Malware Analysis Report

2025-08-11 00:31

Sample ID 240311-b4fjtshb37
Target eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748
SHA256 eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748
Tags
upx urelas trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748

Threat Level: Known bad

The file eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748 was found to be: Known bad.

Malicious Activity Summary

upx urelas trojan

UPX dump on OEP (original entry point)

Urelas

Urelas family

UPX dump on OEP (original entry point)

Deletes itself

Executes dropped EXE

Loads dropped DLL

UPX packed file

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-11 01:41

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

Urelas family

urelas

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-11 01:41

Reported

2024-03-11 01:44

Platform

win7-20240221-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe"

Signatures

Urelas

trojan urelas

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\colim.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ivhie.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1964 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\colim.exe
PID 1964 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\colim.exe
PID 1964 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\colim.exe
PID 1964 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\colim.exe
PID 1964 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 1964 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\colim.exe C:\Users\Admin\AppData\Local\Temp\ivhie.exe
PID 2892 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\colim.exe C:\Users\Admin\AppData\Local\Temp\ivhie.exe
PID 2892 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\colim.exe C:\Users\Admin\AppData\Local\Temp\ivhie.exe
PID 2892 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\colim.exe C:\Users\Admin\AppData\Local\Temp\ivhie.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe

"C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe"

C:\Users\Admin\AppData\Local\Temp\colim.exe

"C:\Users\Admin\AppData\Local\Temp\colim.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\ivhie.exe

"C:\Users\Admin\AppData\Local\Temp\ivhie.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/1964-0-0x0000000000400000-0x000000000045E000-memory.dmp

\Users\Admin\AppData\Local\Temp\colim.exe

MD5 f8363ac97200d9510cbf196077ce8c69
SHA1 10959b9d6c193ca3b16387fced5b8c2ec80925d9
SHA256 3d59ea2d464459d8f790ec5b78dc01e4a4f66cdf4aca53cd4814d21f23ec83f2
SHA512 c982c215c20942680a7a481de38a5d9bb0dfe28780bff3751138003cd6fce6f1075b6e4048275b3aed53cabff0c6f7f750a4d0b74d71a9e629d14404c50beb2a

memory/1964-8-0x0000000002C00000-0x0000000002C5E000-memory.dmp

memory/2892-10-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 25bd150d109fb53389a2cf661df68153
SHA1 e91680efee4cc527c342cddecd48a36a82103403
SHA256 dd59bd7184b5c42ece2f987a4b1c1364dbdf49d167cd5801aed11bfa3fe2edf1
SHA512 1c6278dc3ac0557cd2702f3afbd447add58431f20c4ae90366417cbfd99e444b23edca02e099a5b3330d41a49089ca97478931cc262b8795866445645cc822ea

memory/1964-18-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 e6e2b05c43942798e29d08b08dcdd2df
SHA1 e3ed619628ec585d1b58e1fafb5c5f2553648d1d
SHA256 d41f9f1c8a10f8e7b9d4606093cd9294369e6d1e4e10ffee93211b9180a77b54
SHA512 fe06c5dd5241a561b770510295761a686e502a5add072da43824e2c1dc4768bab5e82055939aa94a9322dc9f15c5970778f074245d59290594cf275a0e359098

memory/2892-21-0x0000000000400000-0x000000000045E000-memory.dmp

\Users\Admin\AppData\Local\Temp\ivhie.exe

MD5 bb51fd87f0bd6aa94faa659e618ba842
SHA1 fb962a05671efd8028b49ec7bccc28f43701add0
SHA256 1028ee3236a778f673f6ef83874cf6047a36cbe529a60b2dde535b19fb85f5b5
SHA512 19fb72a3a6f580cc083d2e9a0e57cf209d76c76efe5625dd1aa9cc40de85a719289515eddafad6a2db7948dd7cab8c4b6b160ff69c75d8e4a6677107e2cb42c8

memory/2892-26-0x0000000002580000-0x0000000002611000-memory.dmp

memory/2892-28-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2332-30-0x0000000000980000-0x0000000000A11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\colim.exe

