Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
FedEx_AWB#53023114643.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FedEx_AWB#53023114643.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\188E93\31437F.lck
|
very short file (no magic)
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\21c8026919fd094ab07ec3c180a9f210_9e146be9-c76a-4720-bcdb-53011b87bd06
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\FedEx_AWB#53023114643.exe
|
"C:\Users\user\Desktop\FedEx_AWB#53023114643.exe"
|
|
|
|
C:\Users\user\Desktop\FedEx_AWB#53023114643.exe
|
"C:\Users\user\Desktop\FedEx_AWB#53023114643.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://kbfvzoboss.bid/alien/fre.php
|
|
||
|
http://24.199.107.111/index.php/0672554332862
|
24.199.107.111
|
|
|
|
http://alphastand.top/alien/fre.php
|
|
||
|
http://alphastand.win/alien/fre.php
|
|
||
|
http://alphastand.trade/alien/fre.php
|
|
||
|
http://24.199.107.111/index.php/0672554332862W
|
unknown
|
||
|
http://24.199.107.111/index.php/wp-json/
|
unknown
|
||
|
https://gmpg.org
|
unknown
|
||
|
http://www.ibsensoftware.com/
|
unknown
|
||
|
https://api.w.org/
|
unknown
|
||
|
http://24.199.107.111/index.php/comments/feed/
|
unknown
|
||
|
https://gmpg.org/xfn/11
|
unknown
|
||
|
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
|
unknown
|
||
|
http://24.199.107.111/index.php/feed/
|
unknown
|
There are 4 hidden URLs, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
24.199.107.111
|
unknown
|
United States
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
E38000
|
heap
|
page read and write
|
|
|
|
39CE000
|
trusted library allocation
|
page read and write
|
|
|
|
39B4000
|
trusted library allocation
|
page read and write
|
|
|
|
2665000
|
trusted library allocation
|
page read and write
|
|
|
|
2570000
|
trusted library allocation
|
page read and write
|
||
|
C80000
|
trusted library allocation
|
page read and write
|
||
|
33A000
|
stack
|
page read and write
|
||
|
4FB0000
|
heap
|
page read and write
|
||
|
A08000
|
heap
|
page read and write
|
||
|
256E000
|
stack
|
page read and write
|
||
|
2590000
|
trusted library allocation
|
page read and write
|
||
|
102F000
|
stack
|
page read and write
|
||
|
2AF2000
|
trusted library allocation
|
page read and write
|
||
|
CFC000
|
stack
|
page read and write
|
||
|
695E000
|
stack
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
2AFE000
|
trusted library allocation
|
page read and write
|
||
|
9A1E000
|
stack
|
page read and write
|
||
|
C84000
|
trusted library allocation
|
page read and write
|
||
|
C60000
|
heap
|
page read and write
|
||
|
864000
|
trusted library allocation
|
page read and write
|
||
|
850000
|
trusted library allocation
|
page read and write
|
||
|
6C1E000
|
stack
|
page read and write
|
||
|
A0C000
|
heap
|
page read and write
|
||
|
88A000
|
trusted library allocation
|
page execute and read and write
|
||
|
25A0000
|
trusted library allocation
|
page read and write
|
||
|
991E000
|
stack
|
page read and write
|
||
|
2A40000
|
heap
|
page read and write
|
||
|
67C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
67E8000
|
trusted library allocation
|
page read and write
|
||
|
2651000
|
trusted library allocation
|
page read and write
|
||
|
220000
|
unkown
|
page readonly
|
||
|
726F000
|
stack
|
page read and write
|
||
|
C50000
|
trusted library allocation
|
page execute and read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
7270000
|
trusted library section
|
page read and write
|
||
|
4C00000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C20000
|
heap
|
page read and write
|
||
|
A15000
|
heap
|
page read and write
|
||
|
89B000
|
trusted library allocation
|
page execute and read and write
|
||
|
6A80000
|
trusted library allocation
|
page read and write
|
||
|
C70000
|
trusted library allocation
|
page read and write
|
||
|
51DE000
|
stack
|
page read and write
|
||
|
3B0000
|
heap
|
page read and write
|
||
|
294E000
|
stack
|
page read and write
|
||
|
CA6000
|
trusted library allocation
|
page read and write
|
||
|
A17000
|
heap
|
page read and write
|
||
|
9BF000
|
stack
|
page read and write
|
||
|
880000
|
trusted library allocation
|
page read and write
|
||
|
4FD0000
|
heap
|
page read and write
|
||
|
9B1F000
|
stack
|
page read and write
|
||
|
9C20000
|
heap
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
863000
|
trusted library allocation
|
page execute and read and write
|
||
|
2580000
|
trusted library allocation
|
page read and write
|
||
|
2611000
|
trusted library allocation
|
page read and write
|
||
|
C0E000
|
stack
|
page read and write
|
||
|
CB2000
|
trusted library allocation
|
page read and write
|
||
|
4D50000
|
heap
|
page read and write
|
||
|
69FE000
|
stack
