Malware Analysis Report

2024-11-16 13:10

Sample ID 220520-2shsxsahgq
Target ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0
SHA256 ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0
Tags
limerat evasion rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0

Threat Level: Known bad

The file ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0 was found to be: Known bad.

Malicious Activity Summary

limerat evasion rat

LimeRAT

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Maps connected drives based on registry

Suspicious use of SetThreadContext

Enumerates physical storage devices

Modifies system certificate store

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-20 22:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-20 22:50

Reported

2022-05-20 22:58

Platform

win7-20220414-en

Max time kernel

152s

Max time network

176s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe"

Signatures

LimeRAT

rat limerat

Looks for VirtualBox Guest Additions in registry

evasion

Looks for VMWare Tools registry key

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1516 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 1516 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 1516 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 1516 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 1516 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1516 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1516 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1516 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe

"C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KuDIkpeai" /XML "C:\Users\Admin\AppData\Local\Temp\tmp276F.tmp"

C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe

"C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1028

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:443 pastebin.com tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp

Files

memory/1516-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

memory/1516-55-0x0000000074330000-0x00000000748DB000-memory.dmp

memory/1656-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp276F.tmp

MD5 9e689074c506a3f06ae10fcf135d0d33
SHA1 26ed44676fe53a6b7523df6ebe9e2fc9d57b8eab
SHA256 ee03c0ce8e1525ccf3d23cbf4dc0a6e440df509b47aa7609a54e2162fab44041
SHA512 224d1633f9e408ef16842487ac10c4d7617bfd5addf6724ecfde90ee45f9b6ba70cb805dc2f2f2a1c7d29fbe5aec4de5fa0f755d76ade26824e083460ee03844

memory/1204-61-0x0000000000080000-0x000000000008C000-memory.dmp

memory/1204-59-0x0000000000080000-0x000000000008C000-memory.dmp

memory/1204-58-0x0000000000080000-0x000000000008C000-memory.dmp

memory/1204-63-0x0000000000408BEE-mapping.dmp

memory/1204-64-0x0000000000080000-0x000000000008C000-memory.dmp

memory/1204-65-0x0000000000080000-0x000000000008C000-memory.dmp

memory/1204-68-0x0000000000080000-0x000000000008C000-memory.dmp

memory/1204-70-0x0000000000080000-0x000000000008C000-memory.dmp

memory/388-72-0x0000000000000000-mapping.dmp

memory/1204-74-0x0000000074330000-0x00000000748DB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-20 22:50

Reported

2022-05-20 22:56

Platform

win10v2004-20220414-en

Max time kernel

152s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe"

Signatures

LimeRAT

rat limerat

Looks for VirtualBox Guest Additions in registry

evasion

Looks for VMWare Tools registry key

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\SysWOW64\schtasks.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe
PID 3048 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3048 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3048 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe

"C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KuDIkpeai" /XML "C:\Users\Admin\AppData\Local\Temp\tmp826E.tmp"

C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe

"C:\Users\Admin\AppData\Local\Temp\ab7b41c231ff2cfd4f9befca2ce8af7478848a956efbbbd534283e549580acd0.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 1824

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 20.189.173.1:443 tcp
FR 2.18.109.224:443 tcp
US 104.18.25.243:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp
FR 194.5.97.169:7877 tcp

Files

memory/3048-130-0x0000000074B30000-0x00000000750E1000-memory.dmp

memory/1728-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp826E.tmp

MD5 33068b7af198af0e057f4a38790bc333
SHA1 dc2b412806a90777559f5334f570a228ea57cdac
SHA256 6c281c431fd69bf4227b55086e62eeb45242a223e97807021b62b4039c167820
SHA512 07a9bebd16bdbafb8df758fc7ffbaa88c67530653a00d3b333ad1602254897e52cef0e08c724e554d3fbd6ee884a3d9445aa72be760fb7498c3889ff4398441e

memory/4752-133-0x0000000000000000-mapping.dmp

memory/4752-134-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4180-135-0x0000000000000000-mapping.dmp

memory/4752-136-0x0000000074B30000-0x00000000750E1000-memory.dmp