Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

1m70ggeepT.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.599795686012734
Filename:	1m70ggeepT.exe
Filesize:	494592
MD5:	06f5b8dffc6c138828adbc7f29cfc7f0
SHA1:	b59ef5d613a1e49c7034c3ee05780ce054ca0054
SHA256:	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
SHA512:	e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
SSDEEP:	6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-H..~H..~H..~.f$~[..~.f&~...~.f'~V..~A.Q~I..~.Z.~J..~....R..~....r..~....j..~A.F~Q..~H..~u..~....,..~..*~I..~....I..~RichH..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder Access Token Manipulation System Time Discovery
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery Ingress Tool Transfer
Machine Learning detection for sample	AV Detection
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery Ingress Tool Transfer
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation Security Software Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Process Discovery
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found evaded block containing many API calls	Malware Analysis System Evasion	Native API Access Token Manipulation Process Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information Security Software Discovery
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery Security Software Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates an autostart registry key	Boot Survival	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Might use command line arguments	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Public key (encryption) found	Cryptography	Account Discovery Security Software Discovery System Owner/User Discovery Archive Collected Data
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation Security Software Discovery
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\AppData\Roaming\microsofts\svcs.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Category:	dropped
Dump:	svcs.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\1m70ggeepT.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.599795686012734
Encrypted:	false
Ssdeep:	6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv
Size:	494592
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for dropped file	AV Detection
Abnormal high CPU Usage	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Spawns processes	System Summary	Process Injection

C:\ProgramData\logsa\logs.dat

data

dropped

Details

File:	C:\ProgramData\logsa\logs.dat
Category:	dropped
Dump:	logs.dat.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Type:	data
Entropy:	7.383946551870991
Encrypted:	false
Ssdeep:	6:nMsZwnfQSvGc6Zyk89M8dxQnM/OITxUfwkMFKrzmqSczxPRTAl6sWEsWmssHbB1:n8nfBvY8N/OsSaRqSsUl1HsWmsKbj
Size:	360
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\microsofts\svcs.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe:Zone.Identifier
Category:	modified
Dump:	svcs.exe_Zone.Identifier.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\1m70ggeepT.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Detected Remcos RAT	Remote Access Functionality	Remote Access Software
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for dropped file	AV Detection
Abnormal high CPU Usage	System Summary
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion
Tries to load missing DLLs	System Summary	DLL Side-Loading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\1m70ggeepT.exe

"C:\Users\user\Desktop\1m70ggeepT.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6544
Target ID:	0
Parent PID:	1028
Name:	1m70ggeepT.exe
Path:	C:\Users\user\Desktop\1m70ggeepT.exe
Commandline:	"C:\Users\user\Desktop\1m70ggeepT.exe"
Size:	494592
MD5:	06F5B8DFFC6C138828ADBC7F29CFC7F0
Time:	05:12:52
Date:	29/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Machine Learning detection for sample	AV Detection
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\AppData\Roaming\microsofts\svcs.exe

"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"

Details

Is windows:	false
Is dropped:	true
PID:	5528
Target ID:	1
Parent PID:	6544
Name:	svcs.exe
Path:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Commandline:	"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"
Size:	494592
MD5:	06F5B8DFFC6C138828ADBC7F29CFC7F0
Time:	05:12:52
Date:	29/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\microsofts\svcs.exe

"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"

Details

Is windows:	false
Is dropped:	true
PID:	5864
Target ID:	3
Parent PID:	1028
Name:	svcs.exe
Path:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Commandline:	"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"
Size:	494592
MD5:	06F5B8DFFC6C138828ADBC7F29CFC7F0
Time:	05:13:02
Date:	29/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\microsofts\svcs.exe

"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"

Details

Is windows:	false
Is dropped:	true
PID:	5324
Target ID:	4
Parent PID:	1028
Name:	svcs.exe
Path:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Commandline:	"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"
Size:	494592
MD5:	06F5B8DFFC6C138828ADBC7F29CFC7F0
Time:	05:13:10
Date:	29/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\microsofts\svcs.exe

"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"

Details

Is windows:	false
Is dropped:	true
PID:	4616
Target ID:	6
Parent PID:	1028
Name:	svcs.exe
Path:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Commandline:	"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"
Size:	494592
MD5:	06F5B8DFFC6C138828ADBC7F29CFC7F0
Time:	05:13:19
Date:	29/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	532480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sigma detected: Remcos	Stealing of Sensitive Information
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://geoplugin.net/json.gp

unknown

http://geoplugin.net/json.gp/C

unknown

leetboy.dynuddns.net

Details

Name:	leetboy.dynuddns.net
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\1m70ggeepT.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

Domains

Name

Malicious

leetboy.dynuddns.net

185.196.11.223

Details

Name:	leetboy.dynuddns.net
IP:	185.196.11.223
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

185.196.11.223

leetboy.dynuddns.net

Switzerland

Details

IP:	185.196.11.223
TargetID:	1
Current Path:	C:\Users\user\AppData\Roaming\microsofts\svcs.exe
Country:	Switzerland
Countrycode:	CHE
ASN number:	42624
ASN name:	SIMPLECARRIERCH
Private:	false
Domain:	leetboy.dynuddns.net

