Malware Analysis Report

2024-09-11 10:23

Sample ID 240726-2xxsmszfkj
Target 6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817
SHA256 6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817
Tags
metamorpherrat discovery persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817

Threat Level: Known bad

The file 6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817 was found to be: Known bad.

Malicious Activity Summary

metamorpherrat discovery persistence rat stealer trojan

MetamorpherRAT

Deletes itself

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Checks computer location settings

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scripting
T1064
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Scripting
T1064
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
System Location Discovery
T1614
System Language Discovery
T1614.001
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-26 22:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 22:58

Reported

2024-07-26 23:01

Platform

win7-20240708-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\"" C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2208 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2208 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2208 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2716 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2716 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2716 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2716 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2208 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe
PID 2208 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe
PID 2208 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe
PID 2208 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe

"C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dt6nxfjx.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B39.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B38.tmp"

C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp

Files

memory/2208-0-0x0000000074611000-0x0000000074612000-memory.dmp

memory/2208-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

memory/2208-2-0x0000000074610000-0x0000000074BBB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dt6nxfjx.cmdline

MD5 6342498c4dbb3b0de93458dd37896d55
SHA1 24c3393928c6fef0aaf3f60a3525fb3a6edd094d
SHA256 b7200b142db4aab8545797c9e9b48667c24decb4a030f00d228852192c203772
SHA512 5b663297b71cfe004c41c91db9a215028cf7d6489bf9563e6af3eb90fc4554d747b74f7af8e64d97b883c3d8e30d2472feda311f86a8c6788567e5ad779cc007

memory/2716-8-0x0000000074610000-0x0000000074BBB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dt6nxfjx.0.vb

MD5 c09d4d8cceb98fec26dce230353f0903
SHA1 2925e5eb68d8e5ab7535750601148249ce097209
SHA256 15d954c83e988e31ec442fe401acde005fc88a6818997bce4feb702e1b1ead02
SHA512 4f6980d5cfb0e9f4228569131cc2439a4a52b9be3b6e902a3bc30c371d04560bbf416d48b58569e661130124ac8081da896cb0454bd29cab5a2e6898bbe6d3d1

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

C:\Users\Admin\AppData\Local\Temp\vbc7B38.tmp

MD5 00284579304422ee3fd5c3157a163c27
SHA1 cbe121699de2c38833a3504545624d8b8275826b
SHA256 0d3a2c5c3a8eda47ec3a34e2bc03ff62d376cda869ac8f95873dd94e5778087b
SHA512 832027f7f37daaa2a68b6f558aa4a87a1ce329bf405c3f9df907ffce77d55cb8580e35ee05c902af964db2de2278572d66586f30eae7e85f59e5a29eafd03708

C:\Users\Admin\AppData\Local\Temp\RES7B39.tmp

MD5 bc082d04feee11db99007ed0634c76d4
SHA1 0fb4c16ad0ca02f0f3f77871679bc9ad6de98a3a
SHA256 004864f20a778b317888d9c5361261ef19afaad861087e873d1465ca94802646
SHA512 adbfe6d571181acaf11fb313d2ac3047efbe603e4b64c16e6ace2ca15c9b068061a4a0de7175f92411d5525f10d5ec05efe06f46f6168d2ac82230131c51b3ca

memory/2716-18-0x0000000074610000-0x0000000074BBB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe

MD5 14ef97ee22682f9935f3f8a15e58387d
SHA1 5026666f079395071aaff5ec5cbd7ea7a397e7f3
SHA256 72dbf796e927ca8b035245adcb889c55d2c344a0f540a6a77cdac97cce29387f
SHA512 394e95938caa74e0f3c2bc1aa1a70d3099630080b480595bf59506186b3db4d5560e82d0fe5cf7646d8252514903bc0de182668b0b6d17cab0cf3bc20dd5cd42

memory/2208-24-0x0000000074610000-0x0000000074BBB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 22:58

Reported

2024-07-26 23:00

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\"" C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3180 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3180 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3180 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 4828 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4188 wrote to memory of 4828 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4188 wrote to memory of 4828 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3180 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe
PID 3180 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe
PID 3180 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe

"C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iznweoww.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES97EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF71A67EFF1954D2B8B94C2DA1F6265D.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp

Files

memory/3180-0-0x0000000074DB2000-0x0000000074DB3000-memory.dmp

memory/3180-1-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/3180-2-0x0000000074DB0000-0x0000000075361000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iznweoww.cmdline

MD5 1d85b4fe2dca2a3f557a499d0b71f05f
SHA1 64a41aa3b3d773f02fb9148c7cdd821a42a8f3e9
SHA256 a12d2ee4bad7c3a583f8dee979ce4b77d8a17c8fcf0317d4b682a7df93027e89
SHA512 11d5dcdd6bc627d3a06030dc58493f2c646ec191a30f57633f19fddb1cff23b209380384437f1395a0f4b1b39d9b0c81e8a7ad29bc6863838a329908cc6d2b5c

C:\Users\Admin\AppData\Local\Temp\iznweoww.0.vb

MD5 5108146b77b7ebcce2712c808dd08173
SHA1 2142850646360d9386c506c82fa525958ccb948d
SHA256 ceecaf92b77a3b4bb06ac9b6cc88a3c6fd9206baf9cf6de382275246abb291d3
SHA512 d410bf60a205fd1e2c40150aeb1eec33906a5b604f8250cb3466378ac8fa2bbc1f17fc2dcbaf57f3b66ccd4841d34769ca617594a7b78429a410f1521c203520

memory/4188-9-0x0000000074DB0000-0x0000000075361000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

C:\Users\Admin\AppData\Local\Temp\vbcF71A67EFF1954D2B8B94C2DA1F6265D.TMP

MD5 2bbacbee8c9eaf25307eca747fca9e79
SHA1 5fb4bdac118a0b0394f653c14f7ebcdfea354db7
SHA256 4f62c922dab781e89692925f3b6c653ea01dc09dd828ec474b7da1cf992e7fd5
SHA512 204e5b35e8dc5a52576583f6ad3f156b110bd5a26642de2da64968884dce46dc9bf603aee9680b4b5659f72e262dadce3bbcd60bf098036c50b825481dbc1a14

C:\Users\Admin\AppData\Local\Temp\RES97EA.tmp

MD5 c348562355e6b0635a2b6e969741b5e0
SHA1 cf434c8fe80ccb12efd0c25da066cee9fd0049e5
SHA256 744febb25968645a6c6c41d266983c4a58cb66b0f648723aea2b5454b4f54618
SHA512 0427f8e1cfaef90c323843529579a63023a80f5d83ce44b0091dc028e9498fedf6030a32974718a2bcc0e71e3ead2b00152487c22330cc65b3571b1dfb8c6eac

memory/4188-18-0x0000000074DB0000-0x0000000075361000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp96B2.tmp.exe

MD5 2ba65ed42fc9d3b7d3c402e8b530c7d5
SHA1 3440bd7067bf117e063cacbe8fac63c88c389417
SHA256 90402580e521f1e45db3c2f5857d0f443b3063561851df289bdbb87ccadeee50
SHA512 032d9e94198acf38c82fecc785788eb241d7747f0b496711117e544228a9e5b5956bcd17eed0682732a6dca0a36eaa81a20f8a71d7aa471d28448b7cb3bd8d30

memory/2248-23-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/3180-22-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/2248-24-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/2248-26-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/2248-27-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/2248-28-0x0000000074DB0000-0x0000000075361000-memory.dmp