Malware Analysis Report

2024-09-11 10:25

Sample ID 240728-fa9b9sycpp
Target 502b6140cbae19b1b29e6ffc5c2064b0N.exe
SHA256 9c373db0b3812e9263b3d00ebf738b68c950f5b1f1532282eb87d7a55069b803
Tags
metamorpherrat discovery persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9c373db0b3812e9263b3d00ebf738b68c950f5b1f1532282eb87d7a55069b803

Threat Level: Known bad

The file 502b6140cbae19b1b29e6ffc5c2064b0N.exe was found to be: Known bad.

Malicious Activity Summary

metamorpherrat discovery persistence rat stealer trojan

MetamorpherRAT

Checks computer location settings

Loads dropped DLL

Uses the VBS compiler for execution

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scripting
T1064
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Scripting
T1064
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
System Location Discovery
T1614
System Language Discovery
T1614.001
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-28 04:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-28 04:41

Reported

2024-07-28 04:44

Platform

win7-20240708-en

Max time kernel

119s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\"" C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2644 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2644 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2644 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2968 wrote to memory of 2868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2968 wrote to memory of 2868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2968 wrote to memory of 2868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2968 wrote to memory of 2868 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2644 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe
PID 2644 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe
PID 2644 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe
PID 2644 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe

"C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gaxztpzi.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5919.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5918.tmp"

C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe" C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp

Files

memory/2644-0-0x00000000741A1000-0x00000000741A2000-memory.dmp

memory/2644-1-0x00000000741A0000-0x000000007474B000-memory.dmp

memory/2644-2-0x00000000741A0000-0x000000007474B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gaxztpzi.cmdline

MD5 01c98e9047a68fb6ac84b99f3e8e4ea4
SHA1 15b4572e7d9a51a3cc0c63f2e83612b07daff952
SHA256 e2d8c4c1124e5ce9f9ddc9ce4f92f6a448ea36113c24f2b17f5e1093bfb088fb
SHA512 24b9a6b45315f8aa6a81496aefa3ad38eac906db1a470440f2bd3bad1281d045e5c253ac0ebc604b412bbc1f6cade41bc6293377c80cccba894f2377393eebe8

memory/2968-8-0x00000000741A0000-0x000000007474B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gaxztpzi.0.vb

MD5 d0542b779b555f9541d3ec829a89598f
SHA1 bdf31ddd328e007dc1a3c5ace7914a557e8be149
SHA256 1559a6c6905edaa9cc41969e2cd126b7ca3c1317fb2144aa78aa9646906b1936
SHA512 1079f75d3f0867d159fca6f99f4476cfe90ada4a3d9ae728824645bfec0ae38414c5df46bb22c32149b2cd38b08e9161b95e315e10839fcc490ff6ee5009f64a

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

C:\Users\Admin\AppData\Local\Temp\vbc5918.tmp

MD5 22ceb94a3d7368e682e45a3c4d7fe485
SHA1 4ed0cb4c18eff375e1891d6545accea6523526a1
SHA256 4081ae78b2ff1c9f25e332f5fc16ea69db8c61beedfb97b3dcb4c303ad06ffa9
SHA512 8e8f74df31ebb6b11cb608d2d1169c6631db9f3d86e7faa45bd3e52ea6d631bcc4d110f1fd1da96e07c7861e2d9ec1e44b2730bb74fa4118d0637b6139a78caf

C:\Users\Admin\AppData\Local\Temp\RES5919.tmp

MD5 bc7573417280552900d019cecdc1605b
SHA1 d7de7e1bab5441ffd365fb54f774c1d440b76a18
SHA256 fad33ef5c3cd445e12ebe3102dc691cdffe7c1f199eec28640cc784d3f7b1117
SHA512 39771abcbd820d99568278160627178c27bc664021af4068518ed3edda33fa201684793791397e438252ffcc65b50000bc6d7abed40c91af23e14a4ed90242d5

memory/2968-18-0x00000000741A0000-0x000000007474B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5560.tmp.exe

MD5 d6b6e3e5f7051c091ff1de4414926687
SHA1 172366a92c1678e809193c20cdbcabfce64ddfd5
SHA256 eae555cd5f519762dec18c8395029e4faed2bb220aae46482d4d1b7a0aa39a9c
SHA512 76174c248db74c228d4c17882d56133eec14d899b542c39da9be1959ce9f10028b62833801f010d6d44b6cf4a4851cfcfc1b8dadf09231f21da82dbf32bd0365

memory/2644-24-0x00000000741A0000-0x000000007474B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-28 04:41

