Malware Analysis Report

2024-09-11 13:42

Sample ID 240613-31r71awgje
Target d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6
SHA256 d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6
Tags
amadey 8fc809 trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6

Threat Level: Known bad

The file d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6 was found to be: Known bad.

Malicious Activity Summary

amadey 8fc809 trojan

Amadey

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:59

Reported

2024-06-14 00:04

Platform

win7-20240508-en

Max time kernel

297s

Max time network

302s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1260 set thread context of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 2400 set thread context of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 1260 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 2612 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2612 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2612 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2612 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 2400 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe

"C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe"

C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe

"C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 nudump.com udp

Files

memory/2612-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2612-6-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1260-5-0x0000000003BA0000-0x0000000003C0F000-memory.dmp

memory/2612-3-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2612-7-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2612-9-0x0000000000400000-0x0000000000472000-memory.dmp

\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

MD5 a03d121ebc9048f8a74a97f5a920e3e1
SHA1 1f5dc74be89417323898aa34ab1e814fcfa70c7c
SHA256 d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6
SHA512 88b94fc74e757a5229cae397a749185a68ec92b51f44df37c9db4f003fc25aa019d6e88541b905290cebaa9d2efd403826a11e15f51eefd0f090ceb24a261fb9

memory/2612-22-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-30-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-31-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-40-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1260-41-0x0000000000400000-0x0000000002398000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\691908287377

MD5 6898856e85bfdedf7aea905101200ea0
SHA1 e906c7dfd7e112a749acd459bec686cdddf9ac5d
SHA256 98d3c5aec9e77b53634a77cbda29c94b70369369473385c34eab6a5d8deeeb79
SHA512 093d9ca5642c0421dbd39d137e516dca0c0ccc861d1d38e60a030c07d0f37409fab0902b62661337aa3aa4cfbe88de341a5d4832c20566bc8d9417772c0f8597

memory/2744-47-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-53-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-57-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-79-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-86-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2744-92-0x0000000000400000-0x0000000000472000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:59

Reported

2024-06-14 00:04

Platform

win10-20240404-en

Max time kernel

293s

Max time network

260s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3152 set thread context of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 512 set thread context of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 3152 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe
PID 4668 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4668 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4668 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 512 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe

"C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe"

C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe

"C:\Users\Admin\AppData\Local\Temp\d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
RU 91.189.114.21:80 otyt.ru tcp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 21.114.189.91.in-addr.arpa udp
KR 218.152.239.123:80 selltix.org tcp
KR 218.152.239.123:80 selltix.org tcp
KR 210.182.29.70:80 selltix.org tcp
KR 210.182.29.70:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
US 8.8.8.8:53 247.37.122.200.in-addr.arpa udp
US 8.8.8.8:53 nudump.com udp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
RU 91.189.114.21:80 otyt.ru tcp
AR 200.122.37.247:80 selltix.org tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
RU 91.189.114.21:80 otyt.ru tcp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 nudump.com udp
RU 91.189.114.21:80 otyt.ru tcp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
AR 200.122.37.247:80 selltix.org tcp
RU 91.189.114.21:80 otyt.ru tcp
US 8.8.8.8:53 nudump.com udp

Files

memory/3152-1-0x00000000024C0000-0x00000000025C0000-memory.dmp

memory/4668-3-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3152-2-0x0000000004030000-0x000000000409F000-memory.dmp

memory/4668-4-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4668-5-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4668-6-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

MD5 a03d121ebc9048f8a74a97f5a920e3e1
SHA1 1f5dc74be89417323898aa34ab1e814fcfa70c7c
SHA256 d0f40103e93a6d8b232053b1a7d931eb3a3c9fe248a08dcc417753babc81f3f6
SHA512 88b94fc74e757a5229cae397a749185a68ec92b51f44df37c9db4f003fc25aa019d6e88541b905290cebaa9d2efd403826a11e15f51eefd0f090ceb24a261fb9

memory/4668-17-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-21-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-22-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-31-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-32-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\604470191232

MD5 b59ea58f429d75beb08f75b728743523
SHA1 dc83c39a68ceea157b51377ac00d394603581d2e
SHA256 304bbd56ad9a7b9899a30bf8f54bc71b48b800b01ac284714fd6c3aa1f34ed06
SHA512 f81d53df876304f879cad3c8658937876a0b4052ed8771e3e80aec16c541c25bdc2643b04fa470d5135268d173ec4324829f639110c9460e6419a6374c4cfd4d

memory/4960-45-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll

MD5 d47b646093dd84d34885a714ce4bd74e
SHA1 c4df23671b6440e29159093dc52cb8c4aa184597
SHA256 6807c84bf35d67496e020c1528303b87d4759933c09817e514a7159ac689d352
SHA512 906fb89d5ec9dc4338f9d5e26fdc9ccc041225157a8f114465449106128d69e9fbc7723b2bcdd56a17c74c29983f7126a1d970b24e3902a3c4e817834f21f338

memory/4960-54-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-60-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-78-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4960-103-0x0000000000400000-0x0000000000472000-memory.dmp