Malware Analysis Report

2024-11-16 13:12

Sample ID 241106-3t4x8a1dqp
Target df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N
SHA256 df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0
Tags
metamorpherrat discovery persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0

Threat Level: Known bad

The file df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N was found to be: Known bad.

Malicious Activity Summary

metamorpherrat discovery persistence rat stealer trojan

MetamorpherRAT

Metamorpherrat family

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Checks computer location settings

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-06 23:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-06 23:49

Reported

2024-11-06 23:56

Platform

win7-20241010-en

Max time kernel

119s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Metamorpherrat family

metamorpherrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\"" C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1664 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1664 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1664 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1664 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2704 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2704 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2704 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2704 wrote to memory of 2840 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1664 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe
PID 1664 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe
PID 1664 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe
PID 1664 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe

"C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dxc8mcjw.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E81.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2E80.tmp"

C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe" C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp

Files

memory/1664-0-0x0000000074C01000-0x0000000074C02000-memory.dmp

memory/1664-2-0x0000000074C00000-0x00000000751AB000-memory.dmp

memory/1664-1-0x0000000074C00000-0x00000000751AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dxc8mcjw.cmdline

MD5 6aa27e9410655eb83b9fcb3b85e78504
SHA1 f25db4aad0db64182039864bce9e59307844debc
SHA256 45253d2412a841801f16be307abe9d002de6f52010a25090592c4c203dbe3549
SHA512 412b8539278874e307f9cdb10a07718c7af8eb6d2340f58000bf0a12f346dd8a6b9a86a8097ccbbb0bec52ae5aca219772a41b038dee22d2c143c5fac81b7f40

memory/2704-8-0x0000000074C00000-0x00000000751AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dxc8mcjw.0.vb

MD5 0459896f4cb80f5905e7a0089bd4ea5d
SHA1 0aa92e31e7727997c35fbacabc3358fb1f08d486
SHA256 19e7af1b6985ff4ae6805c3cbe59d0674da3af9e930ff800b54f0e09f6d75697
SHA512 4ba34638c9a15a83336e503260690dbd6524bf85707894b90e178de1c46f8435d37fbd8dd3dce225bc562d3a17b11861326713c5b9eff1f27a2906abda11db43

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

C:\Users\Admin\AppData\Local\Temp\vbc2E80.tmp

MD5 d5fd92a4cf6eb1ed69480891611189bb
SHA1 928cba2ae14c106d5fec30c9841c4989b52dc0f2
SHA256 d2bed1e4c90f3bc778f959dff9e76b6305281a95f698b5b8ae4bb4e0e6602a74
SHA512 2d84c833f574a6811c4cfb9c85eb0bc389942eaec59e72175345a04602a0b9c81bbe6c002485037583088b4f2f5da2e49045fb6247e275bf2c54d7029c2492c2

C:\Users\Admin\AppData\Local\Temp\RES2E81.tmp

MD5 9761d0002e7e941bd3738292c20f294c
SHA1 9b5786b24a5d3800e6868131b8561351e1df5894
SHA256 82d4e66ac65b5187ce9e5ecb48035e4386ca08d9e83a1f5b8ecfd360403eaf81
SHA512 1939249e810da5691940d0120f84beae0af3686638e6cff2ace8a3327386a248ed66967633e66941ee1762f8660ed264f6b0333001ea610d4d32d6d597c4105f

memory/2704-18-0x0000000074C00000-0x00000000751AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2BC2.tmp.exe

MD5 989038f8c4824b0e32789a49bab6127e
SHA1 3666e4bf54eb7c3f2c87cf1a4aecbc3b6e0e4bda
SHA256 3ea7206164a915ceaffc36e1e2c1b6447159f66654aec065aaa9dbd239980681
SHA512 cf5eaf5d4f18d1ab15933b4dfebd1127af248d4738f0263a66325085eac76918359e47f32d0632c7c0ed29ade8d84b19ab267fc76f76c344bf531812ea0dab7a

memory/1664-24-0x0000000074C00000-0x00000000751AB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-06 23:49