Reported

2024-07-28 04:44

Platform

win10v2004-20240709-en

Max time kernel

120s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\"" C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 816 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 816 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 816 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4852 wrote to memory of 4812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4852 wrote to memory of 4812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4852 wrote to memory of 4812 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 816 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe
PID 816 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe
PID 816 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe

"C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ia2bv18u.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB34.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCAE4EC65DA65494F96B25BED51B9FC12.TMP"

C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe" C:\Users\Admin\AppData\Local\Temp\502b6140cbae19b1b29e6ffc5c2064b0N.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 rwkeith.no-ip.org udp
US 44.221.84.105:80 tcp

Files

memory/816-0-0x00000000745C2000-0x00000000745C3000-memory.dmp

memory/816-1-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/816-2-0x00000000745C0000-0x0000000074B71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ia2bv18u.cmdline

MD5 72541299f127d601117184f945105566
SHA1 f3529daae9472dac650f7618e10af49f03f866e3
SHA256 dbc0db94374d643783b3bf882af59633994d5cdd1b0268d5af29dc8813b40f94
SHA512 be506737cf2ee43d9171fdc1a30883abfbbdfdf35e80efcb1525eb2250d97175850dd4eda28b187deb063e8462fdb18fc2e9f072c9a744de58e6da326502b074

C:\Users\Admin\AppData\Local\Temp\ia2bv18u.0.vb

MD5 54d1f2c90e175fe327a7bb77243497b5
SHA1 8ce1bba9964f0f3e872548989b5a80e673bc8d13
SHA256 5ab629fde2408ec1d2c1cc80a8f15c766ab1cef31d6f35b4eab5f177209b7199
SHA512 2249a71f04a33f7687fba14a24f1c798c9c98b8edfa07287525378ca229dac364df41bf5d1c9d67f0f441e994d361cd33b19c1bbc4b68cf39a847a07840fe660

memory/4852-8-0x00000000745C0000-0x0000000074B71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

C:\Users\Admin\AppData\Local\Temp\vbcCAE4EC65DA65494F96B25BED51B9FC12.TMP

MD5 aaecaee3ae20f2caa00512e32ffd966f
SHA1 e9e39e72b810b7099b56991fc5cae168669afdc0
SHA256 a4c1fdebc8296b00b9cd98abd30acd39ad834ebb94521a12cb1d494bf1f19b46
SHA512 d9d069da787933c646c8252c51fb0ce9af849acb608ab3a5fcc583c5fad00ff0fc6de770e820094569581d9f8b610558dc092a051e342487f26cb541fc52c3a2

memory/4852-18-0x00000000745C0000-0x0000000074B71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA8B3.tmp.exe

MD5 f7f9bf6070b9bc4fb638cdc3a88b683b
SHA1 c7acf00fcc379e4b7cd23811f8fe249c60ce9201
SHA256 fe0b4775f80d327738db7eddb4e4bf55307cd2d564b345751dfec8cb83ec87c2
SHA512 3d12d641eafd138b7607558dbd563b1e09f2d0a8fabe189618478bac6f7a853168b7d4770468a1ffd3d7e16c54919f4d4bdbeb85a3e069ee9d739d2a0cf4c963

C:\Users\Admin\AppData\Local\Temp\RESAB34.tmp

MD5 133c726b949b032dad6994b571e7e50b
SHA1 81ada9125a0ed2051bd41fe0455cbf1a6e253c5f
SHA256 a70de995675853b7ef55548d70b0b2b8973ea9890abe9bc8f60d7555b9d7817d
SHA512 3a92b292fbefb8087f4f9d35ca69edd665498a285fd7f907b12ae38a4a56da3e3cc21876df4d8a46ba59ea0e8b5b845086f1abed295111de6c3e2bd12ed5cb01

memory/816-22-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/2832-23-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/2832-24-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/2832-25-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/2832-27-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/2832-28-0x00000000745C0000-0x0000000074B71000-memory.dmp

memory/2832-29-0x00000000745C0000-0x0000000074B71000-memory.dmp