Malware Analysis Report

2024-09-11 14:31

Sample ID 240619-y4l3yavajq
Target 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4
SHA256 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4
Tags
amadey 8fc809 trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4

Threat Level: Known bad

The file 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4 was found to be: Known bad.

Malicious Activity Summary

amadey 8fc809 trojan

Amadey

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-19 20:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 20:20

Reported

2024-06-19 20:23

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"

Signatures

Amadey

trojan amadey

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4968 set thread context of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4448 set thread context of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 set thread context of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 set thread context of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4968 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 1752 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1752 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1752 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4448 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4944 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 3520 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"

C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 nudump.com udp

Files

memory/4968-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

memory/4968-2-0x0000000000520000-0x000000000058F000-memory.dmp

memory/1752-3-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1752-4-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1752-5-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1752-6-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

MD5 efccb8ebc3cee38b7656617bd1b670ad
SHA1 6754e5a59ff6c2e569d61bd400e50beccc86f81b
SHA256 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4
SHA512 6b9acfb5c7edd0dced0fc4358faa291a608ed5da1412f92b613a025ed462b9b9fb83e27d3f430f25cbf86a4d33032b573919faa8493981d2d4153fbf4ef6706e

memory/1752-20-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4448-26-0x0000000000400000-0x0000000000474000-memory.dmp

memory/4896-29-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4896-30-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4448-28-0x0000000000400000-0x0000000000474000-memory.dmp

memory/4896-27-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4896-31-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4896-40-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\124900551406

MD5 5176105db85c14dbaeba822bf6f6d572
SHA1 f42fbebc760556c329e71b593aed974eca04042b
SHA256 e25d058d8b54dfeb653caae9fa5075dbaa01d3b11329a0ae26874798157191ca
SHA512 3f0c55f6d3f38f3d2f0796f44dc2ef2fb1f6ed3998e40388f0d901cd11312f72d791f308bb76695dab85cc209a0fed41cb5a6bfcec8027a1b6accd621e38d529

memory/4896-45-0x0000000000400000-0x0000000000472000-memory.dmp

memory/60-57-0x0000000000400000-0x0000000000472000-memory.dmp

memory/60-58-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4896-60-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3664-70-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3664-71-0x0000000000400000-0x0000000000472000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 20:20

Reported

2024-06-19 20:23

Platform

win11-20240419-en

Max time kernel

143s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4120 set thread context of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4060 set thread context of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 set thread context of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 set thread context of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 4120 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe
PID 1108 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1108 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1108 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 4060 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 1044 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
PID 8 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"

C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe

"C:\Users\Admin\AppData\Local\Temp\2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 selltix.org udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 otyt.ru udp
US 8.8.8.8:53 nudump.com udp

Files

memory/4120-1-0x0000000000770000-0x0000000000870000-memory.dmp

memory/1108-2-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4120-4-0x00000000006E0000-0x000000000074F000-memory.dmp

memory/1108-5-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1108-6-0x0000000000400000-0x0000000000472000-memory.dmp

memory/1108-3-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

MD5 efccb8ebc3cee38b7656617bd1b670ad
SHA1 6754e5a59ff6c2e569d61bd400e50beccc86f81b
SHA256 2b8547bf6bdafef07f9624d47a541a9734c39ae4c0c2ada330031c30d39826b4
SHA512 6b9acfb5c7edd0dced0fc4358faa291a608ed5da1412f92b613a025ed462b9b9fb83e27d3f430f25cbf86a4d33032b573919faa8493981d2d4153fbf4ef6706e

memory/1108-22-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4060-25-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2612-28-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2612-30-0x0000000000400000-0x0000000000472000-memory.dmp

memory/4060-29-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2612-31-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2612-32-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2612-41-0x0000000000400000-0x0000000000472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\474490143322

MD5 2b46cecf0f8852ef966a58bc0a9e17e2
SHA1 d02fe3d9a7be78087d2bdd0df99b020059be7236
SHA256 79f7386963c690ea71a5033e12a0a212a7bd79d81d759a791e26887fc41db73b
SHA512 7389ee945f5b66053b384f12a65976afa2c7a8bddeb697c86a0f1c86336110315b62be6e3d2e6bb113bf80aec1f68f3ad3ac2e6744469f1c0da405b244f5e9a0

memory/2612-46-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2268-58-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2268-59-0x0000000000400000-0x0000000000472000-memory.dmp

memory/2612-61-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3912-71-0x0000000000400000-0x0000000000472000-memory.dmp

memory/3912-72-0x0000000000400000-0x0000000000472000-memory.dmp