_push(es);
								_t1681 = _t1337 +  *((intOrPtr*)(_t1745 + 0x60));
								 *_t1277 = _t1277 +  *_t1277;
								_push(es);
								 *_t1697 =  *_t1697 & _t1681;
								 *_t1277 = _t1277 +  *_t1277;
								 *_t1277 = _t1277 +  *_t1277;
								asm("pushfd");
								 *_t1277 = _t1277 +  *_t1277;
								 *((intOrPtr*)(_t1295 + 0x54)) =  *((intOrPtr*)(_t1295 + 0x54)) + _t1697;
								 *_t1277 = _t1277 +  *_t1277;
								_t1337 = _t1681 |  *_t1277;
								 *_t1277 =  *_t1277 + 0x6f020600;
								asm("pushad");
								 *_t1277 = _t1277 +  *_t1277;
								_push(es);
								asm("sbb ch, [eax]");
								 *_t1277 =  *_t1277;
							}
							 *_t1750 =  *_t1750 + _t1277;
							_t1337 = _t1337 +  *((intOrPtr*)(_t1745 + 0x60));
							 *_t1277 = _t1277 +  *_t1277;
							_push(es);
							_push(ss);
							 *((intOrPtr*)(_t1745 + 0x2060000)) =  *((intOrPtr*)(_t1745 + 0x2060000)) - _t1277;
							do {
								asm("outsd");
								asm("pushad");
								 *_t1277 = _t1277 +  *_t1277;
								_push(es);
							} while ( *_t1277 < 0);
							_t1092 = _t1277 +  *_t1277;
						}
						break;
					}
					 *((intOrPtr*)(_t1092 + 0x28)) =  *((intOrPtr*)(_t1092 + 0x28)) + _t1697;
					L51:
					asm("outsd");
					_pop(_t1092);
					 *_t1092 =  *_t1092 + _t1092;
					_push(es);
				} while ( *_t1092 < 0);
				 *_t1092 =  *_t1092 + _t1092;
				if( *_t1092 < 0) {
					goto L57;
				} else {
					 *_t1092 =  *_t1092;
					_push(es);
					_t1335 = _t1329 +  *((intOrPtr*)(_t1745 + 0x5a));
					goto L54;
				}
				goto L104;
			}

