Malware Analysis Report

2024-10-23 16:28

Sample ID 240416-a77xtaeh2w
Target f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118
SHA256 064748a64b3e6198f3f9b3821f8aa4b74ee9d687503a1e9ded2926308a86517f
Tags
tofsee evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

064748a64b3e6198f3f9b3821f8aa4b74ee9d687503a1e9ded2926308a86517f

Threat Level: Known bad

The file f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

tofsee evasion persistence trojan

Windows security bypass

Tofsee

Creates new service(s)

Modifies Windows Firewall

Sets service image path in registry

Executes dropped EXE

Deletes itself

Checks computer location settings

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-16 00:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-16 00:52

Reported

2024-04-16 00:54

Platform

win7-20240221-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\pnuednnm = "0" C:\Windows\SysWOW64\svchost.exe N/A

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\pnuednnm\ImagePath = "C:\\Windows\\SysWOW64\\pnuednnm\\xgwklzou.exe" C:\Windows\SysWOW64\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2992 set thread context of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1356 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1356 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1356 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1356 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1356 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1356 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2992 wrote to memory of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe
PID 2992 wrote to memory of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe
PID 2992 wrote to memory of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe
PID 2992 wrote to memory of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe
PID 2992 wrote to memory of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe
PID 2992 wrote to memory of 2676 N/A C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pnuednnm\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xgwklzou.exe" C:\Windows\SysWOW64\pnuednnm\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create pnuednnm binPath= "C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description pnuednnm "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start pnuednnm

C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe

C:\Windows\SysWOW64\pnuednnm\xgwklzou.exe /d"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 52.101.42.0:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 98.136.96.91:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 74.125.128.26:25 smtp.google.com tcp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp

Files

memory/1356-1-0x0000000000250000-0x0000000000350000-memory.dmp

memory/1356-2-0x00000000003C0000-0x00000000003D3000-memory.dmp

memory/1356-3-0x0000000000400000-0x000000000046D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xgwklzou.exe

MD5 7f53a36ea851fea6d57d9230c93817e2
SHA1 9155c8bb26ea09fefa7505195dd140200f449138
SHA256 1859e848a83e4c4d9a7338f56d073b1a375f429d64563ebb2aa960b371d66c3f
SHA512 c20fd723e959be1315eada69b9edc1053d201eafd22f885d7b6c092c3ab221aa81fcb0b823354f6a26e65dbb7d1f2b8a80e96163350a1848710229e3aede4e01

memory/1356-7-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1356-9-0x00000000003C0000-0x00000000003D3000-memory.dmp

memory/2992-10-0x0000000000610000-0x0000000000710000-memory.dmp

memory/2676-11-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2992-12-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2676-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2676-15-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2992-16-0x0000000000400000-0x000000000046D000-memory.dmp

memory/2676-20-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2676-21-0x0000000000080000-0x0000000000095000-memory.dmp

memory/2676-22-0x0000000000080000-0x0000000000095000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-16 00:52

Reported

2024-04-16 00:54

Platform

win10v2004-20240412-en

Max time kernel

146s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe"

Signatures

Tofsee

trojan tofsee

Creates new service(s)

persistence

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bunksdbo\ImagePath = "C:\\Windows\\SysWOW64\\bunksdbo\\yqzherdx.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3880 set thread context of 5068 N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe C:\Windows\SysWOW64\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 868 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 868 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 868 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 868 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3880 wrote to memory of 5068 N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe C:\Windows\SysWOW64\svchost.exe
PID 3880 wrote to memory of 5068 N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe C:\Windows\SysWOW64\svchost.exe
PID 3880 wrote to memory of 5068 N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe C:\Windows\SysWOW64\svchost.exe
PID 3880 wrote to memory of 5068 N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe C:\Windows\SysWOW64\svchost.exe
PID 3880 wrote to memory of 5068 N/A C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bunksdbo\

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yqzherdx.exe" C:\Windows\SysWOW64\bunksdbo\

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" create bunksdbo binPath= "C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" description bunksdbo "wifi internet conection"

C:\Windows\SysWOW64\sc.exe

"C:\Windows\System32\sc.exe" start bunksdbo

C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe

C:\Windows\SysWOW64\bunksdbo\yqzherdx.exe /d"C:\Users\Admin\AppData\Local\Temp\f2500e9a3134b4790760b2ef60c0144b_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

C:\Windows\SysWOW64\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 microsoft.com udp
US 20.112.250.133:80 microsoft.com tcp
US 8.8.8.8:53 microsoft.com udp
US 8.8.8.8:53 microsoft-com.mail.protection.outlook.com udp
US 104.47.53.36:25 microsoft-com.mail.protection.outlook.com tcp
US 8.8.8.8:53 133.250.112.20.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 8.8.8.8:53 mta6.am0.yahoodns.net udp
US 67.195.228.109:25 mta6.am0.yahoodns.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 smtp.google.com udp
NL 74.125.128.26:25 smtp.google.com tcp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 mail.ru udp
US 8.8.8.8:53 mxs.mail.ru udp
RU 94.100.180.31:25 mxs.mail.ru tcp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 refabyd.info udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp
US 8.8.8.8:53 defeatwax.ru udp

Files

memory/868-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

memory/868-2-0x0000000002070000-0x0000000002083000-memory.dmp

memory/868-4-0x0000000000400000-0x000000000046D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yqzherdx.exe

MD5 1c9e17089fc5153538255a5a42877db3
SHA1 a551b4a07a44ff766d584f77b448d3d705f06d77
SHA256 67aa33017e5798bc67b434b573ef8b04f1fad4671fea6303fde4381c9e457695
SHA512 a125eefe402cc246f310bdc8e2e846f66e07d27a0e02463af302e82db09977484be1e133629adbfb976258108c2b43f9e2a332eee23c78901d1f091efe1f3010

memory/3880-8-0x00000000004D0000-0x00000000005D0000-memory.dmp

memory/3880-9-0x00000000005F0000-0x0000000000603000-memory.dmp

memory/5068-10-0x0000000000FC0000-0x0000000000FD5000-memory.dmp

memory/3880-11-0x0000000000400000-0x000000000046D000-memory.dmp

memory/5068-14-0x0000000000FC0000-0x0000000000FD5000-memory.dmp

memory/868-15-0x0000000000400000-0x000000000046D000-memory.dmp

memory/5068-16-0x0000000000FC0000-0x0000000000FD5000-memory.dmp

memory/5068-17-0x0000000000FC0000-0x0000000000FD5000-memory.dmp

memory/3880-18-0x0000000000400000-0x000000000046D000-memory.dmp

memory/868-23-0x00000000005B0000-0x00000000006B0000-memory.dmp

memory/5068-25-0x0000000000FC0000-0x0000000000FD5000-memory.dmp