Reported

2024-11-07 00:19

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Metamorpherrat family

metamorpherrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\"" C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3228 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3228 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3228 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1924 wrote to memory of 1964 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1924 wrote to memory of 1964 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1924 wrote to memory of 1964 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3228 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe
PID 3228 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe
PID 3228 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe

"C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wmhfkrlk.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E05.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9BE13D291032478DB1E4D13116D54E37.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe" C:\Users\Admin\AppData\Local\Temp\df46bca6b125e370d13301f6d84db007bb36d98a4638645aa009ae8c0615ece0N.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp

Files

memory/3228-0-0x0000000075212000-0x0000000075213000-memory.dmp

memory/3228-1-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/3228-2-0x0000000075210000-0x00000000757C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wmhfkrlk.cmdline

MD5 9460698350920ba556b5c0f939cab29c
SHA1 202c567fb93a6b856c2ba1a050ebcd9ef7f2ec42
SHA256 4625b24d9f8474c4f35979489be25a077caa6f879623071443f682739aaf3dd7
SHA512 6b63e9d584d0a8e5073da576dc9e32cae3bc555c7646930f029f01a7e3a83aaa0db02d9efe383682479ff41b8e65ffbd4044b5a3419da4e7724c1f80c49d7e2c

memory/1924-8-0x0000000075210000-0x00000000757C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wmhfkrlk.0.vb

MD5 da17ce5d3c2d847e68dc9f8c803ebb35
SHA1 f88f3b781341c7739457aed01ec16e304681d97f
SHA256 0abd7c599bc35fae95b5df35e1fe5357900e5b62b5a342b6e33c2808f09152ee
SHA512 2f32a418f3b5788ed96d43d6c6753b10bfd0fe5cecaff3697126d04a7505d378450a313af29d8117b11b7ec02dbd14cfd1eed67a6ba13b99e5719c7dcb58bc31

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

C:\Users\Admin\AppData\Local\Temp\vbc9BE13D291032478DB1E4D13116D54E37.TMP

MD5 b9f4ea0c3f8efd8007f6da7bd2d661d7
SHA1 b2e1d9d6949fc7620c43bb172bcdffa2c64ba125
SHA256 c2f980f93455389c7290efe906362148933003201674dee8db02f0609d4c0c61
SHA512 1b09dce69428fc308c045c815ab3884853d45a322d89c1d3b5ca02fb5a038db4320439482d9cb99b3fa6451d53e7a43ea1487210a8e9f421adbfa2973476828d

C:\Users\Admin\AppData\Local\Temp\RES9E05.tmp

MD5 8887fce970892044de0563e6537a4b09
SHA1 33bb9b9d91da7bcfc1cf5384f77ee980243392b7
SHA256 06ebe8e65902494465c68f02543241437b5070db2120180679d25bb781e85318
SHA512 e2c6a9e73ec7eef2a3c09886fb31e6e6623ee1cd92af607078dafb039f3d82791367e0de8617d97c54cede8455d3e3258f44bea64dcf5d96dd944b42030292b4

memory/1924-18-0x0000000075210000-0x00000000757C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8FAD.tmp.exe

MD5 3e5b3b7dd0ba1951eb237425f14db543
SHA1 58d7076156af3899d97daecdb247cf94d5162266
SHA256 64409f0ae88777a7b2086111bb6c18059d40e5e78da0d18414af4c1355df1df2
SHA512 6f4b16d144749a3222ca704422f3364e453a10366bfa6adcf7ebc8c70a3f4eaba0c2c7f8538d49725d50317ef493de8bc7c01fbd624d36c0cfb05c2e687b5697

memory/3228-22-0x0000000075212000-0x0000000075213000-memory.dmp

memory/3228-23-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/3228-24-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/1928-25-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/1928-26-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/1928-27-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/1928-29-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/1928-30-0x0000000075210000-0x00000000757C1000-memory.dmp

memory/1928-31-0x0000000075210000-0x00000000757C1000-memory.dmp