Malware Analysis Report

2024-08-06 17:12

Sample ID 240416-s5v5cadh46
Target f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118
SHA256 87f6887fa47e3e48630a5a46fce5a7470a39dc21a3ac79bdd837ea5b754b6e86
Tags
upx darkcomet guest16 rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

87f6887fa47e3e48630a5a46fce5a7470a39dc21a3ac79bdd837ea5b754b6e86

Threat Level: Known bad

The file f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

upx darkcomet guest16 rat trojan

Darkcomet

Drops file in Drivers directory

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-16 15:43

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-16 15:43

Reported

2024-04-16 15:45

Platform

win7-20231129-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 1540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 1540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 1540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 1540 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE
PID 1540 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE
PID 1540 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE
PID 1540 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\NOEX.EXE

"C:\Users\Admin\AppData\Local\Temp\NOEX.EXE"

C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE

"C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE"

Network

Country Destination Domain Proto
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

memory/1540-0-0x0000000000EB0000-0x0000000000F07000-memory.dmp

\Users\Admin\AppData\Local\Temp\NOEX.EXE

MD5 dc36da2cd96de2ed728f0c022762fde9
SHA1 27de7fa207f71a82f3a2083c7f65f7d3d54b4978
SHA256 b5fae89919b12cd6a4e3966d67a9937a63053a4a78dad7884038bc2c2180a73c
SHA512 8b8249a86d4e6c8191edfb6da5a4aab5aae50df7afc7e18331367f439dc48192e22765202469b0c46955d586293c19f39593aec59ded7dfbabd18ad7273a9a91

memory/1540-10-0x0000000002B30000-0x0000000002BE5000-memory.dmp

memory/3008-19-0x00000000009F0000-0x0000000000A70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE

MD5 23b692383aa2c8bdba068694d9296eef
SHA1 24ffb9ba1af0be8cf5bd85880de1cba78a1f8cf2
SHA256 661b8d0821529be59be266f6b6f35190213dcbd2769da69de23485ef5a0eab5e
SHA512 ac5c3c4ed05eb53667c29e0f6e28603ee89074f27e6ed323b38b993f7af5243162e19e7a06a89b3a8edbf9a3eeec6510d69bc9b4d62a3000ffc166d4f2183ac2

memory/2188-16-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/1540-14-0x0000000000EB0000-0x0000000000F07000-memory.dmp

memory/3008-21-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

memory/2188-22-0x0000000000360000-0x0000000000361000-memory.dmp

memory/3008-23-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

memory/3008-24-0x00000000009F0000-0x0000000000A70000-memory.dmp

memory/2188-25-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3008-26-0x00000000009F0000-0x0000000000A70000-memory.dmp

memory/3008-27-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

memory/3008-29-0x00000000009F0000-0x0000000000A70000-memory.dmp

memory/2188-31-0x0000000000400000-0x00000000004B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-16 15:43

Reported

2024-04-16 15:45

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NOEX.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 868 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 868 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 868 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\NOEX.EXE
PID 868 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE
PID 868 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f3cc6afc6f9cd465907bdffbf02871be_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\NOEX.EXE

"C:\Users\Admin\AppData\Local\Temp\NOEX.EXE"

C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE

"C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
NL 23.62.61.147:443 www.bing.com tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 147.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

memory/868-0-0x00000000001C0000-0x0000000000217000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NOEX.EXE

MD5 dc36da2cd96de2ed728f0c022762fde9
SHA1 27de7fa207f71a82f3a2083c7f65f7d3d54b4978
SHA256 b5fae89919b12cd6a4e3966d67a9937a63053a4a78dad7884038bc2c2180a73c
SHA512 8b8249a86d4e6c8191edfb6da5a4aab5aae50df7afc7e18331367f439dc48192e22765202469b0c46955d586293c19f39593aec59ded7dfbabd18ad7273a9a91

memory/3688-21-0x0000000000400000-0x00000000004B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WINDOWSFORMSAPPLICATION2.EXE

MD5 23b692383aa2c8bdba068694d9296eef
SHA1 24ffb9ba1af0be8cf5bd85880de1cba78a1f8cf2
SHA256 661b8d0821529be59be266f6b6f35190213dcbd2769da69de23485ef5a0eab5e
SHA512 ac5c3c4ed05eb53667c29e0f6e28603ee89074f27e6ed323b38b993f7af5243162e19e7a06a89b3a8edbf9a3eeec6510d69bc9b4d62a3000ffc166d4f2183ac2

memory/868-24-0x00000000001C0000-0x0000000000217000-memory.dmp

memory/3688-26-0x0000000002190000-0x0000000002191000-memory.dmp

memory/752-28-0x000000001B710000-0x000000001BBDE000-memory.dmp

memory/752-27-0x00007FFF3FDD0000-0x00007FFF40771000-memory.dmp

memory/752-29-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

memory/752-30-0x000000001B160000-0x000000001B1FC000-memory.dmp

memory/752-31-0x00007FFF3FDD0000-0x00007FFF40771000-memory.dmp

memory/752-32-0x0000000000B80000-0x0000000000B88000-memory.dmp

memory/752-33-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

memory/3688-34-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3688-35-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/752-36-0x00007FFF3FDD0000-0x00007FFF40771000-memory.dmp

memory/752-37-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

memory/752-38-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

memory/3688-43-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3688-44-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3688-45-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3688-47-0x0000000000400000-0x00000000004B5000-memory.dmp