Malware Analysis Report

2024-11-16 13:25

Sample ID 241012-msyf2swfmd
Target b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN
SHA256 b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfc
Tags
urelas aspackv2 discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfc

Threat Level: Known bad

The file b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN was found to be: Known bad.

Malicious Activity Summary

urelas aspackv2 discovery trojan

Urelas family

Urelas

Deletes itself

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-12 10:44

Signatures

Urelas family

urelas

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-12 10:44

Reported

2024-10-12 10:46

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe"

Signatures

Urelas

trojan urelas

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\byipt.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\mefyro.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\byipt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\byipt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\mefyro.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mymij.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5032 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\byipt.exe
PID 5032 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\byipt.exe
PID 5032 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\byipt.exe
PID 5032 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 5032 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 5032 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\byipt.exe C:\Users\Admin\AppData\Local\Temp\mefyro.exe
PID 2944 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\byipt.exe C:\Users\Admin\AppData\Local\Temp\mefyro.exe
PID 2944 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\byipt.exe C:\Users\Admin\AppData\Local\Temp\mefyro.exe
PID 2448 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe C:\Users\Admin\AppData\Local\Temp\mymij.exe
PID 2448 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe C:\Users\Admin\AppData\Local\Temp\mymij.exe
PID 2448 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe C:\Users\Admin\AppData\Local\Temp\mymij.exe
PID 2448 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\mefyro.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe

"C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe"

C:\Users\Admin\AppData\Local\Temp\byipt.exe

"C:\Users\Admin\AppData\Local\Temp\byipt.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

C:\Users\Admin\AppData\Local\Temp\mefyro.exe

"C:\Users\Admin\AppData\Local\Temp\mefyro.exe" OK

C:\Users\Admin\AppData\Local\Temp\mymij.exe

"C:\Users\Admin\AppData\Local\Temp\mymij.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/5032-0-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\byipt.exe

MD5 6f732454c643063f9ee619ab0061c01f
SHA1 2fbaa15064c15cff0e522445bc0822ad2508f5f3
SHA256 cf223a1fb37dcacdec47b2c42cb7bf640d34372cf7fc1262547e84640b35c432
SHA512 204f2c2f6bbc0bcfd398f5a70f97c69e68f4c591f534c54a0c1420256350d19cd45e1471a6d2dc2c768b139116c31eb934272c67be51442a6614946c12d3f95e

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 eaf71668f015a91f23c2ba9059644553
SHA1 4fdd7794ae9a58cab82a61543a92bdd722eea385
SHA256 45e60e9a7f9d29ecae3e0b5b9819e8571e5105ed05aacc6e4091610cf5e4950b
SHA512 4bc93c0764968a0fcb04b90ac04dc700d4149297f0a39b4d63cecf14525bf1e844adfe724bf2cedf66744ae4785158319fea609b4d3591c726b8946f1eb8555d

memory/5032-14-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 db530785ddab2262c4b5581640b46cb2
SHA1 663b49c33e19a146389ca6d2e693c0408d764954
SHA256 dc4caff8b354ad6a56b0a8f9198240022c7113f18187cc4fb502645c920c5827
SHA512 5eb24c783f8890eba38164aed7c54ac2affc27cd766a016e45baec1e10e5f4f6f5751d430ab1e3b3120d46d2245e53e8ddc951c0d0222624b7f1ef47c0229edd

memory/2944-24-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2448-25-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mymij.exe

MD5 4380b7f758d66ec62cac8792f64293aa
SHA1 4375170b2c2229b15a61bbe47bc70db8a64ac597
SHA256 ec727787f9e08de4b524b5393c69186988c6791e9a07ce493cdb8cecfdfadd03
SHA512 39753f609505b5d6e4e6ab535f417c28a90116392cc23a13fc743eaab9d1e03ac65d4f04935a465e00fdb91f67a2982939a9bee6bcaedacc2e28caf21ccd2d44

memory/4236-37-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-40-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-41-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-39-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/2448-42-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 430011d7369ed65c8fc59216e757c56b
SHA1 b75a4cae517a222b4b849d848c716f9b7a7e1e6e
SHA256 6ede09b00585a266d82a416ee3592aa9a8dfbc101ca768657cfd3fea574c4901
SHA512 91c6c99a41833cca170f85fc12e9cdb29630be89e7448ce50f614ae3077015d515e5c3d20623d85d87b41c4fbd3d5a5bea4996756a4c46b9d8aee0fdb5575d4b

memory/4236-44-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-45-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-46-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-47-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-48-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

memory/4236-49-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-12 10:44

Reported

2024-10-12 10:46

Platform

win7-20240903-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe"

