Malware Analysis Report

2024-11-16 13:25

Sample ID 241013-x52pcaycmj
Target 1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1
SHA256 1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1
Tags
upx urelas discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1

Threat Level: Known bad

The file 1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1 was found to be: Known bad.

Malicious Activity Summary

upx urelas discovery trojan

Urelas family

Urelas

Checks computer location settings

Deletes itself

Loads dropped DLL

Executes dropped EXE

UPX packed file

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-13 19:27

Signatures

Urelas family

urelas

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-13 19:27

Reported

2024-10-13 19:29

Platform

win7-20241010-en

Max time kernel

150s

Max time network

84s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\qourn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\qourn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rebou.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2396 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qourn.exe
PID 2396 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qourn.exe
PID 2396 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qourn.exe
PID 2396 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qourn.exe
PID 2396 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\qourn.exe C:\Users\Admin\AppData\Local\Temp\rebou.exe
PID 2164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\qourn.exe C:\Users\Admin\AppData\Local\Temp\rebou.exe
PID 2164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\qourn.exe C:\Users\Admin\AppData\Local\Temp\rebou.exe
PID 2164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\qourn.exe C:\Users\Admin\AppData\Local\Temp\rebou.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe

"C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"

C:\Users\Admin\AppData\Local\Temp\qourn.exe

"C:\Users\Admin\AppData\Local\Temp\qourn.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\rebou.exe

"C:\Users\Admin\AppData\Local\Temp\rebou.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2396-0-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qourn.exe

MD5 a6177728943bd993459281a0c6b47369
SHA1 56667b63c5b1c4e17fa52e0b40312fb0185049dd
SHA256 b2e7a0d24427016eac02a116f7ffaa2c5ea0ef4c48df2782dfb99ee2429cd329
SHA512 8b3a2baec3cdcd16072c5c8bb48cb69c689a49d995c69b45c57bede98854a2826bd486ef849b75693abaf2e6afe947423b03129176abb7263dd032ed306dfc63

memory/2164-9-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 3fcf392798338eab201b4d578dd2a25a
SHA1 072c6577e302a2d1ced526ab3516a7d8bd8958e0
SHA256 2f54ef30c389dd956a8b6bdd0599b570ad2ef9e8fbe50f7a6a1074a5aaab9ee3
SHA512 df6e7684e7f61739568d5863c1423b4a44f2ea8f74f055cdde46538cc04c701010419b76cbcfb6bbc0ff16c8816204861b7ad32051c35ccabd1c2975015b4992

memory/2396-17-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 8d72c3d8e013466888f3ee9f18be05f5
SHA1 af5e8dce314146d508fdcf82653d65ed4f0d5793
SHA256 9f779d4040e6afbaeb5f96d1ddb0fe61db86b8b7fea028727ae1d6f782aff906
SHA512 69e198de6aa0528ff42047f65b0f342166cb15818c2b92cd77f334a3aecf55662c70e79b03e9add65d5e0dcbe30b093a82ce1bfbdaba2183a07e516d293c5b0c

memory/2164-20-0x0000000000400000-0x00000000004B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\rebou.exe

MD5 28f06ee1e8c8d22d21ec460b5882e255
SHA1 23dba0f9b8e53bfdd0ba08674f12ff19ec30f156
SHA256 2ff5621ff819e440203b5c02ff0fc4f558f5e7ddd00f1f91aebbada443477db0
SHA512 30aa45893623979eafb25e1f4508c5dcaeba6a3d3e0fcf3e40cfa404faa7692ae3e56daf89d62762cff832c38db1f6ba913fa457fa744d7bdce2bd70503b364f

memory/2708-29-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2164-28-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/2164-26-0x0000000003450000-0x00000000034E4000-memory.dmp

memory/2708-31-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2708-32-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2708-33-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2708-34-0x0000000000400000-0x0000000000494000-memory.dmp

memory/2708-35-0x0000000000400000-0x0000000000494000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-13 19:27

Reported

2024-10-13 19:29

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\qokuu.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\qokuu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\qokuu.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cuubv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1508 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qokuu.exe
PID 1508 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qokuu.exe
PID 1508 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Users\Admin\AppData\Local\Temp\qokuu.exe
PID 1508 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\qokuu.exe C:\Users\Admin\AppData\Local\Temp\cuubv.exe
PID 3460 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\qokuu.exe C:\Users\Admin\AppData\Local\Temp\cuubv.exe
PID 3460 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\qokuu.exe C:\Users\Admin\AppData\Local\Temp\cuubv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe

"C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"

C:\Users\Admin\AppData\Local\Temp\qokuu.exe

"C:\Users\Admin\AppData\Local\Temp\qokuu.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\cuubv.exe

"C:\Users\Admin\AppData\Local\Temp\cuubv.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 85.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/1508-0-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qokuu.exe

MD5 d02ef02f68cabe47cb36c175ef646f0d
SHA1 e8ddfa28e4ceb01583845612c789ebf49b7065cf
SHA256 16147b1875bee72705b9487a0077016b801ee7b4c95e184d3cec93824b5db317
SHA512 c3357a6812fedff3a34844b096a4c6eccb4b8a47c762a5c51716ba5dec53b692f08cd27cb3f1366360c73e86c866689c674efd15931d638bda91dd8c677795e5

memory/3460-12-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/1508-14-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 3fcf392798338eab201b4d578dd2a25a
SHA1 072c6577e302a2d1ced526ab3516a7d8bd8958e0
SHA256 2f54ef30c389dd956a8b6bdd0599b570ad2ef9e8fbe50f7a6a1074a5aaab9ee3
SHA512 df6e7684e7f61739568d5863c1423b4a44f2ea8f74f055cdde46538cc04c701010419b76cbcfb6bbc0ff16c8816204861b7ad32051c35ccabd1c2975015b4992

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 ba655ae17147c0abf71a1bea14c8ce95
SHA1 41cad7e07dd3c3c4864ef3b53316a67826c9db7c
SHA256 1c089a13b32dac6cb58d82b44b26548f6186eceb8936e1697558dc2600969178
SHA512 e73eb5667cdc3c526df5baddcbe5b542e6128205eb8a8552e4dbdca42375d7809cf09033923e3137ab7525ce8697a14adcee9d5402a08973dd32a42f9afa13cc

memory/3460-17-0x0000000000400000-0x00000000004B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cuubv.exe

MD5 5e75eb789cc8e2482e77fd77258535ac
SHA1 91fdaa7b36e130acc623b805bcdd0a07c079c51b
SHA256 f5de674ff792930f8a09945c805d1fcbf3f196cf2a7c39ef2bb72c8b0969e714
SHA512 39ccb8b0b5fd8364c8c2634a43198630c8043b2d72564660a5494176b2ab7b6e627d51677baaeac79aad0fe1089b88ccc9646bd775813d749e64142d79c384ed

memory/3528-27-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/3528-26-0x0000000000400000-0x0000000000494000-memory.dmp

memory/3460-28-0x0000000000400000-0x00000000004B6000-memory.dmp

memory/3528-31-0x00000000001D0000-0x00000000001D2000-memory.dmp

memory/3528-30-0x0000000000400000-0x0000000000494000-memory.dmp

memory/3528-32-0x0000000000400000-0x0000000000494000-memory.dmp

memory/3528-33-0x0000000000400000-0x0000000000494000-memory.dmp

memory/3528-34-0x0000000000400000-0x0000000000494000-memory.dmp

memory/3528-35-0x0000000000400000-0x0000000000494000-memory.dmp