|
page read and write
|
||
|
C4C000
|
stack
|
page read and write
|
||
|
4E10000
|
heap
|
page read and write
|
||
|
4C23000
|
heap
|
page read and write
|
||
|
7300000
|
trusted library section
|
page read and write
|
||
|
4A0000
|
remote allocation
|
page execute and read and write
|
||
|
38CA000
|
trusted library allocation
|
page read and write
|
||
|
94C000
|
stack
|
page read and write
|
||
|
8B0000
|
heap
|
page read and write
|
||
|
886000
|
trusted library allocation
|
page execute and read and write
|
||
|
ACE000
|
heap
|
page read and write
|
||
|
BCE000
|
stack
|
page read and write
|
||
|
4DF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D60000
|
heap
|
page read and write
|
||
|
4D30000
|
trusted library section
|
page readonly
|
||
|
E30000
|
heap
|
page read and write
|
||
|
9C0000
|
heap
|
page read and write
|
||
|
2ADF000
|
trusted library allocation
|
page read and write
|
||
|
6BDE000
|
stack
|
page read and write
|
||
|
6A90000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C10000
|
trusted library allocation
|
page read and write
|
||
|
67E0000
|
trusted library allocation
|
page read and write
|
||
|
4618000
|
trusted library allocation
|
page read and write
|
||
|
C9E000
|
trusted library allocation
|
page read and write
|
||
|
4BF0000
|
trusted library allocation
|
page read and write
|
||
|
A75000
|
heap
|
page read and write
|
||
|
7310000
|
trusted library allocation
|
page read and write
|
||
|
72F0000
|
trusted library allocation
|
page read and write
|
||
|
C8B000
|
trusted library allocation
|
page read and write
|
||
|
CA1000
|
trusted library allocation
|
page read and write
|
||
|
2B0F000
|
trusted library allocation
|
page read and write
|
||
|
9C0000
|
trusted library allocation
|
page read and write
|
||
|
4D2B000
|
stack
|
page read and write
|
||
|
25C0000
|
trusted library allocation
|
page read and write
|
||
|
2F8F000
|
stack
|
page read and write
|
||
|
3A68000
|
trusted library allocation
|
page read and write
|
||
|
4E90000
|
heap
|
page execute and read and write
|
||
|
892000
|
trusted library allocation
|
page read and write
|
||
|
6ADE000
|
stack
|
page read and write
|
||
|
3FD000
|
stack
|
page read and write
|
||
|
50A0000
|
heap
|
page read and write
|
||
|
810000
|
heap
|
page read and write
|
||
|
67D0000
|
trusted library allocation
|
page read and write
|
||
|
6F7000
|
stack
|
page read and write
|
||
|
860000
|
trusted library allocation
|
page read and write
|
||
|
222000
|
unkown
|
page readonly
|
||
|
26A3000
|
trusted library allocation
|
page read and write
|
||
|
3611000
|
trusted library allocation
|
page read and write
|
||
|
4BE0000
|
heap
|
page read and write
|
||
|
9F2000
|
heap
|
page read and write
|
||
|
3619000
|
trusted library allocation
|
page read and write
|
||
|
26A5000
|
trusted library allocation
|
page read and write
|
||
|
4D65000
|
heap
|
page read and write
|
||
|
3A0000
|
heap
|
page read and write
|
||
|
6D92000
|
trusted library allocation
|
page read and write
|
||
|
870000
|
trusted library allocation
|
page read and write
|
||
|
9D8000
|
heap
|
page read and write
|
||
|
A68000
|
heap
|
page read and write
|
||
|
9DE000
|
heap
|
page read and write
|
||
|
298E000
|
stack
|
page read and write
|
||
|
80E000
|
stack
|
page read and write
|
||
|
E69000
|
heap
|
page read and write
|
||
|
9C1E000
|
stack
|
page read and write
|
||
|
CAD000
|
trusted library allocation
|
page read and write
|
||
|
6800000
|
trusted library allocation
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
897000
|
trusted library allocation
|
page execute and read and write
|
||
|
67B0000
|
trusted library section
|
page read and write
|
||
|
684E000
|
stack
|
page read and write
|
||
|
873000
|
trusted library allocation
|
page read and write
|
||
|
2595000
|
trusted library allocation
|
page read and write
|
||
|
2600000
|
heap
|
page execute and read and write
|
||
|
7F6A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FA0000
|
heap
|
page read and write
|
||
|
4F9D000
|
stack
|
page read and write
|
||
|
87D000
|
trusted library allocation
|
page execute and read and write
|
||
|
67A0000
|
trusted library section
|
page read and write
|
||
|
4D40000
|
heap
|
page read and write
|
||
|
E0E000
|
stack
|
page read and write
|
||
|
2E8F000
|
stack
|
page read and write
|
||
|
39E8000
|
trusted library allocation
|
page read and write
|
||
|
86D000
|
trusted library allocation
|
page execute and read and write
|
||
|
47AC000
|
stack
|
page read and write
|
||
|
CC7000
|
heap
|
page read and write
|
||
|
6A20000
|
trusted library section
|
page read and write
|
||
|
2808000
|
trusted library allocation
|
page read and write
|
There are 136 hidden memdumps, click here to show them.