Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.Win32.PWSX-gen.23172.5539.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.23172.5539.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23172.5539.exe
|
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23172.5539.exe
|
|
|
|
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23172.5539.exe
|
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.23172.5539.exe
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
|
unknown
|
||
|
http://ocsp.sectigo.com0A
|
unknown
|
||
|
https://sectigo.com/CPS0
|
unknown
|
||
|
http://us2.smtp.mailhostbox.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
us2.smtp.mailhostbox.com
|
208.91.198.143
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.91.198.143
|
us2.smtp.mailhostbox.com
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F71000
|
trusted library allocation
|
page read and write
|
|
|
|
3FFE000
|
trusted library allocation
|
page read and write
|
|
|
|
1914000
|
trusted library allocation
|
page read and write
|
||
|
E25000
|
heap
|
page read and write
|
||
|
5940000
|
trusted library allocation
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
2FC3000
|
trusted library allocation
|
page read and write
|
||
|
E95000
|
heap
|
page read and write
|
||
|
18BD000
|
stack
|
page read and write
|
||
|
2FF9000
|
trusted library allocation
|
page read and write
|
||
|
7750000
|
heap
|
page read and write
|
||
|
A2DF000
|
stack
|
page read and write
|
||
|
D39000
|
stack
|
page read and write
|
||
|
FED000
|
trusted library allocation
|
page execute and read and write
|
||
|
FE0000
|
trusted library allocation
|
page read and write
|
||
|
12BE000
|
stack
|
page read and write
|
||
|
1770000
|
heap
|
page read and write
|
||
|
1902000
|
trusted library allocation
|
page read and write
|
||
|
2DCE000
|
stack
|
page read and write
|
||
|
1170000
|
trusted library allocation
|
page read and write
|
||
|
1095000
|
heap
|
page read and write
|
||
|
1367000
|
heap
|
page read and write
|
||
|
7650000
|
trusted library section
|
page read and write
|
||
|
1380000
|
trusted library allocation
|
page read and write
|
||
|
3E29000
|
trusted library allocation
|
page read and write
|
||
|
5304000
|
trusted library allocation
|
page read and write
|
||
|
53D0000
|
trusted library section
|
page readonly
|
||
|
57D0000
|
trusted library section
|
page read and write
|
||
|
C39000
|
stack
|
page read and write
|
||
|
A1DF000
|
stack
|
page read and write
|
||
|
1200000
|
heap
|
page read and write
|
||
|
59DD000
|
trusted library allocation
|
page read and write
|
||
|
E88000
|
heap
|
page read and write
|
||
|
5F80000
|
heap
|
page read and write
|
||
|
43E000
|
remote allocation
|
page execute and read and write
|
||
|
1330000
|
trusted library allocation
|
page read and write
|
||
|
F07000
|
heap
|
page read and write
|
||
|
57DE000
|
stack
|
page read and write
|
||
|
6200000
|
trusted library allocation
|
page execute and read and write
|
||
|
569E000
|
stack
|
page read and write
|
||
|
1920000
|
trusted library allocation
|
page read and write
|
||
|
57F5000
|
heap
|
page read and write
|
||
|
1024000
|
heap
|
page read and write
|
||
|
2E10000
|
heap
|
page execute and read and write
|
||
|
57E0000
|
trusted library allocation
|
page read and write
|
||
|
FD0000
|
trusted library allocation
|
page read and write
|
||
|
1031000
|
heap
|
page read and write
|
||
|
5300000
|
trusted library allocation
|
page read and write
|
||
|
8AF7000
|
trusted library allocation
|
page read and write
|
||
|
1340000
|
trusted library allocation
|
page execute and read and write
|
||
|
102F000
|
heap
|
page read and write
|
||
|
581D000
|
stack
|
page read and write
|
||
|
53B0000
|
trusted library allocation
|
page read and write
|
||
|
117D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7070000
|
heap
|
page read and write
|
||
|
770E000
|
stack
|
page read and write
|
||
|
E60000
|
heap
|
page read and write
|
||
|
53AA000
|
trusted library allocation
|
page read and write
|
||
|
5450000
|
heap
|
page read and write
|
||
|
FFB000
|
heap
|
page read and write
|
||
|
18DE000
|
trusted library allocation
|
page read and write
|
||
|
3F13000
|
trusted library allocation
|
page read and write
|
||
|
59A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5360000
|
heap
|
page read and write
|
||
|
E53000
|
trusted library allocation
|
page execute and read and write
|
||
|
F0E000
|
heap
|
page read and write
|
||
|
18FD000
|
trusted library allocation
|
page read and write
|
||
|
624D000
|
stack
|
page read and write
|
||
|
59A0000
|
trusted library allocation
|
page read and write
|
||
|
5600000
|
heap
|
page execute and read and write
|
||
|
43C000
|
remote allocation
|
page execute and read and write
|
||
|
794F000
|
stack
|
page read and write
|
||
|
1306000
|
trusted library allocation
|
page execute and read and write
|
||
|
17BC000
|
stack
|
page read and write
|