Malware Analysis Report

2025-04-13 21:10

Sample ID 240126-gejg3sgefn
Target 768a83faefcdc81b408b09df7ed89395
SHA256 ebd4fcb03911f9f6d4ba31386e21881841c98591e78a539f976110b2ff7e8f05
Tags
nanocore evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ebd4fcb03911f9f6d4ba31386e21881841c98591e78a539f976110b2ff7e8f05

Threat Level: Known bad

The file 768a83faefcdc81b408b09df7ed89395 was found to be: Known bad.

Malicious Activity Summary

nanocore evasion keylogger persistence spyware stealer trojan

NanoCore

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops startup file

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-26 05:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-26 05:42

Reported

2024-01-26 05:45

Platform

win7-20231215-en

Max time kernel

142s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe C:\Users\Admin\AppData\Roaming\nan0.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\32bit Patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2612 set thread context of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\TCP Service\tcpsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\TCP Service\tcpsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1724 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\11.exe
PID 1724 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\11.exe
PID 1724 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\11.exe
PID 1724 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 1724 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 1724 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 1724 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 2776 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\11.exe C:\Windows\system32\WerFault.exe
PID 2776 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\11.exe C:\Windows\system32\WerFault.exe
PID 2776 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\11.exe C:\Windows\system32\WerFault.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2612 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe

"C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe"

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

"C:\Users\Admin\AppData\Roaming\32bit Patch.exe"

C:\Users\Admin\AppData\Roaming\11.exe

"C:\Users\Admin\AppData\Roaming\11.exe"

C:\Users\Admin\AppData\Roaming\nan0.exe

"C:\Users\Admin\AppData\Roaming\nan0.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2776 -s 516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sabifati34.duckdns.org udp
US 192.169.69.26:54984 sabifati34.duckdns.org tcp
US 8.8.8.8:53 sabifati34.duckdns.org udp
US 192.169.69.26:54984 sabifati34.duckdns.org tcp
US 8.8.8.8:53 sabifati34.duckdns.org udp
US 192.169.69.26:54984 sabifati34.duckdns.org tcp
US 8.8.8.8:53 kingspy.mywire.org udp
TR 46.196.24.72:54984 kingspy.mywire.org tcp

Files

memory/1724-0-0x0000000000980000-0x0000000001124000-memory.dmp

memory/1724-1-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

MD5 014a6633585a89c8be4c80991ca8e4e0
SHA1 eaeed24ad805d1f2d6b7f10e3ab6ed0e67f5b581
SHA256 b4d25b0627f0d2fb88f51dd6383428daebe2fde862ca95547be8552634c13f85
SHA512 898277a68c4e77807d336f872be7a004a2e8aecfc7d49c2e6d9d69ec0a689d741cc60d7932bcd16f97a7fb9eecdde4b414c0fc2772a3de0f3564a2a1dd0bde17

\Users\Admin\AppData\Roaming\11.exe

MD5 da7f3a087955941a62eab64c7c068b7e
SHA1 84f196582a8da8fb9517f289f230d742db9988e8
SHA256 9b50525b4453465532d46cba1de9f7024c491c4231daafa92bb2f7312801d4c5
SHA512 2454203e5ed67a6aea75de3dd452fd6a2188beef0193f143fcdc5a1300e204b517a3ce31c389efe20887260bb311145b58d0eeae552e51276d4b7c50142af4f3

C:\Users\Admin\AppData\Roaming\11.exe

MD5 8612992452fe0f42f76f33d0320c208c
SHA1 aef42d62ec61ab3675767ab87a6a57d6bdf91135
SHA256 60d61c61f5db33ea50ec002f0a6d6db988c270876e73c703475e05179b8e35bc
SHA512 4b081d881c93ef332bfa060d8bb1a3b648308677a16233bfcd490b7f6423c70006de1fd8d4f52ba61e8b43bac043ae89ab29e173593593548e14a3981e239bd2

