Malware Analysis Report

2024-11-16 13:11

Sample ID 241108-aqws8a1ekb
Target f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N
SHA256 f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377
Tags
metamorpherrat discovery rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377

Threat Level: Known bad

The file f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N was found to be: Known bad.

Malicious Activity Summary

metamorpherrat discovery rat stealer trojan

Metamorpherrat family

MetamorpherRAT

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Uses the VBS compiler for execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 00:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 00:25

Reported

2024-11-08 00:27

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Metamorpherrat family

metamorpherrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2644 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2644 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2644 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1552 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1552 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1552 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1552 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2644 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe
PID 2644 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe
PID 2644 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe
PID 2644 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe

"C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\433wgezc.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC8A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDC89.tmp"

C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp

Files

memory/2644-0-0x0000000074CC1000-0x0000000074CC2000-memory.dmp

memory/2644-1-0x0000000074CC0000-0x000000007526B000-memory.dmp

memory/2644-2-0x0000000074CC0000-0x000000007526B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\433wgezc.cmdline

MD5 e30ea445061d85ddafdb5145fcd29efd
SHA1 bf1eb90ae7b50efcdc704a0f6a65ba70525bc136
SHA256 991958c766c0d5d86972f0beff9fe1d12cdc8185a764afdcb037d86006f14056
SHA512 da368a77f0207660590b0b5280524059dd96afe73d975c784b25636df0ce276fe9786697f986bf337e07cc70f60ce507b5290514c08e0396d6c0e53647e24b60

memory/1552-8-0x0000000074CC0000-0x000000007526B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\433wgezc.0.vb

MD5 514f3d4774d3ef273b60c1a5dea8a242
SHA1 23bff74f0a25b2cd23a087a4c6f8dbe0218bdd9e
SHA256 c51c9319b9b90adbc26a3179c66c5381f18f1fce1f24dd69852a131a2015c4de
SHA512 6b63c3639d23e3bcc90c724118f0f55536ed78b8ad29e4041e406f433d5e147b8c8d80fd67b6d43c8233ea512271e495508d6c5ceffeaf4fa26b51566a4d7407

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 484967ab9def8ff17dd55476ca137721
SHA1 a84012f673fe1ac9041e7827cc3de4b20a1194e2
SHA256 9c0a54047f133cf4e3e4444aa57cc576c566218217ea02ad7c04a408ad01791b
SHA512 1e9a0cc800543dada73e551ee714001c4d6c57a595ea2986a4dd8889d1dffd1557735580c694e5feb0b7c27c1a4b3e71a95fab8baf80839f42f80e2109cbe2d7

C:\Users\Admin\AppData\Local\Temp\vbcDC89.tmp

MD5 c42fc20bab882f4e24fe7569265ecf33
SHA1 6f476af0b168d650be02c6fbd367e7d782f5df03
SHA256 594bcf122c8ec824fc27c3d8c2f708e7148f158632b71445e3fa36f7ba866555
SHA512 db23b425f7bf7c37781e74c29c774d40513edaa813b5c5e9e05678162b3fc3344941e0b0bf55cfbd61c2bad5e488f9c040895d1fb0616c46ac93ab8317a62c0a

C:\Users\Admin\AppData\Local\Temp\RESDC8A.tmp

MD5 d061d0f2c7771ce8090f4a6223583afd
SHA1 a18c95d74a63f93404dcedaf595867d46f1bd24c
SHA256 9c7a5aee0dfa1a343941751c94398842701fbd2822ea49290ddead5f08090bcb
SHA512 3dd9d7184b7cf4ddcdeaf6c05f99491ec27cf04fd844758f3f8c3228d164c40df966bd41b7492b98dab4b5a7d798fb12053aa25c7ec39a4f0e770c11ace1bc78

memory/1552-18-0x0000000074CC0000-0x000000007526B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpDBBF.tmp.exe

MD5 ca6a5c003914efb0949b91560b0d0264
SHA1 1d77402284d2bd9b3c2d6c4a075134b713a9d77c
SHA256 2d09a2fc378e9398f5d1719ff6e65a488ac6e95b1312bc7ac70e335f8ac2904a
SHA512 e67dedfec03a59e60eec5a47aeb3c0554b4ad16511009b4e1b8d982f4765e31dacfa2bef293dc9525d60dd534f79b6855b7fc5bb4c5a817727fb9c6e01c2273f

memory/2644-24-0x0000000074CC0000-0x000000007526B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 00:25

Reported

2024-11-08 00:27

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Metamorpherrat family

metamorpherrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3864 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3864 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3864 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 408 wrote to memory of 3856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 408 wrote to memory of 3856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 408 wrote to memory of 3856 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe
PID 3864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe
PID 3864 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe

"C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qutf8czh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES804C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4E7F03B899A443C5A48FCC2DAAC52BFB.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f13339a7bd320b253086d507c6bb7e7c5bdb7884d1fb4623a72d40f1d13f0377N.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
N/A 127.0.0.1:127 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp
US 44.221.84.105:80 bejnz.com tcp
N/A 127.0.0.1:127 tcp

Files

memory/3864-0-0x0000000075242000-0x0000000075243000-memory.dmp

memory/3864-1-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3864-2-0x0000000075240000-0x00000000757F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qutf8czh.cmdline

MD5 2c5d31eeb7d7514fa9fcea9bd661da81
SHA1 087a7f8643f162567ed9ad53280a33c96dfeaaa0
SHA256 a5dea5d956dcfd0ffff2f2eeca3a9f68f2d7fbb7cde8cdb3b31016e90609229d
SHA512 ab31eb915493f601a7c0883f18bb8558af61ee76156bd52d0a8d91cef4a9c06d74247aef89e5e255bb8ba330965c13865ac2dbc02ae35d66cba9465d973091e8

C:\Users\Admin\AppData\Local\Temp\qutf8czh.0.vb

MD5 b339b4150ba667d34188b7f4c95c1a38
SHA1 28ece8bc78035191d53dee9eb2af4a9ed18bc221
SHA256 6a89e84e0a5f65881173122af1e34b824b539320ac148398c59a1a28b309b6e1
SHA512 1df085172b8d5845fc61d2004d34e6e13456f4f5cb8c08043a2ffcb8557d035b1def3ec27af864e7a1d5c8954a829e850d8c6c67eddb9f03353a7575f8bb46ba

memory/408-9-0x0000000075240000-0x00000000757F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 484967ab9def8ff17dd55476ca137721
SHA1 a84012f673fe1ac9041e7827cc3de4b20a1194e2
SHA256 9c0a54047f133cf4e3e4444aa57cc576c566218217ea02ad7c04a408ad01791b
SHA512 1e9a0cc800543dada73e551ee714001c4d6c57a595ea2986a4dd8889d1dffd1557735580c694e5feb0b7c27c1a4b3e71a95fab8baf80839f42f80e2109cbe2d7

C:\Users\Admin\AppData\Local\Temp\vbc4E7F03B899A443C5A48FCC2DAAC52BFB.TMP

MD5 448990c986cecf7ed3eb463edc279c9a
SHA1 ea4e1965468c02c511a7cdfb8ccd31c72733ea88
SHA256 c932ed603667ea4f9520f0536f9be7205bbfa3edafe6be9ef8f256249c1aa678
SHA512 cff96c5ac029a1b67a0847f19e5f29d6a3da13a0af79fd51059b72cceacb82d250ebfe10cfa4422c9680fdb0a80cebdb17663891efee91a52f3ba75edbadbd4a

C:\Users\Admin\AppData\Local\Temp\RES804C.tmp

MD5 92eb411cd728169de7713f6fa454b6ad
SHA1 cd795ac9cf19ec8cc0dc7570a9927b5b11e60522
SHA256 487581e3122d4f75f8de819fbc364171331592334a2d3f3b0b0614144d40862e
SHA512 ff48aa96814791456ec0e22c15137105a4fd624a127f3364ef8df5f65e33f24a974f7853b5494a32775ef95e9c4b63f8ddb2c4a87394dfad94fb978b489269aa

memory/408-18-0x0000000075240000-0x00000000757F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7F42.tmp.exe

MD5 297876dead0d33d7cf40ab73017fdd38
SHA1 9c8a6d1453f193d063af3a0c3c91ddb31b10a2f1
SHA256 0d74da5fa82c9d9ed244cbc7016faca8808b09444c0cdf255418387297c80d5a
SHA512 96bdf44c8d02546552cbdce34ef4b1caac00eaa71636df4dcb474124bf829001281bf44724729adf0fa932c6a91e909ce03d0db65e4c8ec3b5aea2a8008423a6

memory/3864-22-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-24-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-23-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-25-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-26-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-27-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-28-0x0000000075240000-0x00000000757F1000-memory.dmp

memory/3936-29-0x0000000075240000-0x00000000757F1000-memory.dmp