Edit tour

Windows Analysis Report
mfpmp.exe

Overview

General Information

Sample Name:	mfpmp.exe
Analysis ID:	880358
MD5:	475b4814a0b6114c76ea55c7447b6108
SHA1:	d9cb6110591e7fb53a29ee7c8efd2c7132b3a426
SHA256:	10feb93ebdb8dd942d6b7a878d1ee3920584e89cdead6e34ae8292bfb1916116
Tags:	exeNanoCore
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected Nanocore RAT

Snort IDS alert for network traffic

Machine Learning detection for sample

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Classification

Process Tree

System is w10x64

mfpmp.exe (PID: 6504 cmdline: C:\Users\user\Desktop\mfpmp.exe MD5: 475B4814A0B6114C76EA55C7447B6108)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nanocore RAT, NanoCore	Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.	APT33 The Gorgon Group	https://assets.virustotal.com/reports/2021trends.pdf https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.morphisec.com/syk-crypter-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8507-1300-000c0a4c", "Group": "Default", "Domain1": "dinowar.anondns.net", "Domain2": "dinowar.dynv6.net", "Port": 21942, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 4997, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "1a000100", "MaxPacketSize": "0000a000", "GCThreshold": "f4ff9f00", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mfpmp.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
mfpmp.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
mfpmp.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
mfpmp.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
mfpmp.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
mfpmp.exe	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xff8d:$a1: NanoCore.ClientPluginHost 0xff4d:$a2: NanoCore.ClientPlugin 0x11ea6:$b1: get_BuilderSettings 0xfda9:$b2: ClientLoaderForm.resources 0x115c6:$b3: PluginCommand 0xff7e:$b4: IClientAppHost 0x1a3fe:$b5: GetBlockHash 0x124fe:$b6: AddHostEntry 0x161f1:$b7: LogClientException 0x1246b:$b8: PipeExists 0xffb7:$b9: IClientLoggingHost
00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x11591:$a1: NanoCore.ClientPluginHost 0x16bde:$a1: NanoCore.ClientPluginHost 0x11554:$a2: NanoCore.ClientPlugin 0x16c28:$a2: NanoCore.ClientPlugin 0x11928:$b1: get_BuilderSettings 0x115df:$b4: IClientAppHost 0x11999:$b6: AddHostEntry 0x11a08:$b7: LogClientException 0x1197d:$b8: PipeExists 0x115cc:$b9: IClientLoggingHost 0x16bf8:$b9: IClientLoggingHost
00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1646:$x1: NanoCore.ClientPluginHost
00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x16a6:$i3: IClientNetwork 0x1660:$i6: IClientLoggingHost 0x13df:$s1: ClientPlugin 0x1699:$s1: ClientPlugin
00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1646:$a1: NanoCore.ClientPluginHost 0x1690:$a2: NanoCore.ClientPlugin 0x1660:$b9: IClientLoggingHost
00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x667e:$a1: NanoCore.ClientPluginHost 0x1f14d:$a1: NanoCore.ClientPluginHost 0x6649:$a2: NanoCore.ClientPlugin 0x1f118:$a2: NanoCore.ClientPlugin 0xb5c4:$b1: get_BuilderSettings 0x24093:$b1: get_BuilderSettings 0xb533:$b7: LogClientException 0x24002:$b7: LogClientException 0x6698:$b9: IClientLoggingHost 0x1f167:$b9: IClientLoggingHost
Process Memory Space: mfpmp.exe PID: 6504	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1ca24:$x1: NanoCore.ClientPluginHost 0x42e81:$x1: NanoCore.ClientPluginHost 0x74610:$x1: NanoCore.ClientPluginHost 0xad540:$x1: NanoCore.ClientPluginHost 0xcddc7:$x1: NanoCore.ClientPluginHost 0xf05d3:$x1: NanoCore.ClientPluginHost 0x1ca3e:$x2: IClientNetworkHost 0x42ebe:$x2: IClientNetworkHost 0x7462a:$x2: IClientNetworkHost 0xcddf4:$x2: IClientNetworkHost 0xf0600:$x2: IClientNetworkHost 0x469af:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x51a35:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: mfpmp.exe PID: 6504	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: mfpmp.exe PID: 6504	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1c98e:$a: NanoCore 0x1c9e7:$a: NanoCore 0x1ca24:$a: NanoCore 0x1ca9d:$a: NanoCore 0x1d342:$a: NanoCore 0x1d395:$a: NanoCore 0x1d3ce:$a: NanoCore 0x1d441:$a: NanoCore 0x1e20e:$a: NanoCore 0x1e68a:$a: NanoCore 0x1e6d0:$a: NanoCore 0x1e897:$a: NanoCore 0x328c6:$a: NanoCore 0x32974:$a: NanoCore 0x42b4e:$a: NanoCore 0x42b5e:$a: NanoCore 0x42c1d:$a: NanoCore 0x42c2c:$a: NanoCore 0x42e2d:$a: NanoCore 0x42e41:$a: NanoCore 0x42e81:$a: NanoCore
Process Memory Space: mfpmp.exe PID: 6504	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1ca24:$a1: NanoCore.ClientPluginHost 0x42e81:$a1: NanoCore.ClientPluginHost 0x74610:$a1: NanoCore.ClientPluginHost 0xad540:$a1: NanoCore.ClientPluginHost 0xcddc7:$a1: NanoCore.ClientPluginHost 0xf05d3:$a1: NanoCore.ClientPluginHost 0x1c9e7:$a2: NanoCore.ClientPlugin 0x42e41:$a2: NanoCore.ClientPlugin 0x745d3:$a2: NanoCore.ClientPlugin 0xad58a:$a2: NanoCore.ClientPlugin 0xcdd92:$a2: NanoCore.ClientPlugin 0xf059e:$a2: NanoCore.ClientPlugin 0x1cd8a:$b1: get_BuilderSettings 0x44d58:$b1: get_BuilderSettings 0x7498a:$b1: get_BuilderSettings 0xd2b99:$b1: get_BuilderSettings 0xf54a7:$b1: get_BuilderSettings 0x42c02:$b2: ClientLoaderForm.resources 0x44478:$b3: PluginCommand 0x1ca72:$b4: IClientAppHost 0x42e72:$b4: IClientAppHost
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.mfpmp.exe.29a171c.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x40c2:$x1: NanoCore.ClientPluginHost
0.2.mfpmp.exe.29a171c.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0x40c2:$x2: NanoCore.ClientPluginHost 0x41a0:$s4: PipeCreated 0x40dc:$s5: IClientLoggingHost
0.2.mfpmp.exe.29a171c.1.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x410c:$x2: NanoCore.ClientPlugin 0x40c2:$x3: NanoCore.ClientPluginHost 0x4122:$i3: IClientNetwork 0x40dc:$i6: IClientLoggingHost 0x3e5b:$s1: ClientPlugin 0x4115:$s1: ClientPlugin
0.2.mfpmp.exe.29a171c.1.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x40c2:$a1: NanoCore.ClientPluginHost 0x410c:$a2: NanoCore.ClientPlugin 0x40dc:$b9: IClientLoggingHost
0.2.mfpmp.exe.3a019a0.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
0.2.mfpmp.exe.3a019a0.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
0.2.mfpmp.exe.3a019a0.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.mfpmp.exe.3a019a0.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
0.2.mfpmp.exe.3a019a0.3.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
0.2.mfpmp.exe.4cc0000.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
0.2.mfpmp.exe.4cc0000.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0.2.mfpmp.exe.4cc0000.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
0.2.mfpmp.exe.4cc0000.4.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
0.2.mfpmp.exe.51d0000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
0.2.mfpmp.exe.51d0000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
0.2.mfpmp.exe.51d0000.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.mfpmp.exe.51d0000.6.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
0.2.mfpmp.exe.51d0000.6.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
0.0.mfpmp.exe.2d0000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.mfpmp.exe.2d0000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.0.mfpmp.exe.2d0000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.mfpmp.exe.2d0000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
0.0.mfpmp.exe.2d0000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.0.mfpmp.exe.2d0000.0.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
0.2.mfpmp.exe.51d4629.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
0.2.mfpmp.exe.51d4629.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
0.2.mfpmp.exe.51d4629.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.mfpmp.exe.51d4629.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
0.2.mfpmp.exe.51d4629.5.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost
0.2.mfpmp.exe.51d0000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
0.2.mfpmp.exe.51d0000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
0.2.mfpmp.exe.51d0000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.mfpmp.exe.51d0000.6.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
0.2.mfpmp.exe.51d0000.6.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
0.2.mfpmp.exe.3a019a0.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
0.2.mfpmp.exe.3a019a0.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
0.2.mfpmp.exe.51f0000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1646:$x1: NanoCore.ClientPluginHost
0.2.mfpmp.exe.51f0000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
0.2.mfpmp.exe.3a019a0.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.mfpmp.exe.51f0000.7.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x16a6:$i3: IClientNetwork 0x1660:$i6: IClientLoggingHost 0x13df:$s1: ClientPlugin 0x1699:$s1: ClientPlugin
0.2.mfpmp.exe.51f0000.7.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1646:$a1: NanoCore.ClientPluginHost 0x1690:$a2: NanoCore.ClientPlugin 0x1660:$b9: IClientLoggingHost
0.2.mfpmp.exe.3a019a0.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
0.2.mfpmp.exe.3a019a0.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
0.2.mfpmp.exe.3a05fc9.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
0.2.mfpmp.exe.3a05fc9.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
0.2.mfpmp.exe.3a05fc9.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.mfpmp.exe.3a05fc9.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
0.2.mfpmp.exe.3a05fc9.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost
0.2.mfpmp.exe.29a171c.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0x64c2:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
0.2.mfpmp.exe.29a171c.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x64c2:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x65a0:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x64dc:$s5: IClientLoggingHost
0.2.mfpmp.exe.29a171c.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x650c:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x64c2:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0x6522:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x64dc:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x625b:$s1: ClientPlugin 0x6515:$s1: ClientPlugin
0.2.mfpmp.exe.29a171c.1.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0x64c2:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x650c:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost 0x64dc:$b9: IClientLoggingHost
0.2.mfpmp.exe.29a6598.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1646:$x1: NanoCore.ClientPluginHost
0.2.mfpmp.exe.29a6598.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
0.2.mfpmp.exe.29a6598.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x1690:$x2: NanoCore.ClientPlugin 0x1646:$x3: NanoCore.ClientPluginHost 0x16a6:$i3: IClientNetwork 0x1660:$i6: IClientLoggingHost 0x13df:$s1: ClientPlugin 0x1699:$s1: ClientPlugin
0.2.mfpmp.exe.29a6598.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1646:$a1: NanoCore.ClientPluginHost 0x1690:$a2: NanoCore.ClientPlugin 0x1660:$b9: IClientLoggingHost
Click to see the 51 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\mfpmp.exe, ProcessId: 6504, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\mfpmp.exe, ProcessId: 6504, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\mfpmp.exe, ProcessId: 6504, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\mfpmp.exe, ProcessId: 6504, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Snort Signatures

