Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
bUBD.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bUBD.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\bUBD.exe
|
"C:\Users\user\Desktop\bUBD.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\bUBD.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
patria.duckdns.org
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
patria.duckdns.org
|
46.246.14.22
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
46.246.14.22
|
patria.duckdns.org
|
Sweden
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
||
|
HKEY_CURRENT_USER\SOFTWARE\03bf0f5789
|
[kl]
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
42000
|
unkown
|
page readonly
|
|
|
|
26C1000
|
trusted library allocation
|
page read and write
|
||
|
48E0000
|
trusted library allocation
|
page read and write
|
||
|
520000
|
heap
|
page read and write
|
||
|
830000
|
trusted library allocation
|
page read and write
|
||
|
5F88000
|
heap
|
page read and write
|
||
|
860000
|
heap
|
page read and write
|
||
|
4DDE000
|
stack
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
3110000
|
heap
|
page read and write
|
||
|
26C4000
|
trusted library allocation
|
page read and write
|
||
|
4A5E000
|
stack
|
page read and write
|
||
|
B6A000
|
heap
|
page read and write
|
||
|
4B5F000
|
stack
|
page read and write
|
||
|
97B000
|
trusted library allocation
|
page execute and read and write