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

MD5 a26084634bab2ad1124e104447269bd8
SHA1 43379a654f142016d91ab1b7bb696e48b09fd65c
SHA256 5edaa30b874d91e663356e188705fd4579f7910cc610f4746858f0d96b47a599
SHA512 0361fb6a96862efaa7af2047e7f53f85da1b3f8886697fa63bf623d56d091f1c3b85e4d0e8ef6c8ee06cb5fb4022c4d2710ef3e7ce777d52adaf4c891aebab6c

C:\Users\Admin\AppData\Roaming\11.exe

MD5 941f6c12cef77bc88218c384d12d6ff0
SHA1 cc38714927b2572fe448f51c8cfc605102a88fd9
SHA256 6a821b75ab9e5e3176d2c0d073d31f77695900f361611cf657c5be63e5f7cda1
SHA512 e2b955b2b7a362f3bcc1f562671f6ac9e25c85f87a31fa155cf7eb8bef4c1cbda7ce09039dd9b5bb4b1d703f363855e7b284d4f6939d32cb370190f3d7bdfb32

memory/2776-32-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

memory/2776-31-0x0000000000950000-0x0000000000D86000-memory.dmp

C:\Users\Admin\AppData\Roaming\nan0.exe

MD5 eb5dac7b7c59d99135d021760108ef5a
SHA1 a2a7f393eef680b8077895a8bfb7de09b7abb3eb
SHA256 6ec4ee2eadfc7e325e2b1e25f08bc5a7e4e6edc769521e3fa088ea9e68e854ba
SHA512 db8a5abcd5d5c4c318bac8d1bbcb4dd81b667168a4cbd2f94c5e191e62908ff70d2bf1a4c23c64d76a66dcb995c420fa8bf88397876fbd9658d155a2fb8d267a

memory/1724-37-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

\Users\Admin\AppData\Roaming\11.exe

MD5 f8d9f739161722e291ecd8500ef83371
SHA1 cb96f5b3b71310fe4a5e0274ef05f9c3cb295151
SHA256 d6815861c1d05b306ebcd4eec408c69e895203fc0e1b429b585528f6d7e9241d
SHA512 d3bd589e83678d9cb9c4a493129971becadbc8f3522f18d7906ecdcfbb91a11666a1550e555f1e97d8e501a8beb7cf1f0aeaf4f5fb52417afa454e0f58e57462

\Users\Admin\AppData\Roaming\11.exe

MD5 348141d30d5edc50ce53d629673ade71
SHA1 e36c163d926e1be72ace708124d91b149ea37ad0
SHA256 cd9d0415b3a4447fa945f970a28826ff3baff10e37cb8a92886e2a467ba6266b
SHA512 10f5bef0880964ac23a13cc3fc88456127a02b0760bef4686695719a4068ee7aebc9f1e73448a77c3e59c9f248d3cf6f97d0101c71a3ebaac8bc19ad09f68921

\Users\Admin\AppData\Roaming\11.exe

MD5 69b7aba132952b1263ae190d934faac6
SHA1 7dac83d0945fba43b38259c94ee2f7db01cfec72
SHA256 4a0853bd11c4337fc44738389500bbf537d8b7edebf2754964f79699b4d00080
SHA512 0474b2788d1612f97bc6d4b9d60bd5255c77dd9c8c28688e4815c857409fdd892d5e052df2c6f3ad79a9f4e828d89db4377a27a90885b7d8fccf4c8e25cf430d

\Users\Admin\AppData\Roaming\11.exe

MD5 72af9d1a256297124ba2caf0e008a23e
SHA1 4343cb572feb2cae40a155b7126aafe3b66fb699
SHA256 95268103fa0a9a48a1686a4c98ed18a459bb3ac706cd774d87450ea9526fb88f
SHA512 47f6bc014f8274e426eb4a4c3702984afeef64cde4e02cdea893cd4dcf3bca716683a232c541bbf72f605f10dad9e56bb3c119afcb548c5711b3772cab2041de

memory/2612-42-0x0000000000F50000-0x0000000001010000-memory.dmp

memory/2612-43-0x0000000074880000-0x0000000074F6E000-memory.dmp

\Users\Admin\AppData\Roaming\11.exe

MD5 e2ad596ddeaed06e434a0ccfe5f197ea
SHA1 bffe4cc4876dc90e7fdec2e9c3bcb1a31405a086
SHA256 678e6636b051170ae3a549c198b9347a9f2f29af9346ceef66d89d3ec6c9a7cf
SHA512 5aacb3311c5cabe46332b1096f15bb8bdf9b3911e43fe0350303bc3cb571d41788c04e9e5019641386e81b8003c919d754d34cca088eb9e09467408bd66a552c

memory/2612-45-0x0000000004800000-0x0000000004840000-memory.dmp

memory/2612-46-0x0000000004840000-0x0000000004880000-memory.dmp

C:\Users\Admin\AppData\Roaming\nvidia

MD5 0f8e43ed64baa667770e749417e60d34
SHA1 81ba263ddd26fb643e7775e8890de04258a9b8df
SHA256 3530dde67c08938518222f1c3d52f8f5eb48629cdbf0567a96a5180d29af6682
SHA512 db41a26753a128ec93d759b8161ecfd5e59052788a245e11ac2efca9b75c5449b6b42e6b9b804cdef81c3c3f8e4719167189c2aa6d729abcee929f09087cb5a3

memory/2612-48-0x0000000000610000-0x0000000000613000-memory.dmp

memory/2356-49-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2612-50-0x0000000000620000-0x0000000000623000-memory.dmp

memory/2020-55-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2020-53-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2020-51-0x0000000000400000-0x0000000000438000-memory.dmp

memory/2612-56-0x0000000074880000-0x0000000074F6E000-memory.dmp

memory/2020-59-0x0000000000760000-0x000000000076A000-memory.dmp

memory/2020-60-0x0000000000770000-0x000000000078E000-memory.dmp

memory/2020-61-0x0000000000790000-0x000000000079A000-memory.dmp

memory/2020-62-0x0000000000A20000-0x0000000000A60000-memory.dmp

memory/2776-63-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

memory/2020-68-0x00000000009D0000-0x00000000009DC000-memory.dmp

memory/2020-69-0x00000000009E0000-0x00000000009FA000-memory.dmp

memory/2020-70-0x0000000000A10000-0x0000000000A1E000-memory.dmp

memory/2020-71-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

memory/2020-72-0x0000000000AC0000-0x0000000000ACE000-memory.dmp

memory/2020-73-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

memory/2020-74-0x0000000000BB0000-0x0000000000BC4000-memory.dmp

memory/2020-75-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

memory/2020-76-0x0000000000C50000-0x0000000000C64000-memory.dmp

memory/2020-77-0x0000000000C60000-0x0000000000C6E000-memory.dmp

memory/2020-78-0x0000000000E70000-0x0000000000E9E000-memory.dmp

memory/2020-79-0x0000000000C80000-0x0000000000C94000-memory.dmp

memory/2020-81-0x0000000000A20000-0x0000000000A60000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-26 05:42

Reported

2024-01-26 05:45

Platform

win10v2004-20231215-en

Max time kernel

144s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe C:\Users\Admin\AppData\Roaming\nan0.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\32bit Patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1928 set thread context of 1312 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\UDP Subsystem\udpss.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\nan0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1160 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1160 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1160 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\32bit Patch.exe
PID 1160 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\11.exe
PID 1160 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\11.exe
PID 1160 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 1160 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 1160 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe C:\Users\Admin\AppData\Roaming\nan0.exe
PID 1928 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1928 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1928 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1928 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1928 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1928 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1928 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Roaming\nan0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe

"C:\Users\Admin\AppData\Local\Temp\768a83faefcdc81b408b09df7ed89395.exe"

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

"C:\Users\Admin\AppData\Roaming\32bit Patch.exe"

C:\Users\Admin\AppData\Roaming\11.exe

"C:\Users\Admin\AppData\Roaming\11.exe"