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049726219422816766 06/02/23-03:15:58.229871
SID:	2816766
Source Port:	49726
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049725219422816766 06/02/23-03:15:46.918356
SID:	2816766
Source Port:	49725
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049727219422816766 06/02/23-03:16:05.832874
SID:	2816766
Source Port:	49727
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049714219422816766 06/02/23-03:14:23.945597
SID:	2816766
Source Port:	49714
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049716219422816766 06/02/23-03:14:38.958735
SID:	2816766
Source Port:	49716
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049724219422816766 06/02/23-03:15:41.133556
SID:	2816766
Source Port:	49724
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049728219422816766 06/02/23-03:16:14.874731
SID:	2816766
Source Port:	49728
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049713219422816766 06/02/23-03:14:17.578597
SID:	2816766
Source Port:	49713
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049717219422816766 06/02/23-03:14:46.659916
SID:	2816766
Source Port:	49717
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049715219422816766 06/02/23-03:14:32.676847
SID:	2816766
Source Port:	49715
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049723219422025019 06/02/23-03:15:30.905805
SID:	2025019
Source Port:	49723
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049722219422816766 06/02/23-03:15:18.909197
SID:	2816766
Source Port:	49722
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049713219422025019 06/02/23-03:14:16.340330
SID:	2025019
Source Port:	49713
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049714219422025019 06/02/23-03:14:22.701480
SID:	2025019
Source Port:	49714
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049724219422025019 06/02/23-03:15:38.625540
SID:	2025019
Source Port:	49724
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049725219422025019 06/02/23-03:15:46.516736
SID:	2025019
Source Port:	49725
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049721219422816766 06/02/23-03:15:11.972977
SID:	2816766
Source Port:	49721
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049723219422816766 06/02/23-03:15:32.602475
SID:	2816766
Source Port:	49723
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049715219422025019 06/02/23-03:14:29.058470
SID:	2025019
Source Port:	49715
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049726219422025019 06/02/23-03:15:56.130210
SID:	2025019
Source Port:	49726
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049728219422025019 06/02/23-03:16:12.322829
SID:	2025019
Source Port:	49728
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049717219422025019 06/02/23-03:14:45.071339
SID:	2025019
Source Port:	49717
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049718219422025019 06/02/23-03:14:54.530247
SID:	2025019
Source Port:	49718
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 213.152.161.40 - Destination IP: 192.168.2.5

