Malware Analysis Report

2025-03-15 06:32

Sample ID 240624-vbcr1ssepa
Target 09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118
SHA256 a8e6e14cf27f97ce56a15f61d4fbab94edad1bdba1bc2fb4f4fccf4fab9be496
Tags
gh0strat bootkit persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a8e6e14cf27f97ce56a15f61d4fbab94edad1bdba1bc2fb4f4fccf4fab9be496

Threat Level: Known bad

The file 09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

gh0strat bootkit persistence rat

Gh0st RAT payload

Gh0strat

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-24 16:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 16:48

Reported

2024-06-24 16:51

Platform

win7-20231129-en

Max time kernel

150s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\hfwthsbepp N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\bhfbiuaten C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\SysWOW64\svchost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\hfwthsbepp N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A \??\c:\users\admin\appdata\local\hfwthsbepp N/A
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\hfwthsbepp N/A
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\hfwthsbepp N/A
Token: SeRestorePrivilege N/A \??\c:\users\admin\appdata\local\hfwthsbepp N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2380 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\DNmouse.exe
PID 2380 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\DNmouse.exe
PID 2380 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\DNmouse.exe
PID 2380 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\DNmouse.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2380 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp
PID 2532 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\server.exe \??\c:\users\admin\appdata\local\hfwthsbepp

Processes

C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\DNmouse.exe

"C:\Users\Admin\AppData\Local\Temp\DNmouse.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

\??\c:\users\admin\appdata\local\hfwthsbepp

"C:\Users\Admin\AppData\Local\Temp\server.exe" a -sc:\users\admin\appdata\local\temp\server.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k netsvcs

Network

Country Destination Domain Proto
US 8.8.8.8:53 fwzc.3322.org udp
US 8.8.8.8:53 conf.f.360.cn udp
US 8.8.8.8:53 www.baidu.com udp
US 8.8.8.8:53 www.baidu.com udp

Files

memory/2380-0-0x0000000000400000-0x0000000000466000-memory.dmp

\Users\Admin\AppData\Local\Temp\DNmouse.exe

MD5 05003a962009abf95bde474c2dfae955
SHA1 624819366dda036830f5561c7099590daac117b8
SHA256 16be73d65cac166d31a5ed8a2994f1bfa58d6dbbbaa69eaa2ea5cdf35d3c5faf
SHA512 dccccd68ed91635a8203230224825a59cea0fadef4e87a2f3f47aab558f6d485f0b33de91336cb5aea81acb6d207ac25f67a045b8250d5e082492e3e61601ccd

\Users\Admin\AppData\Local\Temp\server.exe

MD5 249b18fd7a7a2285ff9f2baaa33995c7
SHA1 d81368ffd4dea5a558f1011a2711c7c2364b7025
SHA256 53950411d6c2c603ff3c2564ce1d24762cad08aae70a9360f1b516fd47c75352
SHA512 b1b0324775e4505fd43a073fc5a2c810fcfa68247031d1b678f137e1cd4ced79c62edc149c4fd5eb69706fb349b0c2b9907ba4acd48abea1b71fdcd965f54702

memory/2380-17-0x0000000000400000-0x0000000000466000-memory.dmp

\Users\Admin\AppData\Local\hfwthsbepp

MD5 512b2bf8defe2aee7a1a14b34dfad6f8
SHA1 84368fe6f5c322b2c087734aa1fa45463ad62323
SHA256 25187a89f94ea1502c8155cae232cadd043d2618dfef79aa349db33642c2f993
SHA512 f46cc660ac15d3df57e295fd982a04bce21ba85e5442fd045b71eb2d5c8bc6bcec409f4903a8cc11d91ca916cfdbde10e93e42ebd46a1f55f278fb8ea9110353

\??\c:\programdata\drm\%sessionname%\tkbol.cc3

MD5 6758c40fc53de6a0273e7eb13c6954e5
SHA1 1ccb43ad364916fd108e9c30116bc7f9a981a137
SHA256 bfe743763b768e9b489092b4280eeeba9570a5b29c04741abf44b2705bf26aff
SHA512 fe376aa9473fa5216b1a94cae1de4b7f78c52857a7b95d3304477789bc66dbbda69e14813b48b91dc71595533d6e6085b492c00f69e2e4992b341e8f3072b4d2

memory/2648-33-0x0000000000170000-0x0000000000171000-memory.dmp

memory/2648-34-0x0000000020000000-0x0000000020027000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 16:48