C:\Users\Admin\AppData\Roaming\nan0.exe

"C:\Users\Admin\AppData\Roaming\nan0.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 sabifati34.duckdns.org udp
US 192.169.69.26:54984 sabifati34.duckdns.org tcp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 26.69.169.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 sabifati34.duckdns.org udp
US 192.169.69.26:54984 sabifati34.duckdns.org tcp
US 8.8.8.8:53 sabifati34.duckdns.org udp
US 192.169.69.26:54984 sabifati34.duckdns.org tcp
US 8.8.8.8:53 kingspy.mywire.org udp
TR 46.196.24.72:54984 kingspy.mywire.org tcp
US 8.8.8.8:53 72.24.196.46.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/1160-0-0x00000000006B0000-0x0000000000E54000-memory.dmp

memory/1160-1-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

MD5 566452be3534b31515d00acbead7cde3
SHA1 a349b2b9e8ad7cc5a003b1d190cdad54480ae1b0
SHA256 486d5e6344ff0416ada988efc71a99147560b1a27d75aa259a5aca40af3feb82
SHA512 805ccb2321b97fbf7764ce423dea58cfa0a5ff559743946a60ad723f615e557e7447fb534b883c8ca948dc86b3eb09d9fd9321ce31ad0176acb34e4fcf1f14a0

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

MD5 687ae36a5a6422c66e8c65a5f44a1f74
SHA1 43bf001c867fec70722e4e0db5378dab565e6456
SHA256 be9b2b3fb3730378110a9911e18af87b2969ee8400b13a078ba3a65312b87d03
SHA512 99ac05cde085cd9c624caecfc37ff4e71a36dfc827e5433a8c8287a02998427c2b65c62205f2aedf23470b0069b69e923d986895e14f29686190bb19d8d3c9c2

C:\Users\Admin\AppData\Roaming\32bit Patch.exe

MD5 6f86cb7b2a458135e3ebf1157febe13d
SHA1 f5b16aef3346938d43f3cb87bb1dc0dc68dab87c
SHA256 78432ad49cf03023a5ac7068d29cef55c46319ce797a0e36d23de548df00a03d
SHA512 89c634779e1778a1e2d35841553f1307ddc8b1ea02f20822f92d5d9e92eda187ea2ada86bae51cddf2586f20ad05a52014008f1421846fccd986dfdaa4626d4f

C:\Users\Admin\AppData\Roaming\11.exe

MD5 767e3bebe092ca47e5856ae2fae5c453
SHA1 1fcc083c041385bfa50476bf78fa72cebe025f6a
SHA256 ffd6bb6dc47d52ae9f02321905314b0d9828f997939d12493259eda1e0c73c46
SHA512 0453b8f8366853bab28c6bdd793b757f7b41cdbd2bb28f7e309020dffd5e97a545cfe23997217463be12b169973aa7936634aa9c17cb76f8f851675d88f85d93

C:\Users\Admin\AppData\Roaming\11.exe

MD5 e07418dc6d3680af28be6a647f8bd4dd
SHA1 bae1a2796bd212c4e30116cf89e84bbff37a0317
SHA256 51c464395767688f6d545c4ab894f892b16b53a736d789ca555cb2c75c301096
SHA512 3942178c4f3ac1de880c879206ddd2644c001829dbec482d56ccf85b3254e4442e06463a9edea46802adae09ea1976e0f47d9683cae61e95538cf0bf473c3e94

C:\Users\Admin\AppData\Roaming\nan0.exe

MD5 eb5dac7b7c59d99135d021760108ef5a
SHA1 a2a7f393eef680b8077895a8bfb7de09b7abb3eb
SHA256 6ec4ee2eadfc7e325e2b1e25f08bc5a7e4e6edc769521e3fa088ea9e68e854ba
SHA512 db8a5abcd5d5c4c318bac8d1bbcb4dd81b667168a4cbd2f94c5e191e62908ff70d2bf1a4c23c64d76a66dcb995c420fa8bf88397876fbd9658d155a2fb8d267a

