Malware Analysis Report

2024-11-16 13:24

Sample ID 241008-nqgaesvdqm
Target 2151bdd02708525b2dbf548c9290458a_JaffaCakes118
SHA256 af8be5f5c84e1eed2cf25bc4641c262ea67679bc731fec5d3011af539dab257d
Tags
upx urelas discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

af8be5f5c84e1eed2cf25bc4641c262ea67679bc731fec5d3011af539dab257d

Threat Level: Known bad

The file 2151bdd02708525b2dbf548c9290458a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

upx urelas discovery trojan

Urelas family

Urelas

Deletes itself

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-08 11:35

Signatures

Urelas family

urelas

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-08 11:35

Reported

2024-10-08 18:17

Platform

win7-20240903-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\zyxuo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\zyxuo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lyhuj.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 596 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\zyxuo.exe
PID 596 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\zyxuo.exe
PID 596 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\zyxuo.exe
PID 596 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\zyxuo.exe
PID 596 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 596 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 596 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 596 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2896 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\zyxuo.exe C:\Users\Admin\AppData\Local\Temp\lyhuj.exe
PID 2896 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\zyxuo.exe C:\Users\Admin\AppData\Local\Temp\lyhuj.exe
PID 2896 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\zyxuo.exe C:\Users\Admin\AppData\Local\Temp\lyhuj.exe
PID 2896 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\zyxuo.exe C:\Users\Admin\AppData\Local\Temp\lyhuj.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\zyxuo.exe

"C:\Users\Admin\AppData\Local\Temp\zyxuo.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\lyhuj.exe

"C:\Users\Admin\AppData\Local\Temp\lyhuj.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/596-0-0x0000000000400000-0x000000000048B000-memory.dmp

\Users\Admin\AppData\Local\Temp\zyxuo.exe

MD5 acc821b41421062fec7eb28dc9a20652
SHA1 c8b1dd0ac4da1357826bc1340963f1e7aa4c6a2a
SHA256 e7a8dcd05bdaa89ce6adf6f9cf6a4f3850be033ae603051893359dd99af5eeef
SHA512 750b37829cc1fdfcc0803e939c2fdc5639412663bdc6ac4f0fcb7b280f749fc2b5df2cb3e5ba381b8866a770c65112bcd4c5707adbb1fcbf68bdaa6865e9518b

memory/2896-16-0x0000000000400000-0x000000000048B000-memory.dmp

memory/596-18-0x0000000000400000-0x000000000048B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 62aa3121092af6d3556f608bd6975b3d
SHA1 0db41dc7bf121e87fdc958a3d348135c1b6d87ef
SHA256 9cd702bca6787cd12fb7208325e504196bf5c6a8f1de7fb7cd3bfeffce061391
SHA512 6225327996f07833a802841cf049b839b56ae15ef3dfdfea1e737c37cd083e29e0b68812ccfea56ad719b7e11bfc2dc924075185ade84e6bbb6378dddd8fa730

memory/596-8-0x0000000002510000-0x000000000259B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 b9514ac4b4567386fcb6d9eb82174d9b
SHA1 d918b271c1344b5bd8fbf5cf188a3b7c6173af64
SHA256 0aa15ee61f4ac9bfa409b5d84cf11fdc5d44390391ac3895c0d3c05b33443e87
SHA512 cd7afc9fa08fb7715950119c835c40d4fb0c8c90893d36fa7d3f0e507b51885d1a2837cf91e5ba68659c7a48c89bc2ca1dd879f5f9af8afc1f40ab86901f3552

memory/2896-21-0x0000000000400000-0x000000000048B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lyhuj.exe

MD5 2c5f82f74fea1a7c48b5991100c8bd6c
SHA1 211e15eb1790d429b965b823804c8a4193ad486a
SHA256 bccd4d5bad21fb4caf0eef8f99fee46e27571d3219530cbdee9f9daf3728bec5
SHA512 03ad040d3e9b06da7cd881c6b02e765393fdf5966fcf38717d296f44515f793f3d7367053ade487c24ccf3e795016c31bfdbc448da722e85328e37969c96d3ee

memory/2896-28-0x0000000000400000-0x000000000048B000-memory.dmp

memory/2256-30-0x0000000000A80000-0x0000000000B36000-memory.dmp

memory/2896-29-0x0000000003BA0000-0x0000000003C56000-memory.dmp

memory/2256-32-0x0000000000A80000-0x0000000000B36000-memory.dmp

memory/2256-33-0x0000000000A80000-0x0000000000B36000-memory.dmp

memory/2256-34-0x0000000000A80000-0x0000000000B36000-memory.dmp

memory/2256-35-0x0000000000A80000-0x0000000000B36000-memory.dmp

memory/2256-36-0x0000000000A80000-0x0000000000B36000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-08 11:35

Reported

2024-10-08 18:16

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\xazer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xazer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\xazer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\wejog.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2151bdd02708525b2dbf548c9290458a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\xazer.exe

"C:\Users\Admin\AppData\Local\Temp\xazer.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\wejog.exe

"C:\Users\Admin\AppData\Local\Temp\wejog.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/3748-0-0x0000000000400000-0x000000000048B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xazer.exe

MD5 a6bf70eeefbf68bf7eb63f5caae21701
SHA1 adf327fcfb17af1a80cbcaaf6f9cb9e1ab878e0b
SHA256 71f7e16374ec81fc8d3d2ef61d2d17de24de2ea7a7eb28633a8a9384ea4029d1
SHA512 47e9c65df248e19a6a09d8ccf94bfbf5910bcf26a6d593d01526a737a709a877bebfb809b7a1a315059306629826476309383f82ecd66bb523d5aee5c58e3a71

memory/3172-10-0x0000000000400000-0x000000000048B000-memory.dmp

memory/3748-14-0x0000000000400000-0x000000000048B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 62aa3121092af6d3556f608bd6975b3d
SHA1 0db41dc7bf121e87fdc958a3d348135c1b6d87ef
SHA256 9cd702bca6787cd12fb7208325e504196bf5c6a8f1de7fb7cd3bfeffce061391
SHA512 6225327996f07833a802841cf049b839b56ae15ef3dfdfea1e737c37cd083e29e0b68812ccfea56ad719b7e11bfc2dc924075185ade84e6bbb6378dddd8fa730

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 53a85475317e70579afb8cd9687e7d0b
SHA1 8922d28b7fbd0cab10b19822963cf8e148b1ce1a
SHA256 a64c0c6a74190e4ac7b03381b4a3e90dad0b5d785c8b61d148d5bc5735a7a650
SHA512 8b3e740197138d44af4830c9d81ecb763a01996e9ad48315034602d9b066e702de60739ec4e93bb799e8e9beaca47f551d9c795b897f0305abeb9fbf1930052e

memory/3172-17-0x0000000000400000-0x000000000048B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wejog.exe

MD5 b299d5960018339baa37b288d71f11e2
SHA1 d358eb6d8ab2767a94bc87da37571091ac9d8fbf
SHA256 d4fbeaa628087d894bcc8035d719e796acdb7e7e29d7d26e962025faeaa39c90
SHA512 ca01c251acf5c561a55a50439f1d0fe457af735738f050b13668204ce1b6160a559914a19d8f6972a48d966e5c586e340606f104656ccaf8f38be846c692b0fd

memory/3172-28-0x0000000000400000-0x000000000048B000-memory.dmp

memory/4992-27-0x0000000000940000-0x0000000000941000-memory.dmp

memory/4992-26-0x0000000000750000-0x0000000000806000-memory.dmp

memory/4992-30-0x0000000000750000-0x0000000000806000-memory.dmp

memory/4992-31-0x0000000000750000-0x0000000000806000-memory.dmp

memory/4992-32-0x0000000000750000-0x0000000000806000-memory.dmp

memory/4992-33-0x0000000000750000-0x0000000000806000-memory.dmp

memory/4992-34-0x0000000000750000-0x0000000000806000-memory.dmp