IOC Report
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.31436.29895.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.31436.29895.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_0c57672e7cfd9f6c5592dfeabe7936895a9ce21_8f52b1cc_a2296afc-3fdd-41c9-b2c7-b7ebd5d52e4e\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD635.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Feb 12 19:39:07 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6C3.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD702.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.31436.29895.exe
C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.31436.29895.exe
malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 236

URLs

Name
IP
Malicious
http://www.clamav.net
unknown
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
ProgramId
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
FileId
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
LowerCaseLongPath
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
LongPathHash
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
Name
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
OriginalFileName
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
Publisher
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
Version
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
BinFileVersion
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
BinaryType
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
ProductName
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
ProductVersion
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
LinkDate
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
BinProductVersion
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
AppxPackageFullName
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
AppxPackageRelativeId
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
Size
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
Language
\REGISTRY\A\{e57e56f4-54f6-df88-e218-a349cee23177}\Root\InventoryApplicationFile\securiteinfo.com|267aa3b86586af1a
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page readonly
4F0000
heap
page read and write
401000
unkown
page execute read
414000
unkown
page write copy
610000
heap
page read and write
41C000
unkown
page readonly
41C000
unkown
page readonly
41E000
unkown
page readonly
1F0000
heap
page read and write
400000
unkown
page readonly
401000
unkown
page execute read
61A000
heap
page read and write
9D000
stack
page read and write
41E000
unkown
page readonly
19D000
stack
page read and write
500000
heap
page read and write
61E000
heap
page read and write
414000
unkown
page write copy
There are 8 hidden memdumps, click here to show them.