Malware Analysis Report

2024-11-16 13:27

Sample ID 240801-3lgsqaxcrg
Target 822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118
SHA256 206a904b547eec8a102559b437b3359c77e5c8a9f3eb22abb062dba272f58cd3
Tags
urelas discovery trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

206a904b547eec8a102559b437b3359c77e5c8a9f3eb22abb062dba272f58cd3

Threat Level: Known bad

The file 822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

urelas discovery trojan upx

Urelas

Urelas family

Loads dropped DLL

Executes dropped EXE

Deletes itself

Checks computer location settings

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-01 23:35

Signatures

Urelas family

urelas

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-01 23:35

Reported

2024-08-01 23:38

Platform

win10v2004-20240730-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\joxyr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\joxyr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\joxyr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gobou.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\joxyr.exe

"C:\Users\Admin\AppData\Local\Temp\joxyr.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\gobou.exe

"C:\Users\Admin\AppData\Local\Temp\gobou.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4728-0-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\joxyr.exe

MD5 9b85ac8f57bcb6e0b612f2290864f282
SHA1 de114177eaefa7ee53736eb38b4395a64a70599b
SHA256 8ad4d387c77730a96a11587b0d2f3785c1ea2aa7da560825c645caa3775fa558
SHA512 275c01ee54901d15b8a7a7832897f5242c41f794d28ac08722e4ec4445cbbaef526b9b0c3bdd033c63955990477a2f4ba9eb0eadfe1b383e7964d4362e3bd18d

memory/1904-11-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/4728-14-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 44fed0c3b4f1dca994cc3c29b1379611
SHA1 20cc5a4064b019e1dc84d18f1ec490911059f128
SHA256 87e7c5356c17415ec5c45c665ce57e332e06247cf9fce1b4f837b6ffb3cca22e
SHA512 dd7e1f318571f9441d7609ba1539a7d4b8fa3ac0c1ba94a9a4f2e973cca3e2ef4a11d19d90d72c9aa61f4a4a768fc09a7988d7d2e0e34080945e98b03030dfe8

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 588aee6068ae3c79c8a4d0458eeaf170
SHA1 3f2836841d483936e5625b56c0bc2526fddd3d32
SHA256 c0c8c79a11de93d00ffb893cc1e857766e8647a403c58c47f9232ec0e6fb1f60
SHA512 6f8a4c32c9b46d5eba9a6149ffd3cf33406437f9b85862f174915a0444d4db39e22a730274a98e3cadab02405c4b230b9673a913e9ca00222e77c0020a75ec75

memory/1904-17-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gobou.exe

MD5 9c2f9c319d280c0169f4c9b160d04ac4
SHA1 b9a29858ec6b637b16214ec8687d972fe6980890
SHA256 5986893e19139b1ecf48f4e0c7f58a2fb1d7f8e04f000b765d493861b01cd060
SHA512 4952d743bd402ddb38bb2a6af6e2919e8edd1914fd423fde71ad3154bfafc4ce2fbaba6a008ce3a38e563a2338cd64916e344f1450a6c786d27dfc0c1e02d1af

memory/1904-26-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/1552-28-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/1552-27-0x0000000000400000-0x0000000000494000-memory.dmp

memory/1552-30-0x0000000000400000-0x0000000000494000-memory.dmp

memory/1552-31-0x0000000000400000-0x0000000000494000-memory.dmp

memory/1552-32-0x0000000000400000-0x0000000000494000-memory.dmp

memory/1552-33-0x0000000000400000-0x0000000000494000-memory.dmp

memory/1552-34-0x0000000000400000-0x0000000000494000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-01 23:35

Reported

2024-08-01 23:38

Platform

win7-20240729-en

Max time kernel

149s

Max time network

77s

Command Line

"C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\daivh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\daivh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xifiy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\daivh.exe
PID 2128 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\daivh.exe
PID 2128 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\daivh.exe
PID 2128 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\daivh.exe
PID 2128 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2336 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\daivh.exe C:\Users\Admin\AppData\Local\Temp\xifiy.exe
PID 2336 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\daivh.exe C:\Users\Admin\AppData\Local\Temp\xifiy.exe
PID 2336 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\daivh.exe C:\Users\Admin\AppData\Local\Temp\xifiy.exe
PID 2336 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\daivh.exe C:\Users\Admin\AppData\Local\Temp\xifiy.exe

Processes

C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\daivh.exe

"C:\Users\Admin\AppData\Local\Temp\daivh.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\xifiy.exe

"C:\Users\Admin\AppData\Local\Temp\xifiy.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2128-0-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\daivh.exe

MD5 0404e95e1b385986778da8ae08446553
SHA1 7167d360eb4063e0c12de74bdb7cdb9015758b49
SHA256 2d634cf7f668c049fdeaad48cea63bd0c95c0841c3366cef3f3b843172fb890a
SHA512 a4288224e834c61db39070016357299a8279c63e63a26890261ac0455151ae2c899bad9ee6665716722d0efe8b50ad6856e5b34d78721d3d8069848b0546a6df

memory/2128-14-0x00000000025A0000-0x0000000002656000-memory.dmp

memory/2336-17-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 44fed0c3b4f1dca994cc3c29b1379611
SHA1 20cc5a4064b019e1dc84d18f1ec490911059f128
SHA256 87e7c5356c17415ec5c45c665ce57e332e06247cf9fce1b4f837b6ffb3cca22e
SHA512 dd7e1f318571f9441d7609ba1539a7d4b8fa3ac0c1ba94a9a4f2e973cca3e2ef4a11d19d90d72c9aa61f4a4a768fc09a7988d7d2e0e34080945e98b03030dfe8

memory/2128-18-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 c8c91bd7d3165cd4a5a028e3a6fe7688
SHA1 76dd9eb03c1c71a2bf421ef2764e379b6270ee16
SHA256 afad2d6cc3587e99c8fa9ffd6ad6daed5091f84386ea213928068416d5d75a03
SHA512 d0dd389d7642a3e1c05956d269a2021b7df56fe60a0a0dad67af5840adb7b303fc4acbd45c7d5f5378844d5b3db736785dc02783cbc5fdc2638222717eabdca3

memory/2336-21-0x0000000000400000-0x00000000004B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\xifiy.exe

MD5 6d5975857becd4eccdd1b0a26906bafb
SHA1 008947d10d39d463e2d2f2bddcbc1fd43ab3afd9
SHA256 fc2ef65bd314c315adfa66046ddddba24ef0017f6424cd2b333485e376e52c8f
SHA512 ce27f1ecbaca7b5fb9af2d1b3426abc039eb962ec1e9e4412f337016cb7ad309fb945b28164bfd458200c3a4887d0e67d00623d78d10c058b69aba58c36f613a

memory/2336-27-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2452-29-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2452-30-0x0000000000020000-0x0000000000022000-memory.dmp

memory/2452-32-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2452-33-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2452-34-0x0000000000020000-0x0000000000022000-memory.dmp

memory/2452-35-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2452-36-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2452-37-0x0000000000400000-0x0000000000494000-memory.dmp