Malware Analysis Report

2024-08-06 19:34

Sample ID 221128-wx4y3afa52
Target 60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09
SHA256 60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09
Tags
njrat billy evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09

Threat Level: Known bad

The file 60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09 was found to be: Known bad.

Malicious Activity Summary

njrat billy evasion persistence trojan

njRAT/Bladabindi

Modifies Windows Firewall

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Modify Existing Service
T1031
Registry Run Keys / Startup Folder
T1060
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2022-11-28 18:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-28 18:18

Reported

2022-11-30 00:41

Platform

win7-20220812-en

Max time kernel

188s

Max time network

188s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\BU8271~1 = "C:\\Users\\Admin\\BU8271~1\\nslgdr.vbs" C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1748 set thread context of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1832 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1748 wrote to memory of 2008 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 2008 wrote to memory of 1716 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe

"C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe"

C:\Users\Admin\bu82712949adhi\dacorcy.exe

"C:\Users\Admin\bu82712949adhi\dacorcy.exe" jozngrpxthpu

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "RegSvcs.exe" ENABLE

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 yorkiepet.ddns.net udp
N/A 184.105.237.196:770 yorkiepet.ddns.net tcp
N/A 184.105.237.196:770 yorkiepet.ddns.net tcp
N/A 184.105.237.196:770 yorkiepet.ddns.net tcp

Files

memory/1832-54-0x0000000075601000-0x0000000075603000-memory.dmp

\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

memory/1748-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\bu82712949adhi\jozngrpxthpu

MD5 aff787634fb5b108d751eb5d52dbc3ce
SHA1 a84983d6f2474d423041cc7afa23ffe4481b509b
SHA256 27abc51e5bb387d2df09a99a12366f7a80f3254877875776fb2b670984a04b60
SHA512 66b7523321e46270d611ea907a537538e057521333093c5f87465567c8aa2068edc0635a2735b90ca3538d427e334c91a89e299263b9d830d09a470074ce05a5

C:\Users\Admin\BU8271~1\lvgefuwxc.ELF

MD5 7c70e81a236c0010a36dc156d81bf960
SHA1 1ed6ff2c1b58fb69aa29d1890a78e9b853373cbd
SHA256 8899c78153e7957715dba83d72daa00af4a4af1f462bbf544a1d974349f8539c
SHA512 e3e8626232da5cb5b70ef8260388689f16d71f7e73d927a34eaca5c463cece8ceba877d3ed62df74e46aa1430bbad833f085d342b360ae6ac2a40e08abc757a7

C:\Users\Admin\BU8271~1\wtpq.CVI

MD5 dfe20a533e594f216ce1b47c0b871e78
SHA1 dbe407d172635250141e6fc93276bd98bf5e0556
SHA256 a5361fc86f1476823e5f3e1e1b3b726270f5624186e49c29b36603e147d64bd8
SHA512 930a3c2f4b9a2d66348b3ea69b02b28a54004600115049913b3e3c1334e93caf2306007e5c40e596126e61e2ba1b2c0832a020349e983ed53bbb6e43535089f0

memory/2008-65-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-68-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-69-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-66-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-70-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-71-0x000000000040748E-mapping.dmp

memory/2008-73-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-75-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2008-77-0x0000000073C70000-0x000000007421B000-memory.dmp

memory/1716-78-0x0000000000000000-mapping.dmp

memory/2008-80-0x0000000073C70000-0x000000007421B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-28 18:18

Reported

2022-11-30 00:41

Platform

win10v2004-20220812-en

Max time kernel

188s

Max time network

190s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\BU8271~1 = "C:\\Users\\Admin\\BU8271~1\\nslgdr.vbs" C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4104 set thread context of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
N/A N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2424 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 2424 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 2424 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe C:\Users\Admin\bu82712949adhi\dacorcy.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 4104 wrote to memory of 1648 N/A C:\Users\Admin\bu82712949adhi\dacorcy.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PID 1648 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 1648 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe
PID 1648 wrote to memory of 1028 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe

"C:\Users\Admin\AppData\Local\Temp\60608e45d331927b114d3f72cfd78d324f74624da77659bfb51fc3fab3694d09.exe"

C:\Users\Admin\bu82712949adhi\dacorcy.exe

"C:\Users\Admin\bu82712949adhi\dacorcy.exe" jozngrpxthpu

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" "RegSvcs.exe" ENABLE

Network

Country Destination Domain Proto
N/A 8.253.208.113:80 tcp
N/A 67.27.153.254:80 tcp
N/A 93.184.220.29:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 8.253.208.112:80 tcp
N/A 20.42.65.84:443 tcp
N/A 8.238.20.254:80 tcp
N/A 8.238.20.126:80 tcp
N/A 8.253.208.112:80 tcp
N/A 8.253.208.113:80 tcp
N/A 8.253.208.113:80 tcp
N/A 8.253.208.113:80 tcp
N/A 67.27.153.254:80 tcp
N/A 8.253.208.112:80 tcp
N/A 8.253.208.112:80 tcp
N/A 8.8.8.8:53 yorkiepet.ddns.net udp
N/A 184.105.237.196:770 yorkiepet.ddns.net tcp
N/A 184.105.237.196:770 yorkiepet.ddns.net tcp
N/A 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
N/A 184.105.237.196:770 yorkiepet.ddns.net tcp

Files

memory/4104-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\bu82712949adhi\dacorcy.exe

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\bu82712949adhi\jozngrpxthpu

MD5 aff787634fb5b108d751eb5d52dbc3ce
SHA1 a84983d6f2474d423041cc7afa23ffe4481b509b
SHA256 27abc51e5bb387d2df09a99a12366f7a80f3254877875776fb2b670984a04b60
SHA512 66b7523321e46270d611ea907a537538e057521333093c5f87465567c8aa2068edc0635a2735b90ca3538d427e334c91a89e299263b9d830d09a470074ce05a5

C:\Users\Admin\BU8271~1\lvgefuwxc.ELF

MD5 7c70e81a236c0010a36dc156d81bf960
SHA1 1ed6ff2c1b58fb69aa29d1890a78e9b853373cbd
SHA256 8899c78153e7957715dba83d72daa00af4a4af1f462bbf544a1d974349f8539c
SHA512 e3e8626232da5cb5b70ef8260388689f16d71f7e73d927a34eaca5c463cece8ceba877d3ed62df74e46aa1430bbad833f085d342b360ae6ac2a40e08abc757a7

C:\Users\Admin\BU8271~1\wtpq.CVI

MD5 dfe20a533e594f216ce1b47c0b871e78
SHA1 dbe407d172635250141e6fc93276bd98bf5e0556
SHA256 a5361fc86f1476823e5f3e1e1b3b726270f5624186e49c29b36603e147d64bd8
SHA512 930a3c2f4b9a2d66348b3ea69b02b28a54004600115049913b3e3c1334e93caf2306007e5c40e596126e61e2ba1b2c0832a020349e983ed53bbb6e43535089f0

memory/1648-138-0x0000000000000000-mapping.dmp

memory/1648-139-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1648-140-0x0000000074FD0000-0x0000000075581000-memory.dmp

memory/1028-141-0x0000000000000000-mapping.dmp

memory/1648-142-0x0000000074FD0000-0x0000000075581000-memory.dmp