C:\Users\Admin\AppData\Roaming\11.exe

MD5 a73be1e0cf92fa060dd72a9298e248c7
SHA1 13647ffbbdd28e5016770233d61f7c6904794dff
SHA256 c1049504a0e29d2b35ecd83f747f4770551e29f70c4a5a4728eb9ce478bc1bdd
SHA512 f4667698081aef6a6629d19c28704a5b834924402c299bf0a3827e6d6982573494ec88327b6c6462e1b35bc27194f36975faef6063ec9f92f18d323d15508079

C:\Users\Admin\AppData\Roaming\nan0.exe

MD5 2c50b3d8a2cfa624f33c5b87f212b9b6
SHA1 5fd68f0d0822bcfbd7e59f2a89b40a063da52d1b
SHA256 7b82f469a8d338a29b7ebe581bd0002d89023243614477d49cb0911df6a7b018
SHA512 a2990025b726556f7f2b8e9d96c1678d6abe2b7b8d6acf0851daa06b2d8f898fdd95d50bba4be060892cc371d518a6cc09660eabc740beab0c76460ee05267b3

memory/728-47-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

memory/728-48-0x0000000000150000-0x0000000000586000-memory.dmp

memory/1160-49-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

memory/1928-50-0x0000000000700000-0x00000000007C0000-memory.dmp

memory/1928-52-0x0000000074780000-0x0000000074F30000-memory.dmp

memory/1928-51-0x0000000005000000-0x0000000005092000-memory.dmp

memory/1928-54-0x0000000005160000-0x0000000005170000-memory.dmp

memory/1928-55-0x0000000005540000-0x0000000005580000-memory.dmp

memory/728-56-0x00007FFA89270000-0x00007FFA89D31000-memory.dmp

memory/1928-58-0x0000000005290000-0x0000000005293000-memory.dmp

memory/1312-60-0x0000000000400000-0x0000000000438000-memory.dmp

memory/1928-59-0x00000000052A0000-0x00000000052A3000-memory.dmp

memory/1312-62-0x0000000005260000-0x0000000005804000-memory.dmp

memory/1928-63-0x0000000074780000-0x0000000074F30000-memory.dmp

memory/1312-64-0x0000000074780000-0x0000000074F30000-memory.dmp

memory/1312-65-0x0000000004E90000-0x0000000004F2C000-memory.dmp

memory/1312-66-0x0000000004E20000-0x0000000004E2A000-memory.dmp

memory/1312-69-0x0000000005230000-0x000000000523A000-memory.dmp

memory/1312-70-0x0000000005240000-0x000000000525E000-memory.dmp

memory/2844-72-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1312-73-0x0000000004D00000-0x0000000004D10000-memory.dmp

memory/1312-71-0x0000000005D40000-0x0000000005D4A000-memory.dmp

memory/1312-77-0x00000000068A0000-0x00000000068AC000-memory.dmp

memory/1312-78-0x00000000068B0000-0x00000000068CA000-memory.dmp

memory/1312-79-0x00000000068E0000-0x00000000068EE000-memory.dmp

memory/1312-80-0x00000000068F0000-0x0000000006902000-memory.dmp

memory/1312-81-0x0000000006900000-0x000000000690E000-memory.dmp

memory/1312-82-0x0000000006910000-0x000000000691C000-memory.dmp

memory/1312-83-0x0000000006920000-0x0000000006934000-memory.dmp

memory/1312-84-0x0000000006930000-0x0000000006940000-memory.dmp

memory/1312-85-0x0000000006950000-0x0000000006964000-memory.dmp

memory/1312-86-0x0000000006970000-0x000000000697E000-memory.dmp

memory/1312-87-0x0000000006990000-0x00000000069BE000-memory.dmp

memory/1312-88-0x00000000069C0000-0x00000000069D4000-memory.dmp

memory/1312-89-0x0000000006B80000-0x0000000006BE6000-memory.dmp

memory/1312-92-0x0000000074780000-0x0000000074F30000-memory.dmp

memory/1312-93-0x0000000004D00000-0x0000000004D10000-memory.dmp