Malware Analysis Report

2024-10-23 19:27

Sample ID 240628-2vpdgsxdrj
Target 44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706
SHA256 44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706
Tags
rat default asyncrat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706

Threat Level: Known bad

The file 44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706 was found to be: Known bad.

Malicious Activity Summary

rat default asyncrat

Asyncrat family

Async RAT payload

AsyncRat

Async RAT payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-28 22:54

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 22:54

Reported

2024-06-28 22:56

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\api.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\api.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2732 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2908 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2908 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2908 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 860 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 860 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 860 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 860 wrote to memory of 2660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 860 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe
PID 860 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe
PID 860 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe
PID 860 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe

Processes

C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe

"C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "api" /tr '"C:\Users\Admin\AppData\Roaming\api.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1FFF.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "api" /tr '"C:\Users\Admin\AppData\Roaming\api.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\api.exe

"C:\Users\Admin\AppData\Roaming\api.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp

Files

memory/2732-0-0x00000000743AE000-0x00000000743AF000-memory.dmp

memory/2732-1-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

memory/2732-2-0x00000000743A0000-0x0000000074A8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1FFF.tmp.bat

MD5 2629180e481445b3a88a00391a7fcc66
SHA1 e539dbad5e285dcf69ae22ea18a407580596d3db
SHA256 fbd1687c1c0ef67f9867ff07eaea4db113804c9131d27261afe79c2d9fe6ff8e
SHA512 370ad4c5cb846b1fff8836be9ffddea3f74df6b31008871bdfe1565c5878157508abd25e1f7bc492298b32d9f576c358102599934edfd3f21e4c86711a96b403

memory/2732-12-0x00000000743A0000-0x0000000074A8E000-memory.dmp

\Users\Admin\AppData\Roaming\api.exe

MD5 4a56c6e517888a3524999e18e6d7740b
SHA1 3781d9472264ca9af471cdc80ffc87c34134c112
SHA256 44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706
SHA512 0b7c6c0f82b19b20632d8a8d8c93a772f175acc0bf1c9ff1a57f5e731f739806b98663f824a7ec07843cad2fe69376bba57967587a86e5dfe4dc890df334ba4e

memory/2784-16-0x0000000000830000-0x0000000000842000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 22:54

Reported

2024-06-28 22:57

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\api.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\api.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe C:\Windows\SysWOW64\cmd.exe
PID 3104 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3104 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3104 wrote to memory of 4548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4176 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4176 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4176 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4176 wrote to memory of 5324 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe
PID 4176 wrote to memory of 5324 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe
PID 4176 wrote to memory of 5324 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\api.exe

Processes

C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe

"C:\Users\Admin\AppData\Local\Temp\44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "api" /tr '"C:\Users\Admin\AppData\Roaming\api.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2546.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "api" /tr '"C:\Users\Admin\AppData\Roaming\api.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\api.exe

"C:\Users\Admin\AppData\Roaming\api.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 95.12.20.2.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 104.20.4.235:443 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp

Files

memory/2260-0-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

memory/2260-1-0x0000000000E90000-0x0000000000EA2000-memory.dmp

memory/2260-2-0x0000000074DA0000-0x0000000075550000-memory.dmp

memory/2260-3-0x0000000005960000-0x00000000059FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2546.tmp.bat

MD5 732e4829c0f2509cacdbdd434abff078
SHA1 fccb5a7777f592773ae64857409566aafe18be53
SHA256 5c85d36e4ec8640dc8d624bfdce1c6a12ddd8fe453a3904941321349063aaadc
SHA512 c04bd9d4930edab6c9800f18642c9401eb105f2080076208b7da1f67139fd15c37d1494047bbebc813d517db4ba32e9e3c0f522cfffc5fd2b58ff641745b1b4e

memory/2260-9-0x0000000074DA0000-0x0000000075550000-memory.dmp

C:\Users\Admin\AppData\Roaming\api.exe

MD5 4a56c6e517888a3524999e18e6d7740b
SHA1 3781d9472264ca9af471cdc80ffc87c34134c112
SHA256 44ae9b54c322a598bf0b04a591d69216718a606f4aa01ab72307eed94aec1706
SHA512 0b7c6c0f82b19b20632d8a8d8c93a772f175acc0bf1c9ff1a57f5e731f739806b98663f824a7ec07843cad2fe69376bba57967587a86e5dfe4dc890df334ba4e

memory/5324-13-0x0000000074D00000-0x00000000754B0000-memory.dmp

memory/5324-14-0x0000000074D00000-0x00000000754B0000-memory.dmp