Timestamp:	213.152.161.40192.168.2.521942497252841753 06/02/23-03:15:53.656106
SID:	2841753
Source Port:	21942
Destination Port:	49725
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049716219422025019 06/02/23-03:14:38.559097
SID:	2025019
Source Port:	49716
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049727219422025019 06/02/23-03:16:05.006045
SID:	2025019
Source Port:	49727
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049719219422025019 06/02/23-03:15:01.548154
SID:	2025019
Source Port:	49719
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049722219422025019 06/02/23-03:15:17.333804
SID:	2025019
Source Port:	49722
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049721219422025019 06/02/23-03:15:10.736542
SID:	2025019
Source Port:	49721
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049718219422816766 06/02/23-03:14:55.770847
SID:	2816766
Source Port:	49718
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.2.5 - Destination IP: 213.152.161.40

Timestamp:	192.168.2.5213.152.161.4049719219422816766 06/02/23-03:15:03.125668
SID:	2816766
Source Port:	49719
Destination Port:	21942
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8507-1300-000c0a4c", "Group": "Default", "Domain1": "dinowar.anondns.net", "Domain2": "dinowar.dynv6.net", "Port": 21942, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 4997, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "1a000100", "MaxPacketSize": "0000a000", "GCThreshold": "f4ff9f00", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for submitted file

Source: mfpmp.exe	ReversingLabs: Detection: 97%
Source: mfpmp.exe	Virustotal: Detection: 87%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: mfpmp.exe

Avira: detected

Antivirus detection for URL or domain

Source: dinowar.anondns.net	Avira URL Cloud: Label: malware
Source: dinowar.dynv6.net	Avira URL Cloud: Label: malware

Yara detected Nanocore RAT

Source: Yara match	File source: mfpmp.exe, type: SAMPLE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR

Machine Learning detection for sample

Source: mfpmp.exe

Joe Sandbox ML: detected

Source: mfpmp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\mfpmp.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source:	Binary string: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb0 source: mfpmp.exe, 00000000.00000002.655964464.0000000000B92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Windows\assembly\GA.pdbmscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdb2.0.0.0__b77a5c561934e089\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb(X source: mfpmp.exe, 00000000.00000003.616013627.0000000000B6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdb# source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbmscorlibsymbols\dll\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: iC:\Windows\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbH source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\mfpmp.exe

Code function: 4x nop then mov esp, ebp

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49713 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49713 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49714 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49714 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49715 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49715 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49716 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49716 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49717 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49717 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49718 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49718 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49719 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49719 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49721 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49721 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49722 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49722 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49723 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49723 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49724 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49724 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49725 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49725 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 213.152.161.40:21942 -> 192.168.2.5:49725
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49726 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49726 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49727 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49727 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49728 -> 213.152.161.40:21942
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49728 -> 213.152.161.40:21942

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dinowar.anondns.net
Source: Malware configuration extractor	URLs: dinowar.dynv6.net

Source: Joe Sandbox View

ASN Name: GLOBALLAYERNL GLOBALLAYERNL

Source: global traffic

TCP traffic: 192.168.2.5:49713 -> 213.152.161.40:21942

Source: unknown

DNS traffic detected: queries for: dinowar.anondns.net

Source: C:\Users\user\Desktop\mfpmp.exe

Code function: 0_2_04B02D0A WSARecv,

Source: mfpmp.exe, 00000000.00000002.655964464.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: mfpmp.exe, 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: mfpmp.exe, type: SAMPLE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: mfpmp.exe, type: SAMPLE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: mfpmp.exe, type: SAMPLE	Matched rule: Detects NanoCore Author: ditekSHen
Source: mfpmp.exe, type: SAMPLE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: mfpmp.exe, type: SAMPLE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
Source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown

Source: mfpmp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: mfpmp.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: mfpmp.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: mfpmp.exe, type: SAMPLE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: mfpmp.exe, type: SAMPLE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: mfpmp.exe, type: SAMPLE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.29a171c.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.51f0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.29a171c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.mfpmp.exe.29a6598.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AA9248
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AA8648
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AA2FA8
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AA23A0
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AAAF18
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AA306F
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04AA930F

Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B01642 NtQuerySystemInformation,
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B01607 NtQuerySystemInformation,

Source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.655964464.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs mfpmp.exe
Source: mfpmp.exe, 00000000.00000002.667851771.0000000005210000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs mfpmp.exe

Source: mfpmp.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9965897817460317

Source: mfpmp.exe	ReversingLabs: Detection: 97%
Source: mfpmp.exe	Virustotal: Detection: 87%

Source: C:\Users\user\Desktop\mfpmp.exe

File read: C:\Users\user\Desktop\mfpmp.exe

Jump to behavior

Source: mfpmp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mfpmp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\mfpmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B01402 AdjustTokenPrivileges,
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B013CB AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\mfpmp.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@18/1

Source: mfpmp.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: mfpmp.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: mfpmp.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\mfpmp.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\mfpmp.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\mfpmp.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\Desktop\mfpmp.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{281c27a0-1581-470a-8274-eb0265aada3d}
Source: C:\Users\user\Desktop\mfpmp.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: mfpmp.exe, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: mfpmp.exe, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: mfpmp.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\mfpmp.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: C:\Users\user\Desktop\mfpmp.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: mfpmp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source:	Binary string: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb0 source: mfpmp.exe, 00000000.00000002.655964464.0000000000B92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Windows\assembly\GA.pdbmscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdb2.0.0.0__b77a5c561934e089\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb(X source: mfpmp.exe, 00000000.00000003.616013627.0000000000B6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdb# source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbmscorlibsymbols\dll\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: iC:\Windows\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: mfpmp.exe, 00000000.00000002.655440986.00000000008A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbH source: mfpmp.exe, 00000000.00000002.655693521.00000000009FC000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: mfpmp.exe, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: mfpmp.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_008D9D2C push eax; retf
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_008D9D30 pushad ; retf
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B0248C push B8C2C3FFh; ret
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B001F4 push B8C2C3FFh; ret

Source: mfpmp.exe, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: mfpmp.exe, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 0.0.mfpmp.exe.2d0000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\mfpmp.exe

File opened: C:\Users\user\Desktop\mfpmp.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mfpmp.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\mfpmp.exe TID: 6468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\mfpmp.exe TID: 5692	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\Desktop\mfpmp.exe TID: 6480	Thread sleep time: -640000s >= -30000s

Source: C:\Users\user\Desktop\mfpmp.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\mfpmp.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\mfpmp.exe

Window / User API: foregroundWindowGot 1034

Source: C:\Users\user\Desktop\mfpmp.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\mfpmp.exe

Code function: 0_2_04B0112A GetSystemInfo,

Source: C:\Users\user\Desktop\mfpmp.exe

Thread delayed: delay time: 922337203685477

Source: mfpmp.exe, 00000000.00000003.616013627.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000002.655964464.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mfpmp.exe, 00000000.00000003.605019535.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\mfpmp.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\mfpmp.exe

Memory allocated: page read and write | page guard

Source: mfpmp.exe, 00000000.00000002.655964464.0000000000B76000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000003.616013627.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managern has been aborted because of either a thread exit or an application request.
Source: mfpmp.exe, 00000000.00000003.616013627.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000003.604811258.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000003.605019535.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: mfpmp.exe, 00000000.00000002.657080001.0000000002C3F000.00000004.00000800.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000002.657080001.0000000002A5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerp
Source: mfpmp.exe, 00000000.00000002.657080001.0000000002C33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerL
Source: mfpmp.exe, 00000000.00000003.605019535.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerl
Source: mfpmp.exe, 00000000.00000003.408515369.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000003.604811258.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, mfpmp.exe, 00000000.00000003.394615412.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert$

Source: C:\Users\user\Desktop\mfpmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\mfpmp.exe

Code function: 0_2_008CAF9A GetUserNameW,

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: mfpmp.exe, type: SAMPLE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: mfpmp.exe, 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: mfpmp.exe, 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: mfpmp.exe, 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: mfpmp.exe, 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: mfpmp.exe, 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: mfpmp.exe, 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: mfpmp.exe, 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: mfpmp.exe, 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: mfpmp.exe	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Source: Yara match	File source: mfpmp.exe, type: SAMPLE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.mfpmp.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d4629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.51d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a019a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mfpmp.exe.3a05fc9.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mfpmp.exe PID: 6504, type: MEMORYSTR

Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B0284E bind,
Source: C:\Users\user\Desktop\mfpmp.exe	Code function: 0_2_04B027FC bind,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Masquerading	21 Input Capture	1 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Remote Access Software	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	1 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	11 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	3 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Software Packing	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mfpmp.exe	97%	ReversingLabs	ByteCode-MSIL.Backdoor.NanoCore
mfpmp.exe	88%	Virustotal		Browse
mfpmp.exe	100%	Avira	TR/Dropper.MSIL.Gen7
mfpmp.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
dinowar.anondns.net	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
dinowar.dynv6.net	2%	Virustotal		Browse
dinowar.anondns.net	3%	Virustotal		Browse
dinowar.anondns.net	100%	Avira URL Cloud	malware
dinowar.dynv6.net	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dinowar.anondns.net	213.152.161.40	true	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dinowar.anondns.net	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
dinowar.dynv6.net	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.152.161.40	dinowar.anondns.net	Netherlands		49453	GLOBALLAYERNL	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	880358
Start date and time:	2023-06-02 03:13:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	mfpmp.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@18/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:14:14	API Interceptor	914x Sleep call for process: mfpmp.exe modified