Reported

2024-06-24 16:51

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\svchost.exe.txt C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\bgvghehmqx C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\svchost.exe.txt C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\bpttqxcqqi C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\svchost.exe.txt C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Windows\SysWOW64\bximybfoed C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A
N/A N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A
Token: SeBackupPrivilege N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A
Token: SeRestorePrivilege N/A \??\c:\users\admin\appdata\local\kxwjpiujlx N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DNmouse.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\09b06cee177ec1c4fadd6b36e3c5f4e0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\DNmouse.exe

"C:\Users\Admin\AppData\Local\Temp\DNmouse.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

\??\c:\users\admin\appdata\local\kxwjpiujlx

"C:\Users\Admin\AppData\Local\Temp\server.exe" a -sc:\users\admin\appdata\local\temp\server.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 400 -ip 400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 804

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2620 -ip 2620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 828

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5104 -ip 5104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 680

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 conf.f.360.cn udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

memory/4312-1-0x0000000000400000-0x0000000000466000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DNmouse.exe

MD5 05003a962009abf95bde474c2dfae955
SHA1 624819366dda036830f5561c7099590daac117b8
SHA256 16be73d65cac166d31a5ed8a2994f1bfa58d6dbbbaa69eaa2ea5cdf35d3c5faf
SHA512 dccccd68ed91635a8203230224825a59cea0fadef4e87a2f3f47aab558f6d485f0b33de91336cb5aea81acb6d207ac25f67a045b8250d5e082492e3e61601ccd

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 249b18fd7a7a2285ff9f2baaa33995c7
SHA1 d81368ffd4dea5a558f1011a2711c7c2364b7025
SHA256 53950411d6c2c603ff3c2564ce1d24762cad08aae70a9360f1b516fd47c75352
SHA512 b1b0324775e4505fd43a073fc5a2c810fcfa68247031d1b678f137e1cd4ced79c62edc149c4fd5eb69706fb349b0c2b9907ba4acd48abea1b71fdcd965f54702

C:\Users\Admin\AppData\Local\kxwjpiujlx

MD5 49618c996f152651b4dc2ab057f74b35
SHA1 d2a60ee40d8477fa5bd4b8c671c556387b62813c
SHA256 2a545f62167884c61e925749e03654958da008daeaa0e03cd444a34fd2acad69
SHA512 11b20e40e9568e9ad3eed55c7d817186e1e4fca92adc7640019ced1def4c4d24145d710b95b078f79a727e03cbd109b87441235c22a332a331fb87a293362657

\??\c:\programdata\drm\%sessionname%\ylbsr.cc3

MD5 464950f2f7d1234cf56fe34668feffef
SHA1 eccdb2c84dfef077f4dfef1ef3d04fd171bea79f
SHA256 8a522edb4238f1dbe71c604e683fb73d3ad08dfc1301d3af7d0f110a24c8b80a
SHA512 57528d607c6501d6730388aeb6d8afde827dcd5a5cac0873dc92977d011c2034594f8e8ab1c1a9cc0c02cab35eebb90823961d058f13571a335a0f940109219c

memory/400-32-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

memory/400-34-0x0000000020000000-0x0000000020027000-memory.dmp

memory/2620-36-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

C:\Windows\SysWOW64\svchost.exe.txt

MD5 0d47c39607d6ebc63f372c59970d17e9
SHA1 269a568700a90a818cbc7fbc6d0b0bfbce0d777a
SHA256 991a857b6cb7edde415a73003f31535d2974b3ffb92d59303fd418559ab58bde
SHA512 3fc554322ca2057523110c6775aa7cf71a40ebd8a7770dd6591825a125efabe916cf06c399ea7082676c3394e4c7300cb108c0001a37d76ad6082079862c2bc1

memory/2620-39-0x0000000020000000-0x0000000020027000-memory.dmp

memory/5104-41-0x0000000001C00000-0x0000000001C01000-memory.dmp

C:\Windows\SysWOW64\svchost.exe.txt

MD5 3082b5f3e86d39c2ae6b734d4dbdbd1d
SHA1 b43b72c051d91bcc5463f858fc8f9b832b02197c
SHA256 db075be4d8b24bdd06f4d61ca28f553241102b87fc6d56709dc51e31c0949fe2
SHA512 8714655251d080c642a5a4ef7ca67a9b691c65c82ede96482da24238af79c22507de0ea663e9877f60634f413972477b725f790f6103a82f2a884f24464c8101

memory/5104-44-0x0000000020000000-0x0000000020027000-memory.dmp