Malware Analysis Report

2025-08-11 00:31

Sample ID 240310-1tn6nace59
Target 6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee
SHA256 6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee
Tags
urelas trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee

Threat Level: Known bad

The file 6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee was found to be: Known bad.

Malicious Activity Summary

urelas trojan

Urelas family

Urelas

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Deletes itself

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-10 21:56

Signatures

Urelas family

urelas

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-10 21:56

Reported

2024-03-10 21:59

Platform

win7-20231129-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dyrea.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\noguh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 948 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\dyrea.exe
PID 948 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\dyrea.exe
PID 948 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\dyrea.exe
PID 948 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\dyrea.exe
PID 948 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 948 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 948 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 948 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 2340 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\dyrea.exe C:\Users\Admin\AppData\Local\Temp\noguh.exe
PID 2340 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\dyrea.exe C:\Users\Admin\AppData\Local\Temp\noguh.exe
PID 2340 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\dyrea.exe C:\Users\Admin\AppData\Local\Temp\noguh.exe
PID 2340 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\dyrea.exe C:\Users\Admin\AppData\Local\Temp\noguh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe

"C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe"

C:\Users\Admin\AppData\Local\Temp\dyrea.exe

"C:\Users\Admin\AppData\Local\Temp\dyrea.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\noguh.exe

"C:\Users\Admin\AppData\Local\Temp\noguh.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/948-0-0x0000000000940000-0x00000000009C5000-memory.dmp

\Users\Admin\AppData\Local\Temp\dyrea.exe

MD5 70031312a8db672b51804bfe2af57cf0
SHA1 6f630a7e16fab19bbd7c419a57e3ba5244200c42
SHA256 b9e39ce25d28d62d43dda2847f32cd2eaac737564c2f2d8aec91660bdb87d68c
SHA512 a36ccd055f51871afdee64aeb29005ab2d7e4043e99e8271ffbb7f5a87fefbfb185f765bc0d30bb9594876a02735b829701679982a7f63c9af54078be18d473c

memory/2340-9-0x0000000000FE0000-0x0000000001065000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 fbb9e6fa9d9aba36212379a340f155a0
SHA1 17c9a13635ed2e164f34eb277b2956e25e1b3104
SHA256 d0f4d264decea9079ac02fa1e07785d1045be65ee8fb063666b020853bf85eff
SHA512 f375ca7e85339e85139e3a940b38c0af14c1ae19e694481dade54055f2361b01b2bfe4badc9b5d0ffa834b29dc882d3dc690e28bd9031ba1d48bfd03a24d6bac

memory/948-17-0x0000000000940000-0x00000000009C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 ac4451cdaed6b118005cb283e5450f4d
SHA1 95d7f96d06b9b4123a5a68cc8773aa9e0213743b
SHA256 6697531f92a344acd8bac120bb5322e8f21d0ea65480a5ecd99313d268598a27
SHA512 a38236b908d47be11e062b35d555bf4a738d358d7ae73cf5030f6f3118ca543bb03d62c2e41d11f219367f15f3596695b91082839c09b127fdda7397a6e11ad4

C:\Users\Admin\AppData\Local\Temp\noguh.exe

MD5 35ca41b3c4c54d5261258259a81439a2
SHA1 16027a2792d9b0a5faca514b389327539782c496
SHA256 50f48939c8697cc5662255d233ddeacfb6a4703acc9b8a0fd71ecae55536e43c
SHA512 3cc3870be2a1eb2ef006efc91fdf9ec1e3ac86848b0b944effb5d85abf4cbf26140691fb5b1716d595a6e2c3b2acf389a9d697e173b5dc001f91d355de49c47d

memory/1708-27-0x0000000000250000-0x0000000000304000-memory.dmp

memory/2340-25-0x0000000000FE0000-0x0000000001065000-memory.dmp

memory/1708-28-0x0000000000180000-0x0000000000182000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dyrea.exe

MD5 0b4ffa8532abc8e9b14b205eff6bcbc0
SHA1 b4a2add593a2da09a9575356b5591c9933618783
SHA256 a812d315086e74ba49063bcb6b621fbe8a68164dc4ea3b047ab7636be26d502c
SHA512 e4bfb04bcb2306cfda8c29a72d0e345a1525805d4a4afe22408fb83bd62b062369869334fae9952657f76df5be4b36c0fcf4188719bfe6c6bdbb223d81c810a1

memory/1708-31-0x0000000000250000-0x0000000000304000-memory.dmp

memory/1708-32-0x0000000000250000-0x0000000000304000-memory.dmp

memory/1708-33-0x0000000000250000-0x0000000000304000-memory.dmp

memory/1708-34-0x0000000000250000-0x0000000000304000-memory.dmp

memory/1708-35-0x0000000000250000-0x0000000000304000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-10 21:56

