Malware Analysis Report

2024-10-18 23:03

Sample ID 220501-3twa3segd4
Target f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef
SHA256 f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef
Tags
matiex keylogger stealer collection spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef

Threat Level: Known bad

The file f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef was found to be: Known bad.

Malicious Activity Summary

matiex keylogger stealer collection spyware

Matiex Main Payload

Matiex

Reads user/profile data of web browsers

Checks computer location settings

Reads user/profile data of local email clients

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-01 23:48

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-01 23:48

Reported

2022-05-01 23:52

Platform

win10v2004-20220414-en

Max time kernel

142s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

Signatures

Matiex

stealer keylogger matiex

Matiex Main Payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3504 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 3504 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 3448 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 3504 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EvvUebihf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CC8.tmp"

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

Network

Country Destination Domain Proto
NL 104.110.191.140:80 tcp
US 52.109.8.21:443 tcp
US 20.42.72.131:443 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
DE 193.122.6.168:80 checkip.dyndns.org tcp
BR 132.226.247.73:80 checkip.dyndns.org tcp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 193.122.130.0:80 checkip.dyndns.org tcp

Files

memory/3504-130-0x0000000000160000-0x000000000025E000-memory.dmp

memory/3504-131-0x0000000007100000-0x000000000719C000-memory.dmp

memory/3504-132-0x0000000007750000-0x0000000007CF4000-memory.dmp

memory/3504-133-0x00000000071A0000-0x0000000007232000-memory.dmp

memory/3504-134-0x00000000070D0000-0x00000000070DA000-memory.dmp

memory/3504-135-0x00000000073F0000-0x0000000007446000-memory.dmp

memory/4408-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4CC8.tmp

MD5 814c12f4edda49bf412541e68af10116
SHA1 8b83022059f904b764edb96923df6d0496999649
SHA256 9b5582dc76af3d2b4893bbd8d179fa19be073d66d2699efbf74f6ae6046f887a
SHA512 d7e4ab6a6659e4a0043394b27e5ee6594280e4e5017a161b185cdd63634a94c6b5f1b36aab44fc650fb2d4713c038a7685691ee20c4b5594a20a9a1d05c82dee

memory/2232-138-0x0000000000000000-mapping.dmp

memory/3448-139-0x0000000000000000-mapping.dmp

memory/1996-140-0x0000000000000000-mapping.dmp

memory/1996-141-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe.log

MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

memory/1996-143-0x00000000052A0000-0x0000000005306000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-01 23:48

Reported

2022-05-01 23:51

Platform

win7-20220414-en

Max time kernel

77s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

Signatures

Matiex

stealer keylogger matiex

Matiex Main Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A
N/A freegeoip.app N/A N/A
N/A freegeoip.app N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1960 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\schtasks.exe
PID 1960 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 1960 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe
PID 520 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\WerFault.exe
PID 520 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\WerFault.exe
PID 520 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\WerFault.exe
PID 520 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe C:\Windows\SysWOW64\WerFault.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EvvUebihf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6D0.tmp"

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe

"C:\Users\Admin\AppData\Local\Temp\f4b29519255e0d839cac6027463fc12016f0f94faa2c201901f516489ec9a0ef.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 1760

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 freegeoip.app udp
US 188.114.97.0:443 freegeoip.app tcp
US 8.8.8.8:53 ipbase.com udp
US 99.83.231.61:443 ipbase.com tcp

Files

memory/1960-54-0x0000000001380000-0x000000000147E000-memory.dmp

memory/1960-55-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

memory/1960-56-0x00000000096E0000-0x00000000096E8000-memory.dmp

memory/1960-57-0x00000000074E0000-0x0000000007576000-memory.dmp

memory/1960-58-0x0000000007570000-0x000000000760E000-memory.dmp

memory/1800-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD6D0.tmp

MD5 aa092b7538c415baee8da6ae3b469f07
SHA1 154cc8e25027d2e281f929009d5936afe7e5ac1b
SHA256 3c0bd7838fee03e62d5fb8aa636f39ee7d18a878d840696711480058266a03c2
SHA512 e66b8fd07b887196c873fc6999829ba12ca82ad0cc0bb60ba885cc164cc8ec5edd91c58bef9652093c6573e1f2c24239bb19bbe42ea4b3084dfa9ce7a4bd1843

memory/520-61-0x0000000000400000-0x0000000000472000-memory.dmp

memory/520-62-0x0000000000400000-0x0000000000472000-memory.dmp

memory/520-64-0x0000000000400000-0x0000000000472000-memory.dmp

memory/520-65-0x0000000000400000-0x0000000000472000-memory.dmp

memory/520-66-0x0000000000400000-0x0000000000472000-memory.dmp

memory/520-67-0x000000000046DAEE-mapping.dmp

memory/520-69-0x0000000000400000-0x0000000000472000-memory.dmp

memory/520-71-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1488-73-0x0000000000000000-mapping.dmp