0x00792a9a
0x00792a9a
0x00792a9a
0x00792a9a
0x00792a9a
0x00792a9a
0x00792a9c
0x00792a9e
0x00792adb
0x00792adc
0x00792ae0
0x00792ae2
0x00792ae4
0x00792ae7
0x00792ae9
0x00792aed
0x00792aed
0x00792aee
0x00792af0
0x00792af2
0x00792af4
0x00792af6
0x00792af7
0x00792afb
0x00792b00
0x00792b02
0x00792b04
0x00792b06
0x00792b08
0x00792b0a
0x00792b0c
0x00792b13
0x00792b15
0x00792b17
0x00792b19
0x00792b1d
0x00792b1f
0x00792b21
0x00792b23
0x00792b26
0x00792b28
0x00792b2a
0x00792b2e
0x00792b31
0x00792b33
0x00792b34
0x00792b35
0x00792b37
0x00792b3a
0x00792b3c
0x00792b3d
0x00792b3e
0x00792b40
0x00792b42
0x00792b44
0x00792b46
0x00000000
0x00792b46
0x00792aa0
0x00792aa0
0x00792aa2
0x00792aa4
0x00792aa7
0x00792aa9
0x00792aae
0x00792ab0
0x00792ab1
0x00792ab3
0x00792ab5
0x00792ab6
0x00792ab6
0x00792abc
0x00792abd
0x00792abf
0x00792ac1
0x00792ac2
0x00792ac4
0x00792ac6
0x00792ac7
0x00792b47
0x00792b47
0x00792b48
0x00792b4a
0x00792b4d
0x00792b4f
0x00792b52
0x00792b55
0x00792b5c
0x00792b5e
0x00792b60
0x00792b62
0x00792b65
0x00792b68
0x00792b6a
0x00792b6d
0x00792b6f
0x00792b72
0x00792b73
0x00792b78
0x00792b7a
0x00792b7c
0x00792b7d
0x00792b7e
0x00792b7e
0x00792b80
0x00792b82
0x00792b83
0x00792b85
0x00792ac9
0x00792ac9
0x00792aca
0x00792acc
0x00792ace
0x00792acf
0x00792ad1
0x00792ad3
0x00792ad5
0x00792ad7
0x00792ad9
0x00000000
0x00792ad9
0x00792ac7
0x00792b87
0x00792b8d
0x00792b8f
0x00792b90
0x00792b90
0x00792b92
0x00792b94
0x00792b95
0x00792b97
0x00792b99
0x00792b9a
0x00792b9c
0x00792b9e
0x00792ba0
0x00792ba1
0x00792ba2
0x00792ba5
0x00792ba7
0x00792ba9
0x00792bab
0x00792bad
0x00792bae
0x00792bb1
0x00792bb1
0x00792bb9
0x00792bba
0x00792bbc
0x00792bbe
0x00792bc1
0x00792bc3
0x00792bc8
0x00792bcb
0x00792bd0
0x00792bd2
0x00792bd3
0x00792bd8
0x00792bda
0x00000000
0x00792bdc
0x00792bdc
0x00792be1
0x00792be2
0x00792be2
0x00792bda
0x00792be3
0x00792be5
0x00792bea
0x00792bea
0x00792bee
0x00792bf1
0x00792bf3
0x00792c30
0x00792c32
0x00792c35
0x00792c37
0x00792c39
0x00792c3d
0x00792c3e
0x00792c41
0x00792c45
0x00792c4a
0x00792c4c
0x00792c4d
0x00792c4f
0x00792c51
0x00792c52
0x00792c54
0x00792c55
0x00792c57
0x00792c59
0x00792c5b
0x00792c5c
0x00792c5e
0x00792c5f
0x00792c62
0x00792c64
0x00792c66
0x00792c67
0x00000000
0x00792c67
0x00000000
0x00792c59
0x00792bf5
0x00792bf5
0x00792bf7
0x00792c6b
0x00792c6b
0x00792c6e
0x00792c71
0x00792c72
0x00792c73
0x00792c74
0x00792c76
0x00792c77
0x00792c79
0x00792c7b
0x00792c7d
0x00792c7f
0x00792c81
0x00792c83
0x00792c83
0x00792c85
0x00792c87
0x00792c89
0x00792c8b
0x00792c8e
0x00792c92
0x00792c92
0x00792bf9
0x00792bfb
0x00792bfe
0x00792c03
0x00792c04
0x00792c07
0x00792c09
0x00792c0c
0x00792c0e
0x00792c11
0x00792c12
0x00792c15
0x00792c17
0x00792c1d
0x00792c1f
0x00792c25
0x00792c27
0x00792c2a
0x00792c2c
0x00792c2e
0x00000000
0x00792c2e
0x00792bf7
0x00792c94
0x00792c96
0x00792c98
0x00792c9a
0x00792c9c
0x00792c9e
0x00792ca0
0x00792ca2
0x00792ca5
0x00792ca7
0x00792ca7
0x00792ca8
0x00792caa
0x00792cac
0x00792cae
0x00792cb0
0x00792cb2
0x00792cb4
0x00792cb6
0x00792cb8
0x00792cba
0x00792cbc
0x00792cbf
0x00792cc2
0x00792cc4
0x00792cc6
0x00792cca
0x00792ccc
0x00792cce
0x00792ccf
0x00792cd0
0x00792cd3
0x00792cd5
0x00792cd7
0x00792cd9
0x00792cda
0x00792cdb
0x00792cde
0x00792ce0
0x00792ce2
0x00792ce4
0x00792ce5
0x00792ce6
0x00792ce9
0x00792ceb
0x00792ced
0x00792cef
0x00792cf0
0x00792cf1
0x00792cf3
0x00792cf4
0x00792cf6
0x00792cf8
0x00792cfa
0x00792cfb
0x00792cfc
0x00792cfe
0x00792cff
0x00792d01
0x00792d03
0x00792d05
0x00792d06
0x00792d08
0x00792d0a
0x00792d0c
0x00792d0e
0x00792d10
0x00792d11
0x00792d14
0x00792d15
0x00792d17
0x00792d19
0x00792d1b
0x00792d1c
0x00792d1f
0x00792d20
0x00792d22
0x00792d24
0x00792d26
0x00792d27
0x00792d2d
0x00792d2f
0x00792d31
0x00792d32
0x00792d35
0x00792d36
0x00792d38
0x00792d3a
0x00792d3c
0x00792d3d
0x00792d3e
0x00792d40
0x00792d41
0x00792d43
0x00792d45
0x00792d47
0x00792d48
0x00792d49
0x00792d4b
0x00792d4c
0x00792d4f
0x00792d51
0x00792d52
0x00792d55
0x00792d56
0x00792d56
0x00792d57
0x00792d59
0x00792d5b
0x00792d60
0x00792d63
0x00792d64
0x00792d68
0x00792d69
0x00792d6c
0x00792d6e
0x00792d6f
0x00792db2
0x00792db2
0x00792db4
0x00792db6
0x00792db7
0x00000000
0x00792db9
0x00792db9
0x00792dbb
0x00792dbd
0x00792dc3
0x00792dc4
0x00792dc6
0x00792dc7
0x00792dc8
0x00000000
0x00792dc8
0x00792d71
0x00792d71
0x00792d73
0x00792d75
0x00792d79
0x00792d7a
0x00792d7c
0x00792d7f
0x00792d81
0x00792d84
0x00792d89
0x00792d8c
0x00792d8e
0x00792d8f
0x00792d94
0x00792d96
0x00792d96
0x00792d97
0x00792d98
0x00792d9a
0x00792d9d
0x00792d9f
0x00792da0
0x00792e0d
0x00792e0d
0x00792e0e
0x00792e14
0x00792e15
0x00792e17
0x00792e17
0x00792e19
0x00792e1b
0x00792e1d
0x00792e20
0x00792e22
0x00792e23
0x00792dde
0x00792dde
0x00792ddf
0x00792de0
0x00792de3
0x00792de4
0x00792de8
0x00792de9
0x00792dec
0x00792dee
0x00792def
0x00000000
0x00792df1
0x00792df1
0x00792df3
0x00792df5
0x00792df7
0x00792df8
0x00792df9
0x00792dfa
0x00792dfc
0x00792dff
0x00792e01
0x00792e01
0x00792e04
0x00792e06
0x00792e09
0x00792e0c
0x00000000
0x00792e0c
0x00000000
0x00792df3
0x00792e25
0x00792e25
0x00792e27
0x00792e51
0x00792e51
0x00792e52
0x00792e53
0x00792e55
0x00792e56
0x00000000
0x00792e58
0x00792e58
0x00792e5a
0x00792e84
0x00792e84
0x00792e87
0x00792e89
0x00792e8c
0x00792e8e
0x00792e8f
0x00000000
0x00792e5c
0x00792e5c
0x00792e5f
0x00792e63
0x00792e66
0x00792e67
0x00792e6b
0x00792e6c
0x00792e6f
0x00792e71
0x00792e72
0x00792eb5
0x00792eb6
0x00792eb9
0x00792ebb
0x00792ebd
0x00792ebf
0x00792ec0
0x00792f16
0x00792f16
0x00792f18
0x00792f1a
0x00792f1c
0x00792f1e
0x00000000
0x00792ec2
0x00792ec2
0x00792ec4
0x00792ec6
0x00792ecd
0x00792ecf
0x00792ed0
0x00792ed2
0x00792ed2
0x00792ed6
0x00792ed7
0x00792ed8
0x00792ed9
0x00792edb
0x00792edc
0x00792f31
0x00792f31
0x00792f33
0x00000000
0x00792f35
0x00792f35
0x00792f38
0x00792f39
0x00000000
0x00792f39
0x00792ede
0x00792ede
0x00792ee0
0x00792f0a
0x00792f0a
0x00792f0d
0x00792f0f
0x00792f12
0x00792f14
0x00792f15
0x00000000
0x00792ee2
0x00792ee2
0x00792ee5
0x00792ee6
0x00792ee9
0x00792eec
0x00792eed
0x00792eed
0x00792eed
0x00792eee
0x00792ef0
0x00792ef2
0x00792ef5
0x00792ef7
0x00792ef8
0x00792f3b
0x00792f3b
0x00792f3c
0x00792f3f
0x00792f3f
0x00792f45
0x00792f46
0x00792f48
0x00792f4c
0x00792f53
0x00792f55
0x00792f56
0x00792f58
0x00792f5b
0x00792f5c
0x00792f5d
0x00792f5d
0x00792f5e
0x00792f5f
0x00792f61
0x00792f62
0x00792f29
0x00792f2c
0x00792f2e
0x00792f2f
0x00000000
0x00000000
0x00000000
0x00000000
0x00792f64
0x00792f64
0x00792f66
0x00792f68
0x00792f6b
0x00792f6c
0x00792f6f
0x00792f71
0x00792f72
0x00792f74
0x00792f7a
0x00792f7c
0x00792f7f
0x00792f81
0x00792f82
0x00792f88
0x00792f89
0x00792f8b
0x00792f8d
0x00792f8d
0x00792f90
0x00792f92
0x00792f95
0x00792f97
0x00792f98
0x00792f98
0x00792f62
0x00792efa
0x00792efa
0x00792efc
0x00792efe
0x00792f00
0x00792f03
0x00792f05
0x00792f08
0x00000000
0x00792f08
0x00792f20
0x00792f20
0x00792f20
0x00792ef8
0x00792ee0
0x00792edc
0x00792e74
0x00792e74
0x00792e76
0x00792e78
0x00792e7a
0x00792e7d
0x00792e7f
0x00792e82
0x00000000
0x00792e82
0x00000000
0x00792e76
0x00792e72
0x00792e5a
0x00792e29
0x00792e29
0x00792e2c
0x00792e2d
0x00792e2f
0x00792e2f
0x00792e30
0x00792e32
0x00792e33
0x00792e36
0x00792e38
0x00792e39
0x00792e3a
0x00792e90
0x00792e90
0x00792e91
0x00792e93
0x00792e95
0x00792e97
0x00792e99
0x00792e9a
0x00792e9a
0x00792e3c
0x00792e3c
0x00792e3e
0x00792e40
0x00792e46
0x00792e47
0x00792e4a
0x00792e4b
0x00000000
0x00792e4b
0x00792e3a
0x00792e27
0x00792da2
0x00792da2
0x00792da4
0x00000000
0x00792da6
0x00792da6
0x00792da9
0x00792daa
0x00792dad
0x00792daf
0x00792db0
0x00000000
0x00792db0
0x00792da4
0x00792da0
0x00792f9c
0x00792f9c
0x00792f9d
0x00792fa0
0x00792fa2
0x00792fa3
0x00792fa9
0x00792fa9
0x00792faa
0x00792fab
0x00792fad
0x00792fae
0x00792fb0
0x00792fb2
0x00792fb6
0x00792fb8
0x00000000
0x00000000
0x00792fba
0x00792fbc
0x00792fbe
0x00792fc0
0x00792fc2
0x00792fc5
0x00792fc7
0x00792fc8
0x00000000
0x00792fca
0x00792fca
0x00792fcc
0x00792fce
0x00792fd1
0x00792fd2
0x00792fd5
0x00792fd7
0x00792fd8
0x00792fda
0x00792fdc
0x00792fde
0x00792fdf
0x00792fe1
0x00792fe4
0x00792fe6
0x00792fe8
0x00792fee
0x00792fef
0x00792ff1
0x00792ff2
0x00792ff4
0x00792ff4
0x00792ff6
0x00792ff8
0x00792ffb
0x00792ffd
0x00792ffe
0x00792fff
0x00793005
0x00793005
0x00793006
0x00793007
0x00793009
0x00793009
0x0079300c
0x0079300c
0x00000000
0x00792fc8
0x0079300d
0x00792dce
0x00792dce
0x00792dcf
0x00792dd0
0x00792dd2
0x00792dd2
0x00792dd5
0x00792dd7
0x00000000
0x00792dd9
0x00792dd9
0x00792ddc
0x00792ddd
0x00000000
0x00792ddd
0x00000000

