Malware Analysis Report

2025-04-14 01:40

Sample ID 240602-2gb61aae89
Target 2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c
SHA256 2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c

Threat Level: Shows suspicious behavior

The file 2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 22:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 22:32

Reported

2024-06-02 22:35

Platform

win7-20240221-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717367570" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717367570" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe

"C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/2320-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 24dd3f31e0a915dd4acb281f21ccf3d0
SHA1 71170266d761953ebd7a7479718705367f7b98eb
SHA256 fd2198baae45e2c7944d2ad5f21987464bc36f97682145701be7a6144395227b
SHA512 b7ac7b293d4374f4ecbdcd8772936674dc5de74bbed1a4b01f8920a0f72ddb52b79de0c20d2f9d0fbdc8207da19334d1db872a42526b249f851574e66ed78a78

\Windows\system\rundll32.exe

MD5 bdb0a7d5f2f9c8cd1a0a875326bb922d
SHA1 e90a3606d3b8bd726d8f121c238e74ec0156a0ce
SHA256 f117b229e5f6215e026da28c9fa5819908b0c6c14f6fd348c10a5020e95f89dd
SHA512 1eeeee66a33031a1e599bbb46d4729747da98a3b73cee0b4b8927783c50065a21883213489a9ab831a44004e0fb249db12b107fc713509b888bd1446fbd57bf6

memory/2320-12-0x0000000000380000-0x0000000000396000-memory.dmp

memory/2956-20-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/2320-19-0x0000000000380000-0x0000000000396000-memory.dmp

memory/2320-21-0x0000000000400000-0x0000000000415A00-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 22:32

Reported

2024-06-02 22:35

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717367572" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717367572" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe

"C:\Users\Admin\AppData\Local\Temp\2ef260bf06cfd68d6c26d791fa46b3f769a65ac27fdc3616b7f372614861087c.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/2692-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 e4414fb273fae78dafed1ccfa2d87a58
SHA1 4589eeed2145515b591d79e9ad8a525fcaa504c8
SHA256 e053d005cd1bfd6b36a759876b5fff9445171b2a4dcf7a0280aba99692fabb0f
SHA512 e17fef7af9309b745cfe647e16f7cb11dca664de1d533412205e868eec0138b3ed1c8046f9b17bf2ec509dcef52fe670a31347d43ff415312fe0ba71f53dd723

memory/4120-13-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\system\rundll32.exe

MD5 9565281511126d767eddfe452ac6f93c
SHA1 85758c2e563e57b6654ac03a1c8425f58ea1f81c
SHA256 6c78d1250169da40827cae8e51348f45e1e95b8dfa1a1b24948160acee8bbed9
SHA512 35ea14303909d07892b7390fd32d2c999ea14ccb78344ae0c33eeac48234e4a85f7605484acaed8ffe7dd642884dfc40caf31881f9fba611fe1eafbd6bfef388

memory/2692-14-0x0000000000400000-0x0000000000415A00-memory.dmp