Signatures

Urelas

trojan urelas

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryhog.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ryhog.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dupuyq.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\qybec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\ryhog.exe
PID 1992 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\ryhog.exe
PID 1992 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\ryhog.exe
PID 1992 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Users\Admin\AppData\Local\Temp\ryhog.exe
PID 1992 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe C:\Windows\SysWOW64\cmd.exe
PID 1844 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ryhog.exe C:\Users\Admin\AppData\Local\Temp\dupuyq.exe
PID 1844 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ryhog.exe C:\Users\Admin\AppData\Local\Temp\dupuyq.exe
PID 1844 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ryhog.exe C:\Users\Admin\AppData\Local\Temp\dupuyq.exe
PID 1844 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\ryhog.exe C:\Users\Admin\AppData\Local\Temp\dupuyq.exe
PID 2448 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Users\Admin\AppData\Local\Temp\qybec.exe
PID 2448 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Users\Admin\AppData\Local\Temp\qybec.exe
PID 2448 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Users\Admin\AppData\Local\Temp\qybec.exe
PID 2448 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Users\Admin\AppData\Local\Temp\qybec.exe
PID 2448 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dupuyq.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe

"C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe"

C:\Users\Admin\AppData\Local\Temp\ryhog.exe

"C:\Users\Admin\AppData\Local\Temp\ryhog.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

C:\Users\Admin\AppData\Local\Temp\dupuyq.exe

"C:\Users\Admin\AppData\Local\Temp\dupuyq.exe" OK

C:\Users\Admin\AppData\Local\Temp\qybec.exe

"C:\Users\Admin\AppData\Local\Temp\qybec.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/1992-2-0x0000000000400000-0x0000000000458000-memory.dmp

\Users\Admin\AppData\Local\Temp\ryhog.exe

MD5 8d776cd3bf879803190dfac6c1257fbb
SHA1 b769f14f60d75fd1551bf4b73d51bd071e44b66d
SHA256 5d674a4a4fb06080918d8e6c090e3817a140bcf275449cd6bfba3119049db851
SHA512 d72e6dba6f73f8e71b4025b70f22913b796e4274f23f85cecfee8ec3a4b0b5bff2fc81eaa3b5c03f8787ea8e9d23558faef1a5927e85d69e6d9092af40392c4a

memory/1992-20-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 db530785ddab2262c4b5581640b46cb2
SHA1 663b49c33e19a146389ca6d2e693c0408d764954
SHA256 dc4caff8b354ad6a56b0a8f9198240022c7113f18187cc4fb502645c920c5827
SHA512 5eb24c783f8890eba38164aed7c54ac2affc27cd766a016e45baec1e10e5f4f6f5751d430ab1e3b3120d46d2245e53e8ddc951c0d0222624b7f1ef47c0229edd

memory/1992-11-0x0000000002D20000-0x0000000002D78000-memory.dmp

memory/2448-34-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1844-33-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1844-22-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 7ccc8edf53e39b65926c3c6c78b3517a
SHA1 b5803bae8be4a17fd39b666ccd03df0a51b94b0b
SHA256 7f91aaf26c84c9aa9403911a2771d9397866034736740bd76bca52872d40e852
SHA512 0778074f5ac2c223d1114c5f83dcb9776194015429ae49ec5e743f461ecb4cbdeeac160cfdfd37290caf61d698a597389850daf87bdda816214122e176c5dc92

memory/2448-36-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 10e5901aceb22831a0d6c0425a463e7f
SHA1 cea80cfe5700f84b0048d077396da7defdd78aee
SHA256 1d7cf65f75cefb45e35681ec3627234f8fcf60aa6a5d57adde1eb2da9498300b
SHA512 7a25605fe4b09917e6555eb8250e1a172f129fb2383be04d38b64588c180a9576da113d5c2c7b0f6639ebaf0f9ee478357c5315d93a729f9f0d46c3459b00a0e

\Users\Admin\AppData\Local\Temp\qybec.exe

MD5 ec22cb2b2d53b33d73c670c5d6f06ad1
SHA1 e0311a487cf70bedd02fb80ce799024c1a0e0091
SHA256 dc1cdb8fc1d89d2c33cd754c15fe9ca73e007d9e0f6b78dfa1997c0f11c0bd43
SHA512 98f8c30da1f525af4a3ce94d9d5ae520f5aa6f69d06db1a67f1ca2b58f451d13acc820c98943d843c2a908893206084db2fa3dc39e13682fb06c4f2a64511431

memory/1400-56-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-55-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-54-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-53-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/2448-52-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1400-59-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-60-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-61-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-62-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-63-0x00000000013E0000-0x000000000146C000-memory.dmp

memory/1400-64-0x00000000013E0000-0x000000000146C000-memory.dmp