Malware Analysis Report

2024-12-07 21:20

Sample ID 240212-nypa1aeb87
Target 971548addc373b70e70c748ddb279cfd
SHA256 215b3350b74a68b685582e93b42c4763c6626df94cc2243281bf997d7d83d581
Tags
upx xtremerat persistence rat spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

215b3350b74a68b685582e93b42c4763c6626df94cc2243281bf997d7d83d581

Threat Level: Known bad

The file 971548addc373b70e70c748ddb279cfd was found to be: Known bad.

Malicious Activity Summary

upx xtremerat persistence rat spyware

Detect XtremeRAT payload

XtremeRAT

UPX packed file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-12 11:48

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-12 11:48

Reported

2024-02-12 11:51

Platform

win7-20231215-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\372mYNET.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchostei.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU Key = "C:\\Users\\Admin\\AppData\\Roaming\\svchostei.exe" C:\Users\Admin\AppData\Roaming\svchostei.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM Key = "C:\\Users\\Admin\\AppData\\Roaming\\svchostei.exe" C:\Users\Admin\AppData\Roaming\svchostei.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\zorluadm.dll C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A
File created C:\Windows\SysWOW64\372mYNET.EXE.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A
File created C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 776 set thread context of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 776 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2284 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 2284 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 2284 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 2284 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 2284 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 2284 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 2284 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 2676 wrote to memory of 2992 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe
PID 2676 wrote to memory of 2992 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe
PID 2676 wrote to memory of 2992 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe
PID 2676 wrote to memory of 2992 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe

Processes

C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

"C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe"

C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\372mYNET.EXE

"C:\Windows\system32\372mYNET.EXE"

C:\Users\Admin\AppData\Roaming\svchostei.exe

"C:\Users\Admin\AppData\Roaming\svchostei.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 stabilhayko.no-ip.org udp

Files

memory/776-0-0x0000000000400000-0x0000000000506800-memory.dmp

\Windows\SysWOW64\zorluadm.dll

MD5 df5c622697dc8c743f3884914a9e4d99
SHA1 cdfc6345080dfa9c45d323f15532ad9274385d2f
SHA256 0ca52bc5cf854e274e15ba07df97b2e75ec4e1fc2d90f23676da7fa3c95da089
SHA512 59867bb9608c250661a6eb823f06c907d334eb4f638b04f21cf10213e5163035c37261f5213642c703dd382871a5d3ae764839c1b93e18e833d85ac0e3409f90

memory/2284-6-0x0000000010000000-0x000000001004D000-memory.dmp

memory/776-11-0x0000000000400000-0x0000000000506800-memory.dmp

memory/2284-10-0x0000000010000000-0x000000001004D000-memory.dmp

memory/2284-9-0x0000000000400000-0x0000000000506800-memory.dmp

memory/776-8-0x0000000002E50000-0x0000000002F57000-memory.dmp

memory/2284-7-0x0000000010000000-0x000000001004D000-memory.dmp

memory/2284-12-0x0000000010000000-0x000000001004D000-memory.dmp

memory/2144-13-0x0000000010000000-0x000000001004D000-memory.dmp

memory/2144-15-0x0000000010000000-0x000000001004D000-memory.dmp

\Windows\SysWOW64\372mYNET.EXE

MD5 6752d654cbaf37dc2ca6539019f62ba3
SHA1 1db60d9831fa818a39b60b6843f2dc431110ca4c
SHA256 1021676e9ed6507fe9d814b2b65fc613812fc3e89fbf7b17ba06f792663a985f
SHA512 2d595f14a0b16218176f5916960184d8dd2b51bf040086d3b8c2bff93c08159973bd3d40ff7c6de9206780e9b7d1bd9a4fcd9d206aa42548d84e3aadca254c2f

memory/2284-26-0x0000000010000000-0x000000001004D000-memory.dmp

memory/2144-37-0x0000000010000000-0x000000001004D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-12 11:48

Reported

2024-02-12 11:51

Platform

win10v2004-20231222-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe"

Signatures

Detect XtremeRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XtremeRAT

persistence spyware rat xtremerat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\372mYNET.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\372mYNET.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchostei.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU Key = "C:\\Users\\Admin\\AppData\\Roaming\\svchostei.exe" C:\Users\Admin\AppData\Roaming\svchostei.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM Key = "C:\\Users\\Admin\\AppData\\Roaming\\svchostei.exe" C:\Users\Admin\AppData\Roaming\svchostei.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\zorluadm.dll C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A
File created C:\Windows\SysWOW64\372mYNET.EXE.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A
File created C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2380 set thread context of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 2380 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe
PID 4944 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 4944 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 4944 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 4944 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\svchost.exe
PID 4944 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4944 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4944 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4944 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 4944 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 4944 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe C:\Windows\SysWOW64\372mYNET.EXE
PID 4728 wrote to memory of 208 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe
PID 4728 wrote to memory of 208 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe
PID 4728 wrote to memory of 208 N/A C:\Windows\SysWOW64\372mYNET.EXE C:\Users\Admin\AppData\Roaming\svchostei.exe

Processes

C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

"C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe"

C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

C:\Users\Admin\AppData\Local\Temp\971548addc373b70e70c748ddb279cfd.exe

C:\Windows\SysWOW64\svchost.exe

svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4080 -ip 4080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4080 -ip 4080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 488

C:\Windows\SysWOW64\372mYNET.EXE

"C:\Windows\system32\372mYNET.EXE"

C:\Users\Admin\AppData\Roaming\svchostei.exe

"C:\Users\Admin\AppData\Roaming\svchostei.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 stabilhayko.no-ip.org udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 stabilhayko.no-ip.org udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 stabilhayko.no-ip.org udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 stabilhayko.no-ip.org udp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp

Files

memory/2380-0-0x0000000000400000-0x0000000000506800-memory.dmp

C:\Windows\SysWOW64\zorluadm.dll

MD5 df5c622697dc8c743f3884914a9e4d99
SHA1 cdfc6345080dfa9c45d323f15532ad9274385d2f
SHA256 0ca52bc5cf854e274e15ba07df97b2e75ec4e1fc2d90f23676da7fa3c95da089
SHA512 59867bb9608c250661a6eb823f06c907d334eb4f638b04f21cf10213e5163035c37261f5213642c703dd382871a5d3ae764839c1b93e18e833d85ac0e3409f90

memory/4944-7-0x0000000010000000-0x000000001004D000-memory.dmp

memory/4944-8-0x0000000010000000-0x000000001004D000-memory.dmp

memory/4944-10-0x0000000010000000-0x000000001004D000-memory.dmp

memory/2380-9-0x0000000000400000-0x0000000000506800-memory.dmp

memory/4944-11-0x0000000010000000-0x000000001004D000-memory.dmp

memory/4080-12-0x0000000010000000-0x000000001004D000-memory.dmp

C:\Windows\SysWOW64\372mYNET.EXE

MD5 6752d654cbaf37dc2ca6539019f62ba3
SHA1 1db60d9831fa818a39b60b6843f2dc431110ca4c
SHA256 1021676e9ed6507fe9d814b2b65fc613812fc3e89fbf7b17ba06f792663a985f
SHA512 2d595f14a0b16218176f5916960184d8dd2b51bf040086d3b8c2bff93c08159973bd3d40ff7c6de9206780e9b7d1bd9a4fcd9d206aa42548d84e3aadca254c2f

memory/4944-23-0x0000000010000000-0x000000001004D000-memory.dmp

memory/4080-21-0x0000000010000000-0x000000001004D000-memory.dmp