Malware Analysis Report

2025-01-18 12:21

Sample ID 221030-jxpg6aadg2
Target InvoicePrinting-MUM02322_22-23.js
SHA256 7cdb69e4725d8cd97ba8e9b8d9e072e71cb3b796951dd6e4a0c92dea771a5686
Tags
asyncrat default persistence rat wshrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7cdb69e4725d8cd97ba8e9b8d9e072e71cb3b796951dd6e4a0c92dea771a5686

Threat Level: Known bad

The file InvoicePrinting-MUM02322_22-23.js was found to be: Known bad.

Malicious Activity Summary

asyncrat default persistence rat wshrat

Wshrat family

AsyncRat

WSHRAT payload

Async RAT payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-30 08:03

Signatures

WSHRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Wshrat family

wshrat

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-30 08:03

Reported

2022-10-30 08:05

Platform

win7-20220901-en

Max time kernel

145s

Max time network

152s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\InvoicePrinting-MUM02322_22-23.js

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\err.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\shh.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\InvoicePrinting-MUM02322_22-23 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\InvoicePrinting-MUM02322_22-23.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InvoicePrinting-MUM02322_22-23 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\InvoicePrinting-MUM02322_22-23.js\"" C:\Windows\system32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\err.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\err.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\shh.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\shh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1064 wrote to memory of 716 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 1064 wrote to memory of 716 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 1064 wrote to memory of 716 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 1064 wrote to memory of 716 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 716 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 716 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 784 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 784 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 784 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 784 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1100 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1100 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1100 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1100 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1100 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe
PID 1100 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe
PID 1100 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe
PID 1100 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\InvoicePrinting-MUM02322_22-23.js

C:\Users\Admin\AppData\Local\Temp\err.exe

"C:\Users\Admin\AppData\Local\Temp\err.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "shh" /tr '"C:\Users\Admin\AppData\Roaming\shh.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp235A.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "shh" /tr '"C:\Users\Admin\AppData\Roaming\shh.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\shh.exe

"C:\Users\Admin\AppData\Roaming\shh.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 egodds.longmusic.com udp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:6606 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7707 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:6606 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:6606 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:6606 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp

Files

memory/1064-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

memory/716-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\err.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

C:\Users\Admin\AppData\Local\Temp\err.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

memory/716-58-0x0000000000E50000-0x0000000000E62000-memory.dmp

memory/716-59-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

memory/784-60-0x0000000000000000-mapping.dmp

memory/1100-61-0x0000000000000000-mapping.dmp

memory/1984-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp235A.tmp.bat

MD5 9fb9f70497a02f248f013ac78b5c1144
SHA1 4d6360a627d12ca9ff588437a48d9d2f6ba93679
SHA256 93c86b02e823cca2e0a6cf07f98418551072dc67c4eaef7dc1e34e8a3c03a506
SHA512 b1f5823543e8a36f9db3eedf5d86f5fe4c43cb040c1103e89bd34212d85f466a4968fe0e4df4f66452d2319bfa3dc647c9b7f6a4b162584b926af78efd27c1a2

memory/2040-64-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\shh.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

\Users\Admin\AppData\Roaming\shh.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

memory/1184-67-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\shh.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

memory/1184-69-0x0000000001090000-0x00000000010A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-30 08:03

Reported

2022-10-30 08:05

Platform

win10v2004-20220812-en

Max time kernel

150s

Max time network

156s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\InvoicePrinting-MUM02322_22-23.js

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\err.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\shh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\err.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InvoicePrinting-MUM02322_22-23 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\InvoicePrinting-MUM02322_22-23.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InvoicePrinting-MUM02322_22-23 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\InvoicePrinting-MUM02322_22-23.js\"" C:\Windows\system32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\err.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\shh.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\shh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1544 wrote to memory of 4544 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 1544 wrote to memory of 4544 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 1544 wrote to memory of 4544 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\err.exe
PID 4544 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 4544 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\err.exe C:\Windows\SysWOW64\cmd.exe
PID 1352 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1352 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1352 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2484 wrote to memory of 3816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 3816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 3816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2484 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe
PID 2484 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe
PID 2484 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\shh.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\InvoicePrinting-MUM02322_22-23.js

C:\Users\Admin\AppData\Local\Temp\err.exe

"C:\Users\Admin\AppData\Local\Temp\err.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "shh" /tr '"C:\Users\Admin\AppData\Roaming\shh.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C93.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "shh" /tr '"C:\Users\Admin\AppData\Roaming\shh.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\shh.exe

"C:\Users\Admin\AppData\Roaming\shh.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 egodds.longmusic.com udp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7707 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
IE 13.69.239.72:443 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7707 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
US 8.8.8.8:53 f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa udp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
JP 172.93.220.135:8808 egodds.longmusic.com tcp
N/A 127.0.0.1:7707 tcp
JP 172.93.220.135:7123 egodds.longmusic.com tcp
N/A 127.0.0.1:6606 tcp

Files

memory/4544-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\err.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

C:\Users\Admin\AppData\Local\Temp\err.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

memory/4544-135-0x0000000000940000-0x0000000000952000-memory.dmp

memory/4544-136-0x0000000005610000-0x00000000056AC000-memory.dmp

memory/1352-137-0x0000000000000000-mapping.dmp

memory/2484-138-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9C93.tmp.bat

MD5 648c44a9e8a1dd288cf934d9f788f17a
SHA1 88c2db5f6eafbb7d305793b4e7b7a1513f2340db
SHA256 d63e0d5e466c4391ab7cb690a775cf7df1d9da9d7603be574f83954aeb326582
SHA512 78e1f51a6ca69cff158f7dade9e5ce920667cb1a360418c0f9116b3bea0ab7d83b7f46e8f0335ab4c742057f6cd5a82881340dfd600770f6f6fa64cacb7ac4b2

memory/3816-141-0x0000000000000000-mapping.dmp

memory/2808-140-0x0000000000000000-mapping.dmp

memory/4896-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\shh.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27

C:\Users\Admin\AppData\Roaming\shh.exe

MD5 a1e6c547b3d494b82c0aec8e08cb444e
SHA1 7b851492a93cd9ebb9ceb88a77ee48634c0e82e7
SHA256 a5d6ca8aaffdc369addcf120fe79dc6711e1865d0a4c9b05215d2b82c8a4de51
SHA512 e09eb4d3a4e9a2d1d094324ff7ea1b53e089f52b1ca64b17a8db7e8fe9f2e2c474600cb6a2a6ca8d7bb377c54f3630fb66fa6e9ca2c1378e6e3a380f52d9ef27