Memory Dump Source

Source File: 00000000.00000002.485519399.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.485512124.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.485626977.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c16988bc374efbe8984b744a0d422c9886ef6c69ca86c5214c3506f4c5c420
Instruction ID: e4bde77b2b9d13c9e7d3b6b0f8079352e180649373d1cdc18f2946681893bdfc
Opcode Fuzzy Hash: 54c16988bc374efbe8984b744a0d422c9886ef6c69ca86c5214c3506f4c5c420
Instruction Fuzzy Hash: 3633176104F7C22FDB134B346C756E67FB86E9322471E45CBE8C08B5A3E2181A69D376

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E398 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f1360b412ff9521b9a7d15cea66dd371a8d54bf8db45fdb64c1d44c0475908
Instruction ID: 6d0aa52dcda6bbc0d7412577da06f2f9ee7f31cdf8e85593c043e973c9d01f53
Opcode Fuzzy Hash: d6f1360b412ff9521b9a7d15cea66dd371a8d54bf8db45fdb64c1d44c0475908
Instruction Fuzzy Hash: A212B7F16117468FD3B8CF6AE9882893F63B755328B904328D1711BAD9D7B4A1CACF44

Uniqueness

Uniqueness Score: -1.00%

Function 00F2C084 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d4d0f5b89480d0a03cdf61189c0f0b2442bca6c2c42cb3298f42ca3e63739c
Instruction ID: 51ff953e3229c62846ea6e4ae3ed4be78804d6b6a9edccbb7ad21e5ad9db53a6
Opcode Fuzzy Hash: a7d4d0f5b89480d0a03cdf61189c0f0b2442bca6c2c42cb3298f42ca3e63739c
Instruction Fuzzy Hash: 28A18E32E00229CFCF15DFB5D8445DEBBB2FF85300B15856AE815BB221EB39A955DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F2E388 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.485915940.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3dedfe7938a50560df1cae8388c25107d97d975558dbab03ec0422a17664be
Instruction ID: 8d22285512c1184623f47fc5a8c76aafffa0d3818322e0d24628179f30fdc344
Opcode Fuzzy Hash: dd3dedfe7938a50560df1cae8388c25107d97d975558dbab03ec0422a17664be
Instruction Fuzzy Hash: 1CC12DB16117468ED3A8CF6AE9841897F73BB95328F504328D1716BAD8D7B470CACF44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 5JbQqP8SDG.exePID: 4676, Parent PID: 7036COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Executed Functions

Function 064517DE Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TabbedTextOutA.USER32 ref: 0645181C

Memory Dump Source

Source File: 00000006.00000002.721402619.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6450000_5JbQqP8SDG.jbxd

Similarity

API ID: TabbedText
String ID:
API String ID: 419215656-0
Opcode ID: c5e51ebcdb5af1d9657f277750cf73e396762a2027a876d7ce359ad765eec7f9
Instruction ID: 2dea4cd165df9a835f14b308d36583967bb99208d69b7410813c6ae66533f04e
Opcode Fuzzy Hash: c5e51ebcdb5af1d9657f277750cf73e396762a2027a876d7ce359ad765eec7f9
Instruction Fuzzy Hash: 72E06822B0D2408FD36A9368E415B1D7BB9EF86215F0600EBD50ECF293E8119C0543E3

Uniqueness

Uniqueness Score: -1.00%

Function 064517F8 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TabbedTextOutA.USER32 ref: 0645181C

Memory Dump Source

Source File: 00000006.00000002.721402619.0000000006450000.00000040.00000800.00020000.00000000.sdmp, Offset: 06450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6450000_5JbQqP8SDG.jbxd

Similarity

API ID: TabbedText
String ID:
API String ID: 419215656-0
Opcode ID: cabef6675a42fe75c98bb5baddeea42557116dc9a463969da265188aaef1f6fd
Instruction ID: c29c76fc42165634c8b63d252b7e3cce43fad49e379ef0e631b04268c3b85ead
Opcode Fuzzy Hash: cabef6675a42fe75c98bb5baddeea42557116dc9a463969da265188aaef1f6fd
Instruction Fuzzy Hash: 77D0A731B18024DF57A866ACB414ABC33ADEBCD75531200ABED0BCB352ED526C0247E3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 5JbQqP8SDG.exePID: 5976, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	104
Total number of Limit Nodes:	11

Executed Functions

Function 00ABB5E0 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ABB650
GetCurrentThread.KERNEL32 ref: 00ABB68D
GetCurrentProcess.KERNEL32 ref: 00ABB6CA
GetCurrentThreadId.KERNEL32 ref: 00ABB723

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5a73962d180c89c40930f7aee7720ae95bfaa24c7bb48ee6ebb37ca9b651e5ff
Instruction ID: 7245a6c76211fbd0d918f9a6f0ec23412b312bf78452eb69b1f150a88b67a52a
Opcode Fuzzy Hash: 5a73962d180c89c40930f7aee7720ae95bfaa24c7bb48ee6ebb37ca9b651e5ff
Instruction Fuzzy Hash: 1D5165B0D002498FDB14CFA9D588BEEBBF4FF49304F24846AE449A7391D7B45844CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB5F0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00ABB650
GetCurrentThread.KERNEL32 ref: 00ABB68D
GetCurrentProcess.KERNEL32 ref: 00ABB6CA
GetCurrentThreadId.KERNEL32 ref: 00ABB723

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3edd66c74c222811014e1d59fe6ba10bdf6a4d13b20aca27dc8c0a4080991b37
Instruction ID: 8b958895778222236b34c9edbf677ec98bbb96d8e6283f05ee6d7466423f9545
Opcode Fuzzy Hash: 3edd66c74c222811014e1d59fe6ba10bdf6a4d13b20aca27dc8c0a4080991b37
Instruction Fuzzy Hash: BF5153B0D002488FDB14CFAAD588BEEBBF4FF48304F248459E459A7390D7B4A844CB69

Uniqueness

Uniqueness Score: -1.00%

Function 04C13E30 Relevance: 1.9, APIs: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.600650098.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4c10000_5JbQqP8SDG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ed7b92ef4b46f90e6d2218326f35326e5f75550d067a289db1f48d02a8a6c2
Instruction ID: c16633c4f08f7fd54b560560777a0335c9d9ba8f1ad57767c7909eafd1d36cbf
Opcode Fuzzy Hash: a9ed7b92ef4b46f90e6d2218326f35326e5f75550d067a289db1f48d02a8a6c2
Instruction Fuzzy Hash: 8ED18C347002148FDB18EBB5C4549EEB3F6EF89314B2448A9D406EB7A1DB35ED42DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB92F0 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AB9536

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7e831fb4534bd55f825f7cfe51d4d212b49bcbd022f79b5cde8bb01e5e286cef
Instruction ID: 392fd762a6c12c5ea4aaaca11a1223c96af053515552a801e8d45cd84a595c86
Opcode Fuzzy Hash: 7e831fb4534bd55f825f7cfe51d4d212b49bcbd022f79b5cde8bb01e5e286cef
Instruction Fuzzy Hash: B8711570A00B058FD724DF6AD0457ABBBF9BF88304F00892ED58A9BA51D735E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFB0C Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00ABFC2A

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a685e2aa8c5ad259c0302aa324645b08315cd7dfee3cefa6070f4721469fa5d8
Instruction ID: d1234153a4c2fa55be88e19b7d156c1aa20e1deed163cacf04a40a5993fa6df2
Opcode Fuzzy Hash: a685e2aa8c5ad259c0302aa324645b08315cd7dfee3cefa6070f4721469fa5d8
Instruction Fuzzy Hash: 8B51E3B1D003489FDB14CFA9D884ADEBFB5FF89314F24852AE815AB251D7719885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFB18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00ABFC2A

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e360460aeae2e56b70cc53842dbebf99f2f48d31df957457b3308126216b7de3
Instruction ID: ddabf5559e942d89534a099e7cfbd0b9dfa17b594550653652db902e6f0a7820
Opcode Fuzzy Hash: e360460aeae2e56b70cc53842dbebf99f2f48d31df957457b3308126216b7de3
Instruction Fuzzy Hash: 0A41C1B1D003089FDB14CFA9C984ADEBFB5FF48314F24862AE819AB251D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB810 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ABB89F

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0c2c89cf7b0eea779542857dd772287e657f28efa1bc350ad28e8ca0020ccaae
Instruction ID: 86ba361d7cc779defeaf9943fae8287f5c9ff1ce8d19b04aed730cd57a5ca6b6
Opcode Fuzzy Hash: 0c2c89cf7b0eea779542857dd772287e657f28efa1bc350ad28e8ca0020ccaae
Instruction Fuzzy Hash: 1A21F2B5D00248DFDB10CFA9D884AEEBBF8FF48324F14841AE854A3211D375A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04C1FC50 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04C1FCDD

Memory Dump Source

Source File: 0000000B.00000002.600650098.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4c10000_5JbQqP8SDG.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 40e59b50b84c4e3e41744401d71b1f1b021374285b5b1017721dfc54fd68adfe
Instruction ID: 6a1a1cba9ea00b1af56ca8174f47c0b1b99ef3fc0c072f9936f8be940afcddbe
Opcode Fuzzy Hash: 40e59b50b84c4e3e41744401d71b1f1b021374285b5b1017721dfc54fd68adfe
Instruction Fuzzy Hash: D32114B59002499FCB10CFAAD884BDEBBF5FF49314F10842EE818A3250D778A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB818 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ABB89F

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d4c34c843aa81b6329eed550aa075841be0b039473586d20b865c79262b23472
Instruction ID: 8503439c1ee2cb7ca90149c473141a3959ed1a9ee7638834aba77ff4a5deb4bc
Opcode Fuzzy Hash: d4c34c843aa81b6329eed550aa075841be0b039473586d20b865c79262b23472
Instruction Fuzzy Hash: FC21C4B5900248DFDB10CFA9D984AEEBBF8FF48324F14841AE954A7350D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB8DC0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00AB95B1,00000800,00000000,00000000), ref: 00AB97C2

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a18312522f5a9da83e86b62584671e4a10a52f04f64f9f6b7d6dfa919bc5e0ae
Instruction ID: f79303ddb43bde9094fc99fbbbacdcefe361fd3fb02c5a7716306c43618be0fb
Opcode Fuzzy Hash: a18312522f5a9da83e86b62584671e4a10a52f04f64f9f6b7d6dfa919bc5e0ae
Instruction Fuzzy Hash: 3A1114B69002488FCB10CF9AC484AEFFBF8EF88314F14842AD519A7600C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9750 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00AB95B1,00000800,00000000,00000000), ref: 00AB97C2

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af7221bfb5dc5e89936d6c8f11b477e868942f1209f3dfe69b9d6e3aeacc8a0f
Instruction ID: 80e8be317cfb2095cb33177d8c266524b5ad15a80819b955a29a49b17e6f437e
Opcode Fuzzy Hash: af7221bfb5dc5e89936d6c8f11b477e868942f1209f3dfe69b9d6e3aeacc8a0f
Instruction Fuzzy Hash: 992103B68003499FCB14CF9AC884ADEFBF8FF89324F14842AD559A7640C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C1A8DC Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,04C1B1A9,?,?), ref: 04C1B350

Memory Dump Source

Source File: 0000000B.00000002.600650098.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4c10000_5JbQqP8SDG.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: eb60d97fd929e143fe2ccb67e3cbbdbf395ef398d9d9d7757bf6954fa8ed81f1
Instruction ID: 69eb01450d6d59b5654c309aca3e9cd23c26422da1ff2916b960bb12e052839d
Opcode Fuzzy Hash: eb60d97fd929e143fe2ccb67e3cbbdbf395ef398d9d9d7757bf6954fa8ed81f1
Instruction Fuzzy Hash: 771116B58006098FCB10CF99C484BEEBBF4EF49324F148429D559A7640D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AB94D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AB9536

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 87fc6e8b0e9c4f1728a42a37550bee69f6f05066d06a9e5d83c8c683d7a895a8
Instruction ID: 425ad9ebb789c3ac3f90811e35557e1b6ddb5d1fe773af62ecaecbea5ae37d27
Opcode Fuzzy Hash: 87fc6e8b0e9c4f1728a42a37550bee69f6f05066d06a9e5d83c8c683d7a895a8
Instruction Fuzzy Hash: 6411D2B6C006498FCB24CF9AD444ADEFBF8EF89324F14851AD519A7600D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFD59 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 00ABFDBD

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2e4556b7a67f8d2118650648f9bba7ee73b3aa844137e812773990456326f4fd
Instruction ID: aed78cd37a12bb679db9b1e49d2289473b2cf05869d9dd8597f221f90db8248a
Opcode Fuzzy Hash: 2e4556b7a67f8d2118650648f9bba7ee73b3aa844137e812773990456326f4fd
Instruction Fuzzy Hash: 121103B58002488FDB10CF99D484BEFBBF8FB49324F24855AD859A7740C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFD60 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 00ABFDBD

Memory Dump Source

Source File: 0000000B.00000002.583510425.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ab0000_5JbQqP8SDG.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4713789be536edec7c76f751341889ab94638cd0165130f2264270e0da40ce11
Instruction ID: 9fc926555528ccfa402ff86721f070e4632ca9874e67262f07a6c85ef04da8df
Opcode Fuzzy Hash: 4713789be536edec7c76f751341889ab94638cd0165130f2264270e0da40ce11
Instruction Fuzzy Hash: F81112B58002088FDB10CF9AD884BEEBBF8FB48324F14841AD819A7740C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C1FE08 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04C1FE67

Memory Dump Source

Source File: 0000000B.00000002.600650098.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4c10000_5JbQqP8SDG.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 58cee7f52714f60c26761a5accb0917f44d062be2ebf587213e7d1dc6dfd563d
Instruction ID: 7178045a9d6f6ecfed17d21628b68f2731d410c52453df6eb1188698bbc548b6
Opcode Fuzzy Hash: 58cee7f52714f60c26761a5accb0917f44d062be2ebf587213e7d1dc6dfd563d
Instruction Fuzzy Hash: 6C1112B58002488FCB20CFAAD484BDEBBF8EF49324F14841AD419A7240C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dhcpmon.exePID: 6388, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	112
Total number of Limit Nodes:	7

Executed Functions

Function 02F7B5E0 Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F7B650
GetCurrentThread.KERNEL32 ref: 02F7B68D
GetCurrentProcess.KERNEL32 ref: 02F7B6CA
GetCurrentThreadId.KERNEL32 ref: 02F7B723

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 854fcc7b3a173bdd13e6c470d1af6907ba8f402b0f9b39358f36285759975271
Instruction ID: 126d1b3420a40bceac90eda8c091e4b00bc943d499b72b2e07a8ef93ff9bbae9
Opcode Fuzzy Hash: 854fcc7b3a173bdd13e6c470d1af6907ba8f402b0f9b39358f36285759975271
Instruction Fuzzy Hash: 3F5157B09053488FDB14CFA9D948BEEBBF5BF49308F2484AAE159A7290D7346844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F7B5F0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F7B650
GetCurrentThread.KERNEL32 ref: 02F7B68D
GetCurrentProcess.KERNEL32 ref: 02F7B6CA
GetCurrentThreadId.KERNEL32 ref: 02F7B723

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4a8fb990ed179a44cf7a250d79152c1cabe8a8b48f57c2d08a17d01ec49bb752
Instruction ID: 0b9e79082212127456fb2ad833d68f9f1fa9ee6d6bc3ab3b5abbea8e27be6bde
Opcode Fuzzy Hash: 4a8fb990ed179a44cf7a250d79152c1cabe8a8b48f57c2d08a17d01ec49bb752
Instruction Fuzzy Hash: 5D5154B09002488FDB14CFAAD948BEEBBF5BF49308F24846AE059A7350D7346884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F792F0 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F79536

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a9117f01e7a9f2d698fa52b3b631cee7473a8c9734843ffce4438d9a6db1482b
Instruction ID: b51fea88bc64323a47ede936057384907ac1f1da6453aabaa77533369a897f63
Opcode Fuzzy Hash: a9117f01e7a9f2d698fa52b3b631cee7473a8c9734843ffce4438d9a6db1482b
Instruction Fuzzy Hash: 83714270A00B048FDB64CF6AD5447AAB7F6BF88344F00892ED58ADBA40D775E805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07E8F9D0 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 07E8FB23

Memory Dump Source

Source File: 0000000E.00000002.607916214.0000000007E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e80000_dhcpmon.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6b92aaf17c738bde9fe87706cda0bd0baeefe2901dc12fc66539e3741628a75e
Instruction ID: ae283a5f07c0c1afd510eac928cfa6f4f28f8009450355200e86deae9412f5a1
Opcode Fuzzy Hash: 6b92aaf17c738bde9fe87706cda0bd0baeefe2901dc12fc66539e3741628a75e
Instruction Fuzzy Hash: C15106B1901329DFDB64DF95C880BDDBBB5BF49314F1484AAE40CA7250DB359A88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F7FB0C Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02F7FC2A

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9095794a3cdb876e24d70dcb26d7a82cd08beca0053b1d7c41e894634b46e62f
Instruction ID: 1e977bdb024577576ec33f424535e27e1dfe41d0e8bad6bad6663ba3a7fa5d2f
Opcode Fuzzy Hash: 9095794a3cdb876e24d70dcb26d7a82cd08beca0053b1d7c41e894634b46e62f
Instruction Fuzzy Hash: AD51D0B1D00309DFDF14CFA9C984ADEBBB5BF48354F24862AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F7FB18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02F7FC2A

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4dad445f5fdbb58ab573d79c1cc34b9b43bc58293fcdc8d31bf07752044cccae
Instruction ID: 9b1182941af4374f530130d6ef64f781f1c959cd09e28dcd17e55e9ab2462dfb
Opcode Fuzzy Hash: 4dad445f5fdbb58ab573d79c1cc34b9b43bc58293fcdc8d31bf07752044cccae
Instruction Fuzzy Hash: A441C0B1D00309DFDF14CFA9C984ADEBBB5BF48354F24862AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F7B810 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F7B89F

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 92abc7c68e3166e435c1c1933c960d024ee95cd6043f68fad5cfbd96f893ee27
Instruction ID: 0d57973a99433562869cdbe03add87ca27235014cfa9ed7876619583f81560cb
Opcode Fuzzy Hash: 92abc7c68e3166e435c1c1933c960d024ee95cd6043f68fad5cfbd96f893ee27
Instruction Fuzzy Hash: 5221D2B59012089FDB10CFA9D984AEEBBF8FB49324F14842AE954A3210D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F7B818 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F7B89F

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c0bb564416a0bc5530ee341596b5d92401d8833deb3a1bcf6ddc22fed292bcfc
Instruction ID: 77bd5e05acf47fb1d9df5881ec874bb68ed9a7ed5680cf7f47c85f759c3e92c1
Opcode Fuzzy Hash: c0bb564416a0bc5530ee341596b5d92401d8833deb3a1bcf6ddc22fed292bcfc
Instruction Fuzzy Hash: 2D21C4B5D012089FDB10CFA9D984AEEBBF9FB49324F14841AE954A3350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E8FE00 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07E8FE7F

Memory Dump Source

Source File: 0000000E.00000002.607916214.0000000007E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e80000_dhcpmon.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 85a589e58ab2639befdddb3d11b3af8078162177967102358509cff49a4a1375
Instruction ID: 39507765e86b714231edf079d87023599cff090459c8c3b84726eed603fad8aa
Opcode Fuzzy Hash: 85a589e58ab2639befdddb3d11b3af8078162177967102358509cff49a4a1375
Instruction Fuzzy Hash: C421E7B59013599FCB10DF9AD884BDEBBF4FF48324F14842AE958A7250D374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E8FD40 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07E8FDB7

Memory Dump Source

Source File: 0000000E.00000002.607916214.0000000007E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e80000_dhcpmon.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 42ca6dd203c26ad32c1793f90d42585329eec653a50248f3a9ce38f88004e89a
Instruction ID: 6a320ef86420f94fd634ca57222a7a876ed1570c0577c431f9d40c73c5f4243f
Opcode Fuzzy Hash: 42ca6dd203c26ad32c1793f90d42585329eec653a50248f3a9ce38f88004e89a
Instruction Fuzzy Hash: 4D211AB1D006199FCB10DF9AD845BEEFBF8BF49224F54812AD418B3340D778A9458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E88A58 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07E88AD3

Memory Dump Source

Source File: 0000000E.00000002.607916214.0000000007E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e80000_dhcpmon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 12c5962d8dbfceb17c75220d60102b9a399d8f8544dee1671a313c54e54fafe3
Instruction ID: bdfd57877b97ea7bf167c9f9d1c40ee8b4ea6a60f17024f3a8ecd6101c54da09
Opcode Fuzzy Hash: 12c5962d8dbfceb17c75220d60102b9a399d8f8544dee1671a313c54e54fafe3
Instruction Fuzzy Hash: 432108B59002099FCB10CF99D985BDEBBF4FF48324F148429E858B7250D3789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F79750 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F795B1,00000800,00000000,00000000), ref: 02F797C2

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 617d13b284d45b99b4f5ac47e33ba15553c3d6bf58587904de8668e691d40cfc
Instruction ID: bb80a26e98f521517e7c57480cc6b1084445e914d464c0b7cea11eb2e8802106
Opcode Fuzzy Hash: 617d13b284d45b99b4f5ac47e33ba15553c3d6bf58587904de8668e691d40cfc
Instruction Fuzzy Hash: 492117B6D002089FCB10CF9AC844ADEFBF9FF49364F15842AE959A7640C3B5A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E88A60 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07E88AD3

Memory Dump Source

Source File: 0000000E.00000002.607916214.0000000007E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e80000_dhcpmon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4aa5dd483be9dbab56979b729c4d0e6a1bfd88e51c18da93db9af7a415137e7f
Instruction ID: 3cbf8ae4ab97b518a4d564de4fbffefb62bc76c1f282e65de1b31db71bb851fe
Opcode Fuzzy Hash: 4aa5dd483be9dbab56979b729c4d0e6a1bfd88e51c18da93db9af7a415137e7f
Instruction Fuzzy Hash: 2021F9B59006099FCB10DF9AD484BDEFBF8FF48324F548429E858A7240D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F78DC0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F795B1,00000800,00000000,00000000), ref: 02F797C2

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cd4767b888cb2827c8b8a32f3a9ff784de6a88c8bd741cbce50c9b872ab63a84
Instruction ID: ae5d51dee8bdbe20715be1e1606e4cf7bb4108f0d782f83050fc98feb2ef4793
Opcode Fuzzy Hash: cd4767b888cb2827c8b8a32f3a9ff784de6a88c8bd741cbce50c9b872ab63a84
Instruction Fuzzy Hash: 461114B6D002088FCB10CF9AC444AEEFBF9EB49364F14882AE555A7700C3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E8FED0 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07E8FF3B

Memory Dump Source

Source File: 0000000E.00000002.607916214.0000000007E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7e80000_dhcpmon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 876b71416d28be058419d68603ea95ce72a9bbd239de8bf5e0eec799003e37f0
Instruction ID: bd296b31cfd4da8dd65648bc820faf3da4e65109379c8d4e02ecfb8940924031
Opcode Fuzzy Hash: 876b71416d28be058419d68603ea95ce72a9bbd239de8bf5e0eec799003e37f0
Instruction Fuzzy Hash: FB1122B6800249DFCB10DF9AD884BDEBBF8FF49324F148419E528A7210C335A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F794D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F79536

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 34475b45ee0f085ff7f43ee7a736d8eef0c522f2d56a453916c73dee44067a5c
Instruction ID: 397e156f2330659b39e67906152479fb3cc33e3bdc696e2fe197d729d6b23014
Opcode Fuzzy Hash: 34475b45ee0f085ff7f43ee7a736d8eef0c522f2d56a453916c73dee44067a5c
Instruction Fuzzy Hash: 141110B6C002098FCB10CF9AD444BDEFBF8AF89224F14842AD929B7300C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F7FD59 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02F7FDBD

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: c30ebea7e2bf6d5f5502e7d7eca632b5789a13a1df145fb2fce68b406f28b6d7
Instruction ID: ab2049c525c4d665995843292cc44b7f6c3b67f3e5a51116bf5cae1895b8abe6
Opcode Fuzzy Hash: c30ebea7e2bf6d5f5502e7d7eca632b5789a13a1df145fb2fce68b406f28b6d7
Instruction Fuzzy Hash: 8B1103B59003099FDB10DF99D484BEEBBF8FB48324F14851AE955A3700D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F7FD60 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02F7FDBD

Memory Dump Source

Source File: 0000000E.00000002.587311587.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f70000_dhcpmon.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 758f892776216ad637291acc72ce0f5b5edaa175c9c1eb1f19fe28a2912e7c22
Instruction ID: 98438baeea27a65ecb83f91ab4f3d0cee33309488db25013332411d812535666
Opcode Fuzzy Hash: 758f892776216ad637291acc72ce0f5b5edaa175c9c1eb1f19fe28a2912e7c22
Instruction Fuzzy Hash: 5411E2B59002099FDB10DF9AD588BEFBBF8FB48324F14851AE959A7740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AF06E8 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8535cb9f393fbd80d548e5df6799f17c2cf29a043ace8306a7c04af6315e59d
Instruction ID: f3d33bbce7f6a4db4421d86fa62acdd3dd6295ad2baf24b3cefb63096628c19e
Opcode Fuzzy Hash: f8535cb9f393fbd80d548e5df6799f17c2cf29a043ace8306a7c04af6315e59d
Instruction Fuzzy Hash: 6BB17FB4B012049FDB14DBA4D594AAEBBF6EF89310F1540A9F615AB3A2CB71DD00CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07AF05B9 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b347d8a8dd6676660c5dd0332955329df4bd656475e383db46455a6f16e52d
Instruction ID: 524e5b39541b44b99f8018d34ed89b7ab55ee84ac56939e60c7a52525b8f36df
Opcode Fuzzy Hash: 24b347d8a8dd6676660c5dd0332955329df4bd656475e383db46455a6f16e52d
Instruction Fuzzy Hash: 1E31CDB0B007018FCB59EB75C96066E77A2AFC9204B04847DE6598F392DF35DC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 07AF05C8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2a39a81a50485642fc8351c79e8df60f23b654237072ec91595ba7726b6ad6
Instruction ID: cb1afb863c757be5429eb3b515d6c41d4d17942f390fc93edb0d0d38b249eda2
Opcode Fuzzy Hash: ab2a39a81a50485642fc8351c79e8df60f23b654237072ec91595ba7726b6ad6
Instruction Fuzzy Hash: 2A31CEB0B007018BCB58EB79C85062E77A2AFC9704B04847CEA598F392DF75DC01CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586387573.0000000002E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6665fa0008775f667184b092a3e2f7b4b8c4aa26f9ca017d08a8bb0d327635e4
Instruction ID: 8c2f07b1e0a8d4cae06df7a3a685ae56ce5440ee1f5680f79d008e6719d8875b
Opcode Fuzzy Hash: 6665fa0008775f667184b092a3e2f7b4b8c4aa26f9ca017d08a8bb0d327635e4
Instruction Fuzzy Hash: 952137B1544244DFDF09EF50DDC0FA6BBA9FB88328F24C56AE8050B246C336E856C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586626472.0000000002EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ead000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a4065517f654254ef6ed0cf6dca6e86df8ab43968060f3a65ca391455b1fcb
Instruction ID: abef1712737aa4ab746a3cf92c19a6b3ce8dd9b728a99508e2f2a94b18a32769
Opcode Fuzzy Hash: 75a4065517f654254ef6ed0cf6dca6e86df8ab43968060f3a65ca391455b1fcb
Instruction Fuzzy Hash: 79212571544240DFDB14CF20DCD5B66BBA6FB88318F24C96DD84A4F646C337E806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586626472.0000000002EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ead000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5f0bdc22adf01ee8ed875b917e3b185040231b7e136a8f88184f2bd9060b6f
Instruction ID: 07e049cbe75c185a19ebac510506b9b92289d325332e8cd59b5c80259591d588
Opcode Fuzzy Hash: bf5f0bdc22adf01ee8ed875b917e3b185040231b7e136a8f88184f2bd9060b6f
Instruction Fuzzy Hash: 37212571544204DFDB04CF60D9D4B66BBA5FB88318F24C9ADE8094F641C336E806CA71

Uniqueness

Uniqueness Score: -1.00%

Function 07AF0C9B Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebd1495e39d9deeebd18b92416ce98a179db636dd971aa67070e704715b14f8
Instruction ID: 1419b4fce742cff4d0fe8ca8e32ce1894660edba610b40b1d3de6e0a1b5771ff
Opcode Fuzzy Hash: eebd1495e39d9deeebd18b92416ce98a179db636dd971aa67070e704715b14f8
Instruction Fuzzy Hash: 2421DBB66093898FDB01DFA1C94096A7FF6EF46304B0594ABE128CB163C735D809CF22

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586626472.0000000002EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ead000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a7aa0b2a2c1ca60089ff9313197d842a438e231d50dea36c14de370b291b00
Instruction ID: e5e3fa4f5ad8f8771697eb8360a457a339b23378b62e306869b48ff07b83fab4
Opcode Fuzzy Hash: 95a7aa0b2a2c1ca60089ff9313197d842a438e231d50dea36c14de370b291b00
Instruction Fuzzy Hash: 862153755493C08FCB12CF24D9E4715BF71EB46214F28C5DAD8498F697C33A944ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586387573.0000000002E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction ID: b535c6f8b3b5d789dc65abe0bb4fac4726cc0aab18dedb027934faca378bd360
Opcode Fuzzy Hash: 89cab565afb9096415ec76201e3a3567f3b82aa6e5430c9b10a616fa3bee2fd6
Instruction Fuzzy Hash: AF110876444280CFCF15DF10D9C4B16BF71FB85328F28C6AAD8454B656C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07AF0348 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb3af1e0cdb40807c2029ba6bd2bb3543cee2dc9a47cd2e9381c938786151f7
Instruction ID: 4ac777ddbaa639e4c4ea6701072b447eb6fe250b7aacf0272025d3c8aca864ea
Opcode Fuzzy Hash: bcb3af1e0cdb40807c2029ba6bd2bb3543cee2dc9a47cd2e9381c938786151f7
Instruction Fuzzy Hash: 1F01A1B0714614DBC3388FAAE544637BBFAEBC5710B08881DF166C7706CB32E8468791

Uniqueness

Uniqueness Score: -1.00%

Function 02EAD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586626472.0000000002EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2ead000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc4167c3c97515e31d18ccee52d8336f50c7ccc6e38931adc408a7337d2e844
Instruction ID: 55fb3d3591130898e01119c2f0b108c58ab7d17604f95bdb4b79152fe3276508
Opcode Fuzzy Hash: bbc4167c3c97515e31d18ccee52d8336f50c7ccc6e38931adc408a7337d2e844
Instruction Fuzzy Hash: 53118E75544280DFCB11CF50D9D4B15BB61FB84328F28C6A9D8494F656C33AE45ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 07AF0D69 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee7b1fd9c7bf7459cb92189cee9a4127e210233034c6e26bbf3e8ff698d0bd3
Instruction ID: 268a7db72630d1f6e6ad663c526081f9a6dc9d6f1c1e99b314ed383e77f433dc
Opcode Fuzzy Hash: fee7b1fd9c7bf7459cb92189cee9a4127e210233034c6e26bbf3e8ff698d0bd3
Instruction Fuzzy Hash: FF11A1B6945345DFCB06DFA0C94069EBFB5AF45300F1080A7D124CB163C7349908CF52

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586387573.0000000002E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697f0a74c35038f98653d5730fc32371092ba145f95f07602bd596915521415a
Instruction ID: 5006df5961cb3ae3c7bcbf64bcd82d7cbff3eb783029c368dc2fff895442001a
Opcode Fuzzy Hash: 697f0a74c35038f98653d5730fc32371092ba145f95f07602bd596915521415a
Instruction Fuzzy Hash: E701F775048350AAEB106A61CC84BE6BB9CEF41278F08D95BED151B242D37A9444CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 02E9D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.586387573.0000000002E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2e9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40ed2feef35e3576d8504f88e548a414dd44d62fd04cce9d45277a80c885dd0
Instruction ID: aadd8a8fd845a4ce1ec0931bd72f6fa7e0bcf0fd3505fcf06ea9a4f639766057
Opcode Fuzzy Hash: c40ed2feef35e3576d8504f88e548a414dd44d62fd04cce9d45277a80c885dd0
Instruction Fuzzy Hash: C7F0C272405244AEEB109E55CC88BA2FF9CEB41238F18C45BED081B286C37AA844CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 07AF1531 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028da8fcf9f973719d2d62893c0d9674b619507b7e617cf8c55296a91f99bc72
Instruction ID: 6176cbfd5fa32ae612a74eed8bac217f6f8b4bf858856fc8068ed392f3c8af6b
Opcode Fuzzy Hash: 028da8fcf9f973719d2d62893c0d9674b619507b7e617cf8c55296a91f99bc72
Instruction Fuzzy Hash: 4F01E4B0E4125A9FDB10DFAAC455ABEBFF1EB48211F14846AD52AE2241D7345141CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07AF0C39 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f4b3b244567c5893f368e5feb2398a4a382f1eec2f798032eb67f7c6617f27
Instruction ID: edf9a03099ad40fab50e83a6cc9d52cc50410b89cb82ead61a0094188de46c9c
Opcode Fuzzy Hash: 71f4b3b244567c5893f368e5feb2398a4a382f1eec2f798032eb67f7c6617f27
Instruction Fuzzy Hash: 16F0A0F1E402169EEB50DFAAD5047ABBFF5EF48300F10883AE119E7241DBB085458FA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AF1540 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea1bd5f5f8cc2eeb3fb786a54b0aceb9c0b9d70bf49b088f4c35738de2417a9
Instruction ID: 63dc073c11215560f112556df6bd62d93e01c000335da5e3f706ae23d79a050f
Opcode Fuzzy Hash: 4ea1bd5f5f8cc2eeb3fb786a54b0aceb9c0b9d70bf49b088f4c35738de2417a9
Instruction Fuzzy Hash: 6FF0F4B0E0421EDFCB44DFAAC5556BEBFF0AB08200F14846AE526E2241D7345240CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AF15A8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9168cbbd952d44d591d5b6866b66472aa119a850cb949b075845c6bd335d61
Instruction ID: 9403c21161ebf92d7f5f03354e686082deb963458d80af41eb995b71a94ba271
Opcode Fuzzy Hash: 0d9168cbbd952d44d591d5b6866b66472aa119a850cb949b075845c6bd335d61
Instruction Fuzzy Hash: 4DF0A0E0C8E3DADFC7025BD5D8281BA7FB0EF0A251F4940CAE1A2CA192C7784105CB62

Uniqueness

Uniqueness Score: -1.00%

Function 07AF0C48 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144dbd20386024f6fb8704dcfd141efbc094de884d68b13d6d7d7610166c0377
Instruction ID: 15ec7bffce719e68386b1db98dd0d07df2d53068328bfa9514f927dea7f27e9b
Opcode Fuzzy Hash: 144dbd20386024f6fb8704dcfd141efbc094de884d68b13d6d7d7610166c0377
Instruction Fuzzy Hash: E2E039F0D0021AAFD750EFAA890466BBEF8AF48250F104829E119E7201EBB085418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 07AF0DC0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.607101467.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7af0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017d568a9d08374ffc5aa55abe65a4a0086c290215c552750effe04f38144b97
Instruction ID: 04ad777adc06a745e1c0fdb919d411c63bd34fa754fd8478132b0ce6e3f8ce21
Opcode Fuzzy Hash: 017d568a9d08374ffc5aa55abe65a4a0086c290215c552750effe04f38144b97
Instruction Fuzzy Hash: 64D0ECB4C40309EFD750EFB9890139FBAF4BB04200F108966D124E6202EB7452008B91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5JbQqP8SDG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5JbQqP8SDG.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

C:\Users\user\AppData\Local\Temp\tmp3E23.tmp

C:\Users\user\AppData\Local\Temp\tmp5777.tmp

C:\Users\user\AppData\Local\Temp\tmpBD8.tmp

C:\Users\user\AppData\Local\Temp\tmpBE25.tmp

C:\Users\user\AppData\Local\Temp\tmpFEC7.tmp

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

C:\Users\user\AppData\Roaming\GryVAO.exe

Windows Analysis Report
5JbQqP8SDG.exe

Function 00F2B5F0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00F292F0 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Function 00F2FB18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00F2B818 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00F28DC0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00F294D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON