Malware Analysis Report

2024-11-30 20:02

Sample ID 211124-aqq8qsege9
Target test.zip
SHA256 a00a34aa07b3ddf3ecae91fef78943998c624c9ff2c213179135e183dfdd6640
Tags
betabot backdoor botnet collection evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a00a34aa07b3ddf3ecae91fef78943998c624c9ff2c213179135e183dfdd6640

Threat Level: Known bad

The file test.zip was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet collection evasion persistence spyware stealer trojan

BetaBot

Modifies firewall policy service

Downloads MZ/PE file

Sets file execution options in registry

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks BIOS information in registry

Drops desktop.ini file(s)

Accesses Microsoft Outlook profiles

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

outlook_office_path

Suspicious use of WriteProcessMemory

Modifies Internet Explorer Protected Mode

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Modifies Internet Explorer Protected Mode Banner

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

outlook_win_path

NTFS ADS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-11-24 00:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-11-24 00:25

Reported

2021-11-24 00:29

Platform

win10-en-20211104

Max time kernel

231s

Max time network

224s

Command Line

"C:\Users\Admin\AppData\Local\Temp\test.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A

Downloads MZ/PE file

Sets file execution options in registry

persistence

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\os1ey3c9m5197ac.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\os1ey3c9m5197ac.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\os1ey3c9m5197ac.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3740 set thread context of 3968 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 2780 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\AppData\Local\Temp\i1353379.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" C:\Windows\SysWOW64\explorer.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\i1353379.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2872 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\test.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 2872 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\test.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 2872 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\test.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 3740 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 3740 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 3740 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 3740 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 3740 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Users\Admin\AppData\Roaming\Unist\vtc.exe
PID 3968 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Windows\SysWOW64\explorer.exe
PID 3968 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Windows\SysWOW64\explorer.exe
PID 3968 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\Unist\vtc.exe C:\Windows\SysWOW64\explorer.exe
PID 696 wrote to memory of 2780 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe
PID 696 wrote to memory of 2780 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe
PID 696 wrote to memory of 2780 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe
PID 696 wrote to memory of 968 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\i1353379.exe
PID 696 wrote to memory of 968 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\i1353379.exe
PID 696 wrote to memory of 948 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe
PID 696 wrote to memory of 948 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe
PID 696 wrote to memory of 948 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\test.exe

"C:\Users\Admin\AppData\Local\Temp\test.exe"

C:\Users\Admin\AppData\Roaming\Unist\vtc.exe

"C:\Users\Admin\AppData\Roaming\Unist\vtc.exe"

C:\Users\Admin\AppData\Roaming\Unist\vtc.exe

"C:\Users\Admin\AppData\Roaming\Unist\vtc.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe

/suac

C:\Users\Admin\AppData\Local\Temp\i1353379.exe

"C:\Users\Admin\AppData\Local\Temp\i1353379.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 968 -s 1240

C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe

"C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe"

Network

Country Destination Domain Proto
IE 52.109.76.31:443 tcp
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp
US 8.8.8.8:53 sv.symcb.com udp
US 72.21.91.29:80 sv.symcb.com tcp
US 8.8.8.8:53 update.microsoft.com udp
US 52.137.90.34:80 update.microsoft.com tcp
US 8.8.8.8:53 russk18.icu udp
US 8.8.8.8:53 ts-crl.ws.symantec.com udp
US 72.21.91.29:80 ts-crl.ws.symantec.com tcp
US 8.8.8.8:53 russk19.icu udp
US 8.8.8.8:53 russk19.icu udp
DE 160.20.147.189:80 russk19.icu tcp
US 8.8.8.8:53 chtoluca.com.mx udp
US 165.227.25.112:80 chtoluca.com.mx tcp
DE 160.20.147.189:80 russk19.icu tcp
DE 160.20.147.189:80 russk19.icu tcp

Files

memory/2872-118-0x00000000008A0000-0x00000000008A1000-memory.dmp

memory/3740-119-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Unist\vtc.exe

MD5 27c97218fb392cd17d63e2ded2d9557c
SHA1 1c33057c397ab56ee9d376a1a1c1e1b772674ff1
SHA256 464a6415d0dd1b6425dc21fac401f21d04e3e4ae198d2fd3619c6fcd18181a86
SHA512 9c4c02a1e38bce828b73d9723ab9d7d526b22cf65769deda0190b7baf47cf225f9928024b12f36b981d5faa38514070a2d0abeb1f6ade9332de1c13ca331e3e5

C:\Users\Admin\AppData\Roaming\Unist\vtc.exe

MD5 27c97218fb392cd17d63e2ded2d9557c
SHA1 1c33057c397ab56ee9d376a1a1c1e1b772674ff1
SHA256 464a6415d0dd1b6425dc21fac401f21d04e3e4ae198d2fd3619c6fcd18181a86
SHA512 9c4c02a1e38bce828b73d9723ab9d7d526b22cf65769deda0190b7baf47cf225f9928024b12f36b981d5faa38514070a2d0abeb1f6ade9332de1c13ca331e3e5

memory/3968-122-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3968-123-0x00000000004015C6-mapping.dmp

C:\Users\Admin\AppData\Roaming\Unist\vtc.exe

MD5 27c97218fb392cd17d63e2ded2d9557c
SHA1 1c33057c397ab56ee9d376a1a1c1e1b772674ff1
SHA256 464a6415d0dd1b6425dc21fac401f21d04e3e4ae198d2fd3619c6fcd18181a86
SHA512 9c4c02a1e38bce828b73d9723ab9d7d526b22cf65769deda0190b7baf47cf225f9928024b12f36b981d5faa38514070a2d0abeb1f6ade9332de1c13ca331e3e5

memory/3968-125-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3968-127-0x00000000004C0000-0x000000000060A000-memory.dmp

memory/3968-126-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3968-131-0x0000000002660000-0x000000000266C000-memory.dmp

memory/3968-129-0x0000000002630000-0x0000000002631000-memory.dmp

memory/3968-128-0x0000000000590000-0x00000000005F6000-memory.dmp

memory/3968-132-0x0000000000900000-0x000000000090D000-memory.dmp

memory/696-133-0x0000000000000000-mapping.dmp

memory/696-135-0x0000000000A70000-0x0000000000BD8000-memory.dmp

memory/696-136-0x00000000033B0000-0x00000000034E6000-memory.dmp

memory/696-134-0x0000000000F70000-0x00000000013AF000-memory.dmp

memory/3968-137-0x0000000002650000-0x0000000002651000-memory.dmp

memory/696-138-0x0000000006690000-0x0000000006692000-memory.dmp

memory/2780-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe

MD5 27c97218fb392cd17d63e2ded2d9557c
SHA1 1c33057c397ab56ee9d376a1a1c1e1b772674ff1
SHA256 464a6415d0dd1b6425dc21fac401f21d04e3e4ae198d2fd3619c6fcd18181a86
SHA512 9c4c02a1e38bce828b73d9723ab9d7d526b22cf65769deda0190b7baf47cf225f9928024b12f36b981d5faa38514070a2d0abeb1f6ade9332de1c13ca331e3e5

C:\Users\Admin\AppData\Local\Temp\os1ey3c9m5197ac_1.exe

MD5 27c97218fb392cd17d63e2ded2d9557c
SHA1 1c33057c397ab56ee9d376a1a1c1e1b772674ff1
SHA256 464a6415d0dd1b6425dc21fac401f21d04e3e4ae198d2fd3619c6fcd18181a86
SHA512 9c4c02a1e38bce828b73d9723ab9d7d526b22cf65769deda0190b7baf47cf225f9928024b12f36b981d5faa38514070a2d0abeb1f6ade9332de1c13ca331e3e5

C:\Users\Admin\AppData\Local\Temp\i1353379.exe

MD5 5dd157c23b3ae2940b86be2413638513
SHA1 3c242d6289b0af392ea821abbf61314aa13a2253
SHA256 480e5b49e6e73afd15af182ed1d4abec69bf7252c58fa97c16d6beeb13bdb9ed
SHA512 4d93f556a00a3cc5f7f3bf4cbdd72fac15fe9abd9d40a76de310201b3495c1200341ed0d7c24c43d2097644b405cea4e646f4c04e0152504f47d24e40b57efe4

C:\Users\Admin\AppData\Local\Temp\i1353379.exe

MD5 5dd157c23b3ae2940b86be2413638513
SHA1 3c242d6289b0af392ea821abbf61314aa13a2253
SHA256 480e5b49e6e73afd15af182ed1d4abec69bf7252c58fa97c16d6beeb13bdb9ed
SHA512 4d93f556a00a3cc5f7f3bf4cbdd72fac15fe9abd9d40a76de310201b3495c1200341ed0d7c24c43d2097644b405cea4e646f4c04e0152504f47d24e40b57efe4

memory/968-142-0x0000000000000000-mapping.dmp

memory/968-145-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

memory/968-147-0x000000001BDA0000-0x000000001BDA2000-memory.dmp

memory/968-148-0x000000001F900000-0x000000001FDBC000-memory.dmp

memory/968-149-0x000000001BDA2000-0x000000001BDA4000-memory.dmp

memory/968-150-0x000000001BDA4000-0x000000001BDA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe

MD5 d79538d481522090c4d6ea18be680dc0
SHA1 68e45dd6b03011dd6f9fc766764f7e5da0001836
SHA256 43566095adf3e00feb284d35e0e2f5c086e5f92f6fb6302ac0a42edb1044afe1
SHA512 b3d9c52bc0ea2483c0a2d57badb47864693d9e4b843bfb069c54c699c033c25462ef5a916ea6e39158dd2d39375a0d67db9dabb9c44a043d8fed73cf7859188d

memory/948-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7q5199773e.exe

MD5 d79538d481522090c4d6ea18be680dc0
SHA1 68e45dd6b03011dd6f9fc766764f7e5da0001836
SHA256 43566095adf3e00feb284d35e0e2f5c086e5f92f6fb6302ac0a42edb1044afe1
SHA512 b3d9c52bc0ea2483c0a2d57badb47864693d9e4b843bfb069c54c699c033c25462ef5a916ea6e39158dd2d39375a0d67db9dabb9c44a043d8fed73cf7859188d

memory/948-154-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/968-157-0x000000001BDA6000-0x000000001BDA8000-memory.dmp

memory/968-156-0x000000001BDA5000-0x000000001BDA6000-memory.dmp

memory/968-158-0x000000001BDA8000-0x000000001BDAA000-memory.dmp

\Users\Admin\AppData\Local\Temp\Costura\1ACF592E7018DA88DDC32B96D203A4BE\32\sqlite3.dll

MD5 0a855f27a1e48991d14c593cb930d2b2
SHA1 01935b77a59ab90be4af37bb4e8bc57fbdcf23a1
SHA256 43d11ddfa64be9a2eeb94574f21fd45334e4598506f3d5ae1446c7a0add10300
SHA512 bfc680d50d043c438c0c4bc97f7830010bf302e9e81296c57b1a06e3e87a2000444e44fadec20ca2025260bf745629971bfca02ff59469085fc7eada7912e873