Process:	C:\Users\user\Desktop\mfpmp.exe
File Type:	data
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.997351629001838
Encrypted:	false
SSDEEP:	6:X4LDAnybgCFcps0Oa706d+6zsThvr9ohWCsT9ZIWyq4B:X4LEnybgCF07hNgtr9oE/3oB
MD5:	EDB5F15385E111D1F43093F56149A3FB
SHA1:	D865A47A0997848D5D4005B857A3FD0027BCD3C6
SHA-256:	1995E579108E8EB3B6C00893E855E8204D1C36F150088736556B66BE445E7957
SHA-512:	C3C0ADA45BECD863F41369F766E719A6FDC7807096F17FAEFBA6466EBEE4830524046DAFB186E1DFB50B15B07F0877ECD3B4E5993B83E8D67FF5A68D4F2ACCFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*.............S.Ty.K.&....q$.7....."....F... .N.k.C.X.D.^.....u.\...X........s^.;...m/.,7X..v"B..#.T.F L...h.....t 5.\|Z

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Users\user\Desktop\mfpmp.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:V66pt:1
MD5:	C8A6A661D6743E259E659C36B4C72D17
SHA1:	1526F977C40AB1700E731F506D7FFB2BC440ED9E
SHA-256:	AD606B5A81C70DDA9F84813BAAAF04DE4605FCA79877D9B9F2C69316605A5C29
SHA-512:	15598B836EF25A356884598B374A5CDF286812B4DFB13A5D266F16AC60B8F36FC9114823A390B72AF44ACA63AC1CD9CE29EDC40F8E827B749708AD0620A68043
Malicious:	true
Reputation:	low
Preview:	.a..Rc.H

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.476662499761944
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	mfpmp.exe
File size:	214528
MD5:	475b4814a0b6114c76ea55c7447b6108
SHA1:	d9cb6110591e7fb53a29ee7c8efd2c7132b3a426
SHA256:	10feb93ebdb8dd942d6b7a878d1ee3920584e89cdead6e34ae8292bfb1916116
SHA512:	cb822c8b67d1733a9d4779d1e35c737db6f4ad47d2ded10aacdcd7d85acf72e58eb71d2b8bbb90e9c271041efe87f5654ea661bd786d8376d6fc4b4717c82c9b
SSDEEP:	6144:ELV6Bta6dtJmakIM5zmMVrunW9jnHzmycg81x:ELV6Btpmk8msrunW9P+
TLSH:	B724CF167BA84A3FE2DE8AB9711211028379C2E398C3F3DE5CD495B74B267E50A071D7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.T.....................\|........... ........@.. .....................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41e792
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x54E927A1 [Sun Feb 22 00:49:37 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e738	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x17860	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x20000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1c798	0x1c800	False	0.5945124040570176	data	6.59808650483268	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x20000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x17860	0x17a00	False	0.9965897817460317	data	7.997328427019175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_RCDATA	0x22058	0x17808	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5213.152.161.4049726219422816766 06/02/23-03:15:58.229871	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49726	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049725219422816766 06/02/23-03:15:46.918356	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49725	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049727219422816766 06/02/23-03:16:05.832874	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49727	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049714219422816766 06/02/23-03:14:23.945597	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49714	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049716219422816766 06/02/23-03:14:38.958735	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49716	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049724219422816766 06/02/23-03:15:41.133556	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49724	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049728219422816766 06/02/23-03:16:14.874731	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49728	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049713219422816766 06/02/23-03:14:17.578597	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49713	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049717219422816766 06/02/23-03:14:46.659916	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49717	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049715219422816766 06/02/23-03:14:32.676847	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49715	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049723219422025019 06/02/23-03:15:30.905805	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49723	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049722219422816766 06/02/23-03:15:18.909197	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49722	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049713219422025019 06/02/23-03:14:16.340330	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49713	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049714219422025019 06/02/23-03:14:22.701480	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49714	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049724219422025019 06/02/23-03:15:38.625540	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49724	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049725219422025019 06/02/23-03:15:46.516736	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49725	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049721219422816766 06/02/23-03:15:11.972977	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49721	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049723219422816766 06/02/23-03:15:32.602475	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49723	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049715219422025019 06/02/23-03:14:29.058470	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49715	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049726219422025019 06/02/23-03:15:56.130210	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49726	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049728219422025019 06/02/23-03:16:12.322829	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49728	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049717219422025019 06/02/23-03:14:45.071339	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49717	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049718219422025019 06/02/23-03:14:54.530247	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49718	21942	192.168.2.5	213.152.161.40
213.152.161.40192.168.2.521942497252841753 06/02/23-03:15:53.656106	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	21942	49725	213.152.161.40	192.168.2.5
192.168.2.5213.152.161.4049716219422025019 06/02/23-03:14:38.559097	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49716	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049727219422025019 06/02/23-03:16:05.006045	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49727	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049719219422025019 06/02/23-03:15:01.548154	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49719	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049722219422025019 06/02/23-03:15:17.333804	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49722	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049721219422025019 06/02/23-03:15:10.736542	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49721	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049718219422816766 06/02/23-03:14:55.770847	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49718	21942	192.168.2.5	213.152.161.40
192.168.2.5213.152.161.4049719219422816766 06/02/23-03:15:03.125668	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49719	21942	192.168.2.5	213.152.161.40

