SHA256 - 04cc92b4e0f79ba841ba3c76651c8968d6525d4805829dd875f7a34034ffa460

MD5 - 8a971e9fe9fa2c3005ee1eb9c143b331

Language - c/c++

The link below has network moitoring and iocs related to the suspicous IP.

VirusTotal

Static Analysis

Strings

A
dmin\\AppData\\Local\\Temp
TMP=C:\\Users\\Admin\\AppData\\Local\\Temp
USERDOMAIN=THZSENLF
USERDOMAIN_ROAMINGPROFILE=THZSENLF
USERNAME=Admin
USERPRx
dmin\\AppData\\Local\\Temp
TMP=C:\\Users\\Admin\\AppData\\Local\\Temp
USERDOMAIN=THZSENLF
USERDOMAIN_ROAMINGPROFILE=THZSENLF
USERNAME=Admin
USERPROFILE=C:\\Users\\Admin
windir=C:\\
ltraDefrag
USERDOMAIN=WIN10
USERDOMAIN_ROAMINGPROFILE=WIN10
USERNAME=maxine
USERPROFI
OWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\WINDOW
ltraDefrag
USERDOMAIN=WIN10
USERDOMAIN_ROAMINGPROFILE=WIN10
USERNAME=maxine
USERPROFILE=C:\\Users\\maxine
windir=C:\\Wind
min\\AppData\\Local\\Temp
TMP=C:\\Users\\Admin\\AppData\\Local\\Te
ltraDefrag
USERDOMAIN=WIN
min\\AppData\\Local\\Temp
TMP=C:\\Users\\Admin\\AppData\\Local\\Temp
USERDOMAIN=GJWRVADZ
USERDOMAIN_ROAMINGPROFILE=GJWRVADZ
min\\AppData\\Local\\Temp
TMP=C:\\Users\\Admin\\AppData\\Local\\Temp
USERDOMAIN=GJWRVADZ
USERDOMAIN_ROAMINGPROFILE=GJWRVADZ
USERNAME=Admin
USERPROFILE=C:\\Users\\Admin
windir=C:\\Win

IATS

 	LoadLibraryA
	GetProcAddress
	VirtualProtect
	VirtualAlloc
	VirtualFree
	ExitProcess

Dynamic Analysis

Network IOCs:

Malicious IP -

107.163.241.232

WireShark: