Malware Analysis Report

2025-04-14 05:10

Sample ID 250106-kmg6rsvjcj
Target JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2
SHA256 f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4
Tags
stealer revengerat discovery persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4

Threat Level: Known bad

The file JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2 was found to be: Known bad.

Malicious Activity Summary

stealer revengerat discovery persistence trojan

RevengeRAT

Revengerat family

RevengeRat Executable

RevengeRat Executable

Drops startup file

Uses the VBS compiler for execution

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-06 08:42

Signatures

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A

Revengerat family

revengerat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-06 08:42

Reported

2025-01-06 08:45

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe"

Signatures

RevengeRAT

trojan revengerat

Revengerat family

revengerat

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.lnk C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.URL C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.vbs C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.js C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\4kTEAM = "C:\\Users\\Admin\\AppData\\Roaming\\TeamViewer-4k.exe" C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1864 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 1864 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 1864 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 1864 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 2656 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2656 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2656 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2656 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 884 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 884 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 884 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 884 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2656 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe
PID 2656 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe
PID 2656 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe
PID 2656 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe
PID 2596 wrote to memory of 2728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 2596 wrote to memory of 2728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 2596 wrote to memory of 2728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 2596 wrote to memory of 2728 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe"

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

"C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_kt9bggp.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE457.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE456.tmp"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /sc minute /mo 1 /tn "4kTEAM" /tr "C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {975C0800-82CC-44EA-BD04-70E7D3D1A532} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp

Files

memory/1864-0-0x0000000074511000-0x0000000074512000-memory.dmp

memory/1864-1-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/1864-2-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/1864-3-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/1864-4-0x0000000074510000-0x0000000074ABB000-memory.dmp

\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

MD5 19c8f7ceabfd03accfcbfb8698aabdd2
SHA1 7450580ec60ad5c82d6be51cbcf7f9a3cf55e25f
SHA256 f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4
SHA512 cb3507d419a7368665d32f255ddb830776a0f2d01287f9a8b559a53aaaa06d04f2396da8066553cf73e7e87e090f7bf3434ace5384a7426883db6ca90182ebe4

memory/1864-16-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/2656-17-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/2656-18-0x0000000074510000-0x0000000074ABB000-memory.dmp

memory/2656-19-0x0000000074510000-0x0000000074ABB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_kt9bggp.cmdline

MD5 40047d0cf92335c786e68843afe48c6d
SHA1 3abb83a49e65eba51d44d1bf3b1c87cb4c951533
SHA256 ba32fa35c096d087219623a50e442fab97964c57bf8cbea725e2cc907b78418a
SHA512 d6b02802edd14dee48a6b345bd66775f610168fec0872f46aa28073a02cd4689c467649168f19d206b798d3bd62fecfee89768f6cb479ff587cdafff2a7946d4

C:\Users\Admin\AppData\Local\Temp\_kt9bggp.0.vb

MD5 6f08a6843d6aab5c6c2f04127f9260a2
SHA1 545eff96fbc0d3c3d6759d158b71705904613114
SHA256 0737ebc854708f9f2ec8707c8e83adb8e1a4e8f83074cfc77a1eba0e0949f3a4
SHA512 2753cdb89404cd8147a524b4c2ce71317ad51b02a7bde5fa473877e828303b6302b8b82c0d3ca7ce62e901aa24c82d44da720f687b694a770fedaef913c1c3a6

C:\Users\Admin\AppData\Local\Temp\vbcE456.tmp

MD5 b2e2ac45261982d0eb75d0a4f9f7a4c5
SHA1 ab1741199faf69b1163a6ddaf5a739ede02858ab
SHA256 1a8da5a0397488b826932d7584733a714005a6e1f720da484d56e4f9677e96ae
SHA512 0a87dc721ffdc45f892529a0a2edc454bf87ec53e0b43cc1d0561e138493533ba244db9cc8395a061120d4323dc8b20b298a0d76da66dda429a6cb3d69d5d07a

C:\Users\Admin\AppData\Local\Temp\RESE457.tmp

MD5 394498da4237ad15b279ccad2dc59c69
SHA1 d97439dedddcda51e458ef367c7d21a74386306e
SHA256 61f78ee79360da44fbf7b2b6d5dd2d994f3712005945241b7fd98a402c70f09b
SHA512 9c91ec41786d2441593fabd5477c31d593510109452fc04c0d706bdc559e339ab60f4212e248badc74a4dd9f76072f21a3078db3dfdd155bff01494e5eb0c378

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-06 08:42

Reported

2025-01-06 08:45

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe"

Signatures

RevengeRAT

trojan revengerat

Revengerat family

revengerat

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.vbs C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.js C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.lnk C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TeamViewer-4k.URL C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4kTEAM = "C:\\Users\\Admin\\AppData\\Roaming\\TeamViewer-4k.exe" C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4692 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 4692 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 4692 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe
PID 3820 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3820 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3820 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3576 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3576 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3576 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3820 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe
PID 3820 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe
PID 3820 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8f7ceabfd03accfcbfb8698aabdd2.exe"

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

"C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ibsbiy1z.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB188.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc700E91A6916F4B3EBD3977C3292A6080.TMP"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /sc minute /mo 1 /tn "4kTEAM" /tr "C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe"

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp
US 8.8.8.8:53 w1nd0wsv3r1f1c4t10n.ddns.net udp

Files

memory/4692-0-0x00000000750B2000-0x00000000750B3000-memory.dmp

memory/4692-1-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/4692-2-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/4692-3-0x00000000750B2000-0x00000000750B3000-memory.dmp

memory/4692-4-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/4692-5-0x00000000750B0000-0x0000000075661000-memory.dmp

C:\Users\Admin\AppData\Roaming\TeamViewer-4k.exe

MD5 19c8f7ceabfd03accfcbfb8698aabdd2
SHA1 7450580ec60ad5c82d6be51cbcf7f9a3cf55e25f
SHA256 f10c42d174ddd54feb7137a49807904d489b9b7345a032a7b393b7e8f612d9e4
SHA512 cb3507d419a7368665d32f255ddb830776a0f2d01287f9a8b559a53aaaa06d04f2396da8066553cf73e7e87e090f7bf3434ace5384a7426883db6ca90182ebe4

memory/4692-18-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/3820-20-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/3820-21-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/3820-19-0x00000000750B0000-0x0000000075661000-memory.dmp

memory/3820-22-0x00000000750B0000-0x0000000075661000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ibsbiy1z.cmdline

MD5 ccc5df2090ecb63c2d7d42f3166f35e7
SHA1 e8a86c489810321a350fa085778b64387293d9d4
SHA256 d77ca15ca721a03f276a7f18766967ba1f4caff5a9cd5af474287d6716fb68c2
SHA512 24ea532c2dd6c214a0bbd45e2d72f50098fdd12a3b14d4c47b0fdeef034656c6a2854a7df9cd64a90f131e17093bc8b46c315b707ceec13de8db54c0eddf3cd3

memory/3576-37-0x00000000750B0000-0x0000000075661000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ibsbiy1z.0.vb

MD5 6f08a6843d6aab5c6c2f04127f9260a2
SHA1 545eff96fbc0d3c3d6759d158b71705904613114
SHA256 0737ebc854708f9f2ec8707c8e83adb8e1a4e8f83074cfc77a1eba0e0949f3a4
SHA512 2753cdb89404cd8147a524b4c2ce71317ad51b02a7bde5fa473877e828303b6302b8b82c0d3ca7ce62e901aa24c82d44da720f687b694a770fedaef913c1c3a6

C:\Users\Admin\AppData\Local\Temp\vbc700E91A6916F4B3EBD3977C3292A6080.TMP

MD5 b2e2ac45261982d0eb75d0a4f9f7a4c5
SHA1 ab1741199faf69b1163a6ddaf5a739ede02858ab
SHA256 1a8da5a0397488b826932d7584733a714005a6e1f720da484d56e4f9677e96ae
SHA512 0a87dc721ffdc45f892529a0a2edc454bf87ec53e0b43cc1d0561e138493533ba244db9cc8395a061120d4323dc8b20b298a0d76da66dda429a6cb3d69d5d07a

C:\Users\Admin\AppData\Local\Temp\RESB188.tmp

MD5 0760b1bd6feecab1ba29367d42a52ab5
SHA1 19ee7fb08a28212af36687d2d9e2b878b4186038
SHA256 6e0aa99e8177c7a889b820503d8e299d1189809ce1b1376e0ca2379cff2fe3b6
SHA512 28b642f890a662fe70bceea501e6014f1204e6d0523c5afa84deba191f054cf2008652eb7156efe6023e11fdc8f15b8aee871b948a247293e18ee89a69f4a852

memory/3576-46-0x00000000750B0000-0x0000000075661000-memory.dmp