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 2, 2023 03:14:15.897165060 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:16.291115046 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:16.292726994 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:16.340329885 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:16.740214109 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:16.741002083 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:17.182162046 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:17.182327032 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:17.577496052 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:17.578597069 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.023407936 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.023624897 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.153752089 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.452577114 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.452625036 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.452646971 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.452670097 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.452670097 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.452722073 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.452725887 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.452780008 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.452780008 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.452825069 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.453490019 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.453512907 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.453535080 CEST	21942	49713	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:18.453617096 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:18.453643084 CEST	49713	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:22.293716908 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:22.689059019 CEST	21942	49714	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:22.689198971 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:22.701479912 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:23.106259108 CEST	21942	49714	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:23.107754946 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:23.549438000 CEST	21942	49714	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:23.550512075 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:23.945451975 CEST	21942	49714	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:23.945596933 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:24.559926987 CEST	49714	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:28.666457891 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:29.057277918 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:29.057544947 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:29.058470011 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:29.456240892 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:29.456424952 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:30.233597994 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:30.636657953 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:30.636878014 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.069416046 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.073952913 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.500612974 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.500646114 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.500659943 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.500674009 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.500886917 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.501477003 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.501518965 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.501518965 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.501554012 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.501625061 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.501672983 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.501741886 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.501791000 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.892621040 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.892793894 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.892899036 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.892967939 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.893393040 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.893415928 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.893439054 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.893467903 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.893497944 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.893512964 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:31.894252062 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:31.894345045 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.200197935 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.284379959 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.284544945 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.284564972 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.284594059 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.284624100 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.284672976 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.284677982 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.284704924 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.284723997 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.284744978 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.285245895 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.285310030 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.645306110 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.645418882 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.675637007 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.675745964 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.676757097 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.676791906 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.676811934 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.676831961 CEST	21942	49715	213.152.161.40	192.168.2.5
Jun 2, 2023 03:14:32.676846981 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.676846981 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.676883936 CEST	49715	21942	192.168.2.5	213.152.161.40
Jun 2, 2023 03:14:32.676893950 CEST	49715	21942	192.168.2.5	213.152.161.40

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 2, 2023 03:14:15.853120089 CEST	49177	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:14:15.885448933 CEST	53	49177	8.8.8.8	192.168.2.5
Jun 2, 2023 03:14:22.231913090 CEST	49724	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:14:22.253011942 CEST	53	49724	8.8.8.8	192.168.2.5
Jun 2, 2023 03:14:28.631515026 CEST	61452	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:14:28.664314032 CEST	53	61452	8.8.8.8	192.168.2.5
Jun 2, 2023 03:14:37.110941887 CEST	65323	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:14:37.149499893 CEST	53	65323	8.8.8.8	192.168.2.5
Jun 2, 2023 03:14:44.644526005 CEST	51484	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:14:44.672653913 CEST	53	51484	8.8.8.8	192.168.2.5
Jun 2, 2023 03:14:51.091420889 CEST	63446	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:14:51.118262053 CEST	53	63446	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:01.121577978 CEST	56751	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:01.150638103 CEST	53	56751	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:09.295682907 CEST	60975	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:09.324079990 CEST	53	60975	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:16.925514936 CEST	59220	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:16.940361977 CEST	53	59220	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:23.323892117 CEST	55068	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:24.376849890 CEST	55068	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:25.449541092 CEST	55068	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:27.482081890 CEST	53	55068	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:37.110519886 CEST	56682	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:38.121855974 CEST	56682	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:38.144364119 CEST	53	56682	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:39.134860039 CEST	53	56682	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:46.034936905 CEST	58532	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:46.071866035 CEST	53	58532	8.8.8.8	192.168.2.5
Jun 2, 2023 03:15:52.640743017 CEST	62659	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:15:52.668926954 CEST	53	62659	8.8.8.8	192.168.2.5
Jun 2, 2023 03:16:03.578902960 CEST	58581	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:16:03.599817038 CEST	53	58581	8.8.8.8	192.168.2.5
Jun 2, 2023 03:16:11.905319929 CEST	56263	53	192.168.2.5	8.8.8.8
Jun 2, 2023 03:16:11.926800966 CEST	53	56263	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 2, 2023 03:15:39.135045052 CEST	192.168.2.5	8.8.8.8	d008	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 2, 2023 03:14:15.853120089 CEST	192.168.2.5	8.8.8.8	0x96b3	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:22.231913090 CEST	192.168.2.5	8.8.8.8	0x367a	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:28.631515026 CEST	192.168.2.5	8.8.8.8	0x1016	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:37.110941887 CEST	192.168.2.5	8.8.8.8	0x1c00	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:44.644526005 CEST	192.168.2.5	8.8.8.8	0xc195	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:51.091420889 CEST	192.168.2.5	8.8.8.8	0x997c	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:01.121577978 CEST	192.168.2.5	8.8.8.8	0xb8bf	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:09.295682907 CEST	192.168.2.5	8.8.8.8	0x9cdf	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:16.925514936 CEST	192.168.2.5	8.8.8.8	0x8754	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:23.323892117 CEST	192.168.2.5	8.8.8.8	0xd62c	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:24.376849890 CEST	192.168.2.5	8.8.8.8	0xd62c	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:25.449541092 CEST	192.168.2.5	8.8.8.8	0xd62c	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:37.110519886 CEST	192.168.2.5	8.8.8.8	0x89d3	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:38.121855974 CEST	192.168.2.5	8.8.8.8	0x89d3	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:46.034936905 CEST	192.168.2.5	8.8.8.8	0xf3b5	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:52.640743017 CEST	192.168.2.5	8.8.8.8	0xaee7	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:16:03.578902960 CEST	192.168.2.5	8.8.8.8	0x1577	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:16:11.905319929 CEST	192.168.2.5	8.8.8.8	0xf81a	Standard query (0)	dinowar.anondns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 2, 2023 03:14:15.885448933 CEST	8.8.8.8	192.168.2.5	0x96b3	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:22.253011942 CEST	8.8.8.8	192.168.2.5	0x367a	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:28.664314032 CEST	8.8.8.8	192.168.2.5	0x1016	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:37.149499893 CEST	8.8.8.8	192.168.2.5	0x1c00	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:44.672653913 CEST	8.8.8.8	192.168.2.5	0xc195	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:14:51.118262053 CEST	8.8.8.8	192.168.2.5	0x997c	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:01.150638103 CEST	8.8.8.8	192.168.2.5	0xb8bf	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:09.324079990 CEST	8.8.8.8	192.168.2.5	0x9cdf	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:16.940361977 CEST	8.8.8.8	192.168.2.5	0x8754	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:27.482081890 CEST	8.8.8.8	192.168.2.5	0xd62c	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:38.144364119 CEST	8.8.8.8	192.168.2.5	0x89d3	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:39.134860039 CEST	8.8.8.8	192.168.2.5	0x89d3	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:46.071866035 CEST	8.8.8.8	192.168.2.5	0xf3b5	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:15:52.668926954 CEST	8.8.8.8	192.168.2.5	0xaee7	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:16:03.599817038 CEST	8.8.8.8	192.168.2.5	0x1577	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false
Jun 2, 2023 03:16:11.926800966 CEST	8.8.8.8	192.168.2.5	0xf81a	No error (0)	dinowar.anondns.net	213.152.161.40	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:14:13
Start date:	02/06/2023
Path:	C:\Users\user\Desktop\mfpmp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\mfpmp.exe
Imagebase:	0x2d0000
File size:	214528 bytes
MD5 hash:	475B4814A0B6114C76EA55C7447B6108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000000.390950299.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.657080001.0000000002991000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.667317565.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.667774340.00000000051F0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.667674827.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.665497536.00000000039F2000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mfpmp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: NanoCore

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
mfpmp.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre