Malware Analysis Report

2024-11-16 13:11

Sample ID 241108-y7cnnsyjht
Target 1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f
SHA256 1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f
Tags
metamorpherrat discovery rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f

Threat Level: Known bad

The file 1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f was found to be: Known bad.

Malicious Activity Summary

metamorpherrat discovery rat stealer trojan

Metamorpherrat family

MetamorpherRAT

Loads dropped DLL

Deletes itself

Executes dropped EXE

Uses the VBS compiler for execution

Checks computer location settings

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 20:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 20:25

Reported

2024-11-08 20:27

Platform

win7-20240903-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Metamorpherrat family

metamorpherrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2512 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2164 wrote to memory of 2568 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2164 wrote to memory of 2568 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2164 wrote to memory of 2568 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2164 wrote to memory of 2568 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2512 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe
PID 2512 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe
PID 2512 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe
PID 2512 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe

"C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7mg6aqe3.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC2F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC2E.tmp"

C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe" C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp

Files

memory/2512-0-0x0000000073E01000-0x0000000073E02000-memory.dmp

memory/2512-1-0x0000000073E00000-0x00000000743AB000-memory.dmp

memory/2512-2-0x0000000073E00000-0x00000000743AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7mg6aqe3.cmdline

MD5 3bfc6a1b2e8fea660ba3243134b91383
SHA1 fe9ad599a994077ab86513dc85944ffc120535a1
SHA256 a447e2ca6c80c2ce19c2dd4ed451366cffdb9a92eab8ec58c0dbeeb283398fac
SHA512 43f42ee1f35a98c134bd1d7832076c977bad2362e93784dcd72b7b91ea0b5e6315bf3cb2991b65a4b58494a393f6668912af6e41c1a6ffdc60e2bdc41b55a999

memory/2164-8-0x0000000073E00000-0x00000000743AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7mg6aqe3.0.vb

MD5 dd7c931ffb53fb0bc09d95fcc005737c
SHA1 f3843387cf57c6f10df77ddbf79ffe3fffabd965
SHA256 8ed1d28b3b49b12b3d7f0805c2caf1c2995820d241cd9005cf42c55b08977956
SHA512 f60dc347031cf3bf7196119a6b39cafce512d52be8998c4e9f6547f0ff65ee3db7a24ab8319a88d2f39d59955ab8a28f9aa0b0234f71ed91ff38461c4a236523

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 8008b17644b64cea2613d47c30c6e9f4
SHA1 4cd2935358e7a306af6aac6d1c0e495535bd5b32
SHA256 fc343d0c2ee741f89cc4f187d7b6694397765e151dbc737052df4c19d7a36c55
SHA512 0c1161a8ebcc659ffd920f0607cc751ece0a0c918a8d3b8f8ca508ebc03b854c29bd0bdf1518922c4525a825f90ef3bca8c7540975d4ecab9182b9f0ce6880ea

C:\Users\Admin\AppData\Local\Temp\vbcBC2E.tmp

MD5 07530c7b67251efb3f66fb2b6f72e037
SHA1 949d307619f71f1171f90cef064c92315169a562
SHA256 c8bb3ddb23a1e51c073c7187d07c738ebd9d56c432376653a9640a33778eeb15
SHA512 2540ea30db95652812b082746abf91f41a2b29da1d34b1b75e11c70d401f20e1b121494ae54d21530938b3056274ad7153c18a121ab77b9ab4d5103a2bb03c0e

C:\Users\Admin\AppData\Local\Temp\RESBC2F.tmp

MD5 b2a4fb4f389ab0b4fcef3c1854a8ced6
SHA1 b12a3597bbf489f4b49d5ccbfa6a2b8297c77900
SHA256 54ccfcdf564b37b16dc8482202d1ce223dcdda869f2b9eb4d44330c9a798e05e
SHA512 928f03ac3f7740cd35ee40b957e6a3cff0705665d026b1556bf0ef8f898c68c6914b4f90a1a2b465fdedee6ad47cca5c265dfe85ee6d1b04e572d5e6d4646443

memory/2164-18-0x0000000073E00000-0x00000000743AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpBB15.tmp.exe

MD5 75cb575e506ce4e6ef473a034325faa3
SHA1 cfb9d9e01c0d8a154058f7995a9d0757dab6a34b
SHA256 234b158def6c4727117c588d51141a9175a20b9798801450c91cf15bed181c14
SHA512 8f0fd649c9a39f8612d31e834ad1a28775cdf061a319b8e0b42dcb64a8064cefc740cac6ea79bc31a152f41276e1d19ca214e11fd9f47aa0b2d55204360ec55d

memory/2512-24-0x0000000073E00000-0x00000000743AB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 20:25

Reported

2024-11-08 20:27

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe"

Signatures

MetamorpherRAT

trojan rat stealer metamorpherrat

Metamorpherrat family

metamorpherrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4040 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2448 wrote to memory of 4304 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2448 wrote to memory of 4304 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2448 wrote to memory of 4304 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4040 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe
PID 4040 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe
PID 4040 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe

"C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ls0os32v.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F7E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcACDF74E6498F4711A93688B34E057C4.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe" C:\Users\Admin\AppData\Local\Temp\1e1c24f07838641dc4dbf5be3897fa4ecda27d3bd9bd7db32eb98af15a96790f.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 bejnz.com udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 simrat.no-ip.info udp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 44.221.84.105:80 bejnz.com tcp
US 8.8.8.8:53 udp

Files

memory/4040-0-0x0000000074742000-0x0000000074743000-memory.dmp

memory/4040-1-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/4040-2-0x0000000074740000-0x0000000074CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ls0os32v.cmdline

MD5 4fe8a2687665e58ad86330480b081082
SHA1 94c76f67185918506c78f75a0bbf7144de6c1833
SHA256 2fa895ac8f1d6da0e4e75d1fcc8382c74a5b49a627caccb9e057f5ae394a8b4a
SHA512 7f07949ca244ed8f7ff4d9a15ec8cf526d03207e88ea867d8ddc34642e615da675290022009d569031594f60f766eedb6f52eebf3425c976e1709a35ba80f3d6

memory/2448-8-0x0000000074740000-0x0000000074CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ls0os32v.0.vb

MD5 0cbc80c7393295d32b309b65b0723590
SHA1 cc3a4d86dc44d4dbae8f0fd3808a3b29451b0254
SHA256 597b38086795384fe09c28debcc6b1d0ac3614b5471f5c0b896fa5576e2504cc
SHA512 27f1f5c6b8d20f94a46e6152536d6e417c13bbedbf8a6ca4efe91be997802e594e716bec398d768cd8c8365f718c5970c9fbee90e4b5bb88e19201108cbb76b2

C:\Users\Admin\AppData\Local\Temp\zCom.resources

MD5 8008b17644b64cea2613d47c30c6e9f4
SHA1 4cd2935358e7a306af6aac6d1c0e495535bd5b32
SHA256 fc343d0c2ee741f89cc4f187d7b6694397765e151dbc737052df4c19d7a36c55
SHA512 0c1161a8ebcc659ffd920f0607cc751ece0a0c918a8d3b8f8ca508ebc03b854c29bd0bdf1518922c4525a825f90ef3bca8c7540975d4ecab9182b9f0ce6880ea

C:\Users\Admin\AppData\Local\Temp\vbcACDF74E6498F4711A93688B34E057C4.TMP

MD5 1b731e2ee3974d446813cbeb2577bae5
SHA1 1ef84208e73cb10cb4e5ad1d93f9af93d3ab94d4
SHA256 80910c8da0a7856b5df539a5827e256a58383a3c01e8933b6af8a83a1fbf3f69
SHA512 e7d3a84138c674d4c43967911dbd52b6b4692b83ac1341007432409590345e1c89e7c16391ccc0ed991cb14d182eb8176a9622f6d40458e0d90b48021270b2d7

C:\Users\Admin\AppData\Local\Temp\RES8F7E.tmp

MD5 1cbbe74d457916b4c684ce54e7cc2c6b
SHA1 b031707f451db3c83c692e23e638ea53b22c0be5
SHA256 e80a3effc0be75fc843994a53c13d1ce445500c0237f6bfd3e55825f41099cd3
SHA512 5ef4413b0ce61f363db5100cd83036556534d041dc17cb5756b1a0328e902d711c3c2e32858b02b20f40dc868642da389939512eedd411c6585315e2c73c060c

memory/2448-18-0x0000000074740000-0x0000000074CF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8E55.tmp.exe

MD5 88dee95bb790639f18cc6936c0f88b39
SHA1 7a10e71be532ba47e24fc8dd2ae9954c7e4a4140
SHA256 db64abc17138e9e0b61ff7a85ad582fc2be5728d8bc060afd9726835c7f9d3cf
SHA512 2f74c6f7b39ea25a3f5198f3079ef377f6f27d9ab632f1f63363ac49ce5f514bd8efb428ebf837faa2bd04f520c30dda405b14d3b1dd6107a4b7b5939c2cb76b

memory/4040-22-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/716-23-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/716-24-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/716-25-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/716-26-0x0000000074740000-0x0000000074CF1000-memory.dmp

memory/716-27-0x0000000074740000-0x0000000074CF1000-memory.dmp