Reported

2024-03-10 21:59

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\obtoy.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\obtoy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\duhyp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4660 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\obtoy.exe
PID 4660 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\obtoy.exe
PID 4660 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Users\Admin\AppData\Local\Temp\obtoy.exe
PID 4660 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 4660 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 4660 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\obtoy.exe C:\Users\Admin\AppData\Local\Temp\duhyp.exe
PID 1952 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\obtoy.exe C:\Users\Admin\AppData\Local\Temp\duhyp.exe
PID 1952 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\obtoy.exe C:\Users\Admin\AppData\Local\Temp\duhyp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe

"C:\Users\Admin\AppData\Local\Temp\6b5ceef5225f59130c5175bba37e0d89c7bc223e82a29243c1b2dfc8c07f87ee.exe"

C:\Users\Admin\AppData\Local\Temp\obtoy.exe

"C:\Users\Admin\AppData\Local\Temp\obtoy.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\duhyp.exe

"C:\Users\Admin\AppData\Local\Temp\duhyp.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 210.135.221.88.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 42.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/4660-0-0x0000000000240000-0x00000000002C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\obtoy.exe

MD5 760bec4fe4aff4bf2cbb32da856b1f6d
SHA1 6cb3e5af41476c8b98378867f260bb0f0df7b737
SHA256 f5b2f86899918fca35c38d7226246b6fa0dddc15788054b20a10b1b1aa553877
SHA512 9def0d0d00b8b4b081e09c0c8b383c7a6d94cf9bd5deef4513ed9a989a35cb33304cccda5d1fc389c84df743a65065dcd5ca62816359359d6f36f318704fa444

memory/1952-11-0x0000000000FF0000-0x0000000001075000-memory.dmp

memory/4660-14-0x0000000000240000-0x00000000002C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 fbb9e6fa9d9aba36212379a340f155a0
SHA1 17c9a13635ed2e164f34eb277b2956e25e1b3104
SHA256 d0f4d264decea9079ac02fa1e07785d1045be65ee8fb063666b020853bf85eff
SHA512 f375ca7e85339e85139e3a940b38c0af14c1ae19e694481dade54055f2361b01b2bfe4badc9b5d0ffa834b29dc882d3dc690e28bd9031ba1d48bfd03a24d6bac

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 1b4da99f97587cd63f190b8cdc5f2104
SHA1 a2c5857a6b6e27dc2dfa0da2a7e0089a05c30a4d
SHA256 4e818b47e890590c58b1ea6404b35f48c35699036ec0e46f490e320c50a9f163
SHA512 9e2e779f1ecb01a1913345d712e1ecfebf82296e6ee1d9b358a4ad142694731b5f75b59d884093864d5551d765af17b8e39b16a9acfe50701724494d57038a26

C:\Users\Admin\AppData\Local\Temp\duhyp.exe

MD5 8c190d0faa01ae57d34a1ecfd925f5f7
SHA1 a002de0c81caf205c16ed7d0c037f5d39c15d7ad
SHA256 042b0d2ea855aaa7431fdc2700c92ebcf0b07bfd083126fbe9e02d4c3859a175
SHA512 dd6ca18161dc820a875f652f662c695659c618cfd1bbe1c0e2fd0eb760298b1369216d9de99f81e5ade714f08d16d04bbf3374fcb89d983c300a16b5c40fb824

memory/1952-26-0x0000000000FF0000-0x0000000001075000-memory.dmp

memory/784-25-0x0000000000980000-0x0000000000A34000-memory.dmp

memory/784-27-0x0000000000970000-0x0000000000972000-memory.dmp

memory/784-29-0x0000000000980000-0x0000000000A34000-memory.dmp

memory/784-30-0x0000000000980000-0x0000000000A34000-memory.dmp

memory/784-31-0x0000000000980000-0x0000000000A34000-memory.dmp

memory/784-32-0x0000000000980000-0x0000000000A34000-memory.dmp

memory/784-33-0x0000000000980000-0x0000000000A34000-memory.dmp