Analysis Overview
SHA256
aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90
Threat Level: Known bad
The file aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe was found to be: Known bad.
Malicious Activity Summary
Stormkitty family
AsyncRat
StormKitty
Asyncrat family
Async RAT payload
StormKitty payload
A potential corporate email address has been identified in the URL: WorldWindProResultsDate2024112630524AMSystemWindows10Pro64BitUsernameAdminCompNameYLFOGIOELanguageenUSAntivirusNotinstalledHardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.1.54ExternalIP181.215.176.83BSSID1acd5d41dbb4DomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberDatabasefiles6TelegramChannel@XSplinter
Reads user/profile data of web browsers
Looks up geolocation information via web service
Legitimate hosting services abused for malware hosting/C2
Drops desktop.ini file(s)
Looks up external IP address via web service
Event Triggered Execution: Netsh Helper DLL
System Network Configuration Discovery: Wi-Fi Discovery
System Location Discovery: System Language Discovery
Unsigned PE
Browser Information Discovery
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-26 03:05
Signatures
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Asyncrat family
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-26 03:05
Reported
2024-11-26 03:07
Platform
win7-20240903-en
Max time kernel
118s
Max time network
116s
Command Line
Signatures
AsyncRat
Asyncrat family
StormKitty
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
Reads user/profile data of web browsers
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | icanhazip.com | N/A | N/A |
Looks up geolocation information via web service
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\chcp.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\chcp.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe
"C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
C:\Windows\SysWOW64\findstr.exe
findstr All
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | icanhazip.com | udp |
| US | 104.16.184.241:80 | icanhazip.com | tcp |
| US | 8.8.8.8:53 | api.mylnikov.org | udp |
| US | 172.67.196.114:443 | api.mylnikov.org | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:8808 | tcp |
Files
memory/2420-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp
memory/2420-1-0x0000000000B90000-0x0000000000BC2000-memory.dmp
memory/2420-2-0x0000000074CE0000-0x00000000753CE000-memory.dmp
C:\Users\Admin\AppData\Local\ca37f786b0b0d49d03ae0dee7341df51\Admin@VORHPBAB_en-US\Browsers\Firefox\Bookmarks.txt
| MD5 | 2e9d094dda5cdc3ce6519f75943a4ff4 |
| SHA1 | 5d989b4ac8b699781681fe75ed9ef98191a5096c |
| SHA256 | c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142 |
| SHA512 | d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7 |
memory/2420-73-0x0000000074CE0000-0x00000000753CE000-memory.dmp
memory/2420-77-0x0000000074CEE000-0x0000000074CEF000-memory.dmp
memory/2420-78-0x0000000074CE0000-0x00000000753CE000-memory.dmp
C:\Users\Admin\AppData\Local\24dff8c3177a860d0c17fe3c5f934c6d\msgid.dat
| MD5 | cfcd208495d565ef66e7dff9f98764da |
| SHA1 | b6589fc6ab0dc82cf12099d1c2d40ab994e8410c |
| SHA256 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 |
| SHA512 | 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99 |
memory/2420-84-0x0000000074CE0000-0x00000000753CE000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-26 03:05
Reported
2024-11-26 03:07
Platform
win10v2004-20241007-en
Max time kernel
114s
Max time network
121s
Command Line
Signatures
AsyncRat
Asyncrat family
StormKitty
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
A potential corporate email address has been identified in the URL: WorldWindProResultsDate2024112630524AMSystemWindows10Pro64BitUsernameAdminCompNameYLFOGIOELanguageenUSAntivirusNotinstalledHardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.1.54ExternalIP181.215.176.83BSSID1acd5d41dbb4DomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberDatabasefiles6TelegramChannel@XSplinter
Reads user/profile data of web browsers
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| File created | C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | icanhazip.com | N/A | N/A |
Looks up geolocation information via web service
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh | C:\Windows\SysWOW64\netsh.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\chcp.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\chcp.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\netsh.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe
"C:\Users\Admin\AppData\Local\Temp\aee2aa11f6035fd4ffa55099d0da2e01affd08e57aab1947a2ac6f641659cd90.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
C:\Windows\SysWOW64\findstr.exe
findstr All
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | icanhazip.com | udp |
| US | 104.16.184.241:80 | icanhazip.com | tcp |
| US | 8.8.8.8:53 | api.mylnikov.org | udp |
| US | 104.21.44.66:443 | api.mylnikov.org | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 241.184.16.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.44.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.3.235:443 | pastebin.com | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| N/A | 127.0.0.1:6606 | tcp | |
| US | 8.8.8.8:53 | 235.3.20.104.in-addr.arpa | udp |
| N/A | 127.0.0.1:8808 | tcp | |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:6606 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:8808 | tcp | |
| N/A | 127.0.0.1:7707 | tcp | |
| N/A | 127.0.0.1:8808 | tcp |
Files
memory/4480-0-0x00000000744AE000-0x00000000744AF000-memory.dmp
memory/4480-1-0x0000000000E70000-0x0000000000EA2000-memory.dmp
memory/4480-2-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/4480-3-0x00000000059C0000-0x0000000005A26000-memory.dmp
C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\Browsers\Firefox\Bookmarks.txt
| MD5 | 2e9d094dda5cdc3ce6519f75943a4ff4 |
| SHA1 | 5d989b4ac8b699781681fe75ed9ef98191a5096c |
| SHA256 | c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142 |
| SHA512 | d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7 |
memory/4480-101-0x00000000744AE000-0x00000000744AF000-memory.dmp
memory/4480-123-0x00000000744A0000-0x0000000074C50000-memory.dmp
C:\Users\Admin\AppData\Local\f8cde957709c3f32d36350c54c80b0e3\Admin@YLFOGIOE_en-US\System\Process.txt
| MD5 | 03fd76d7afe829500370f4a5b7b12e39 |
| SHA1 | 3658de2453edc88658f27818f8571f4ede850f2c |
| SHA256 | 246c4f208facf41ac7b548f0e56fe597580c01c5d07da14a34aef38a5287fd96 |
| SHA512 | b0a5448909eb5da54bfba36c4203d24170c7a6163b9690ddba528b3f8f1cc0bea625812003cd03dbaf4871d694feeb6fd2112ea73c0a04774aab21acca91f971 |
memory/4480-149-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/4480-151-0x00000000062D0000-0x0000000006362000-memory.dmp
memory/4480-152-0x0000000006AA0000-0x0000000007044000-memory.dmp
memory/4480-156-0x0000000006600000-0x000000000660A000-memory.dmp
C:\Users\Admin\AppData\Local\9fbf229ec67280cb3c9c4255ccb1dfb1\msgid.dat
| MD5 | cfcd208495d565ef66e7dff9f98764da |
| SHA1 | b6589fc6ab0dc82cf12099d1c2d40ab994e8410c |
| SHA256 | 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 |
| SHA512 | 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99 |
memory/4480-162-0x0000000006A80000-0x0000000006A92000-memory.dmp
memory/4480-187-0x00000000744A0000-0x0000000074C50000-memory.dmp