MD5 57cd01ba0b9f5d5dc3575ce4efbfcf47
SHA1 5264d61dc7ef2a2fec71ce4c895aeba140640476
SHA256 9c0bbc23a2bba42d3454545fc88b9932abda40c4acb2188ed123640694a5b1ba
SHA512 cd9e9b83314e2680e7f34a2e2aec59e9ed8e1a2fc85717a504000b0efe470bf0e6343aa3da3f2d9c7ecefa709145d798a161421276bc185c46928fa73e9a738f

memory/2332-33-0x0000000000980000-0x0000000000A11000-memory.dmp

memory/2332-34-0x0000000000980000-0x0000000000A11000-memory.dmp

memory/2332-35-0x0000000000980000-0x0000000000A11000-memory.dmp

memory/2332-36-0x0000000000980000-0x0000000000A11000-memory.dmp

memory/2332-37-0x0000000000980000-0x0000000000A11000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-11 01:41

Reported

2024-03-11 01:44

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe"

Signatures

Urelas

trojan urelas

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\nosit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nosit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\capyj.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1892 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\nosit.exe
PID 1892 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\nosit.exe
PID 1892 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Users\Admin\AppData\Local\Temp\nosit.exe
PID 1892 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe C:\Windows\SysWOW64\cmd.exe
PID 3200 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\nosit.exe C:\Users\Admin\AppData\Local\Temp\capyj.exe
PID 3200 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\nosit.exe C:\Users\Admin\AppData\Local\Temp\capyj.exe
PID 3200 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\nosit.exe C:\Users\Admin\AppData\Local\Temp\capyj.exe

Processes

C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe

"C:\Users\Admin\AppData\Local\Temp\eae1f6609862456c8dbd5e21484a204fc84ab5b48ebb131aa46a4a9368b3d748.exe"

C:\Users\Admin\AppData\Local\Temp\nosit.exe

"C:\Users\Admin\AppData\Local\Temp\nosit.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\capyj.exe

"C:\Users\Admin\AppData\Local\Temp\capyj.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/1892-0-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nosit.exe

MD5 68320299aee7ab92ec40e95f033f3964
SHA1 7bcb2041e08beacfffaf9383aaf583dc941304c4
SHA256 f65a77a54eda638c0bf2e9b40dd47ad30b54f3d8e264110b515519b0dee03dd5
SHA512 50c57e2630d7678f7c0d78c93a7ff72451a3cbbb6005ce84cf72e82b1c0596354694b5b5270217609a5586428f9083d7d4578b0fe5aa0f2083afe485724ec6d0

memory/3200-12-0x0000000000400000-0x000000000045E000-memory.dmp

memory/1892-14-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 25bd150d109fb53389a2cf661df68153
SHA1 e91680efee4cc527c342cddecd48a36a82103403
SHA256 dd59bd7184b5c42ece2f987a4b1c1364dbdf49d167cd5801aed11bfa3fe2edf1
SHA512 1c6278dc3ac0557cd2702f3afbd447add58431f20c4ae90366417cbfd99e444b23edca02e099a5b3330d41a49089ca97478931cc262b8795866445645cc822ea

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 4749254221d314690f003206a386b614
SHA1 2585b79a6a8df7dd181bddc80d931dd18875fedd
SHA256 db7b1d0149e6e4d84972056bfd88adc83b4d7233da53fbb97260f78bdb65bca4
SHA512 e4040adf1fc9ab782e7cd4fbd42c52f28fb9d384a83bad4b8928e955bbd65dee63b54e491edd0855227f645f1c6b68f5826b51fe45ceb05fa5d2b9cd1e257f55

memory/3200-17-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\capyj.exe

MD5 4d3b2458e34a7379220b397e9569df91
SHA1 536ea53a668fb349b1698dababa198b9f4cb701f
SHA256 ba4559fe75a96473f4796f1c3e1507271ddd903cb9205f1cc07dfa6de0910b69
SHA512 b8d3679aefecd8544561bd15fcbc508abce132ac53c16ba5fd6f26f4fdedbc5342d2b57ba0a0b285700a98826d9d38704a4d5dc302e62648d45bb89379130713

memory/3204-26-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3200-27-0x0000000000400000-0x000000000045E000-memory.dmp

memory/3204-28-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3204-30-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3204-31-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3204-32-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3204-33-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3204-34-0x0000000000B70000-0x0000000000C01000-memory.dmp

memory/3204-35-0x0000000000B70000-0x0000000000C01000-memory.dmp