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Rmc-3XK1S0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	Rmc-3XK1S0
Value data:	"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\Rmc-3XK1S0

exepath

HKEY_CURRENT_USER\SOFTWARE\Rmc-3XK1S0

licence

HKEY_CURRENT_USER\SOFTWARE\Rmc-3XK1S0

time

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

Rmc-3XK1S0

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Value name:	Rmc-3XK1S0
Value data:	"C:\Users\user\AppData\Roaming\microsofts\svcs.exe"

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

Memdumps

Base Address

Regiontype

Protect

Malicious

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

5C7000

heap

page read and write

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

459000

unkown

page readonly

76E000

heap

page read and write

236F000

stack

page read and write

226C000

stack

page read and write

401000

unkown

page execute read

610000

heap

page read and write

401000

unkown

page execute read

65A000

heap

page read and write

478000

unkown

page readonly

60E000

stack

page read and write

691000

heap

page read and write

297F000

stack

page read and write

471000

unkown

page write copy

4D0000

heap

page read and write

2ABF000

stack

page read and write

478000

unkown

page readonly

25F0000

heap

page read and write

25EF000

stack

page read and write

400000

unkown

page readonly

270F000

unkown

page read and write

474000

unkown

page read and write

79B000

heap

page read and write

6DE000

stack

page read and write

400000

unkown

page readonly

19D000

stack

page read and write

80E000

stack

page read and write

750000

heap

page read and write

98F000

stack

page read and write

95E000

stack

page read and write

5B0000

heap

page read and write

505000

heap

page read and write

80E000

stack

page read and write

4CE000

stack

page read and write

478000

unkown

page readonly

1F0000

heap

page read and write

401000

unkown

page execute read

90F000

stack

page read and write

25EE000

stack

page read and write

262E000

stack

page read and write

760000

heap

page read and write

94F000

stack

page read and write

4CE000

stack

page read and write

84E000

stack

page read and write

9C000

stack

page read and write

401000

unkown

page execute read

540000

heap

page read and write

471000

unkown

page write copy

9B000

stack

page read and write

21A0000

heap

page read and write

19D000

stack

page read and write

471000

unkown

page read and write

1F0000

heap

page read and write

65E000

heap

page read and write

2670000

heap

page read and write

478000

unkown

page readonly

4CE000

stack

page read and write

471000

unkown

page read and write

1F0000

heap

page read and write

19C000

stack

page read and write

471000

unkown

page read and write

500000

heap

page read and write

478000

unkown

page readonly

478000

unkown

page readonly

400000

unkown

page readonly

287F000

stack

page read and write

400000

unkown

page readonly

400000

unkown

page readonly

4DE000

stack

page read and write

474000

unkown

page read and write

2AFE000

stack

page read and write

2210000

heap

page read and write

94F000

stack

page read and write

617000

heap

page read and write

401000

unkown

page execute read

71E000

stack

page read and write

2C3C000

stack

page read and write

5C0000

heap

page read and write

88E000

stack

page read and write

471000

unkown

page write copy

401000

unkown

page execute read

474000

unkown

page read and write

760000

heap

page read and write

471000

unkown

page write copy

490000

heap

page read and write

478000

unkown

page readonly

4F0000

heap

page read and write

630000

heap

page read and write

401000

unkown

page execute read

4D0000

heap

page read and write

650000

heap

page read and write

590000

heap

page read and write

21A0000

heap

page read and write

400000

unkown

page readonly

76A000

heap

page read and write

471000

unkown

page read and write

2BFF000

stack

page read and write

277E000

stack

page read and write

474000

unkown

page read and write

550000

heap

page read and write

400000

unkown

page readonly

471000

unkown

page read and write

560000

heap

page read and write

212E000

stack

page read and write

1F0000

heap

page read and write

9C000

stack

page read and write

24EE000

stack

page read and write

51E000

stack

page read and write

24AF000

stack

page read and write

474000

unkown

page read and write

61E000

stack

page read and write

9C000

stack

page read and write

478000

unkown

page readonly

19A000

stack

page read and write

222F000

stack

page read and write

595000

heap

page read and write

400000

unkown

page readonly

62C000

heap

page read and write

401000

unkown

page execute read

266E000

stack

page read and write

471000

unkown

page write copy

547000

heap

page read and write

29BE000

stack

page read and write

23AC000

stack

page read and write

720000

heap

page read and write

400000

unkown

page readonly

401000

unkown

page execute read

1F0000

heap

page read and write

5DE000

stack

page read and write

478000

unkown

page readonly

401000

unkown

page execute read

2D3C000

stack

page read and write

478000

unkown

page readonly

4D0000

heap

page read and write

400000

unkown

page readonly

510000

heap

page read and write

9C000

stack

page read and write

19D000

stack

page read and write

There are 137 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
1m70ggeepT.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report1m70ggeepT.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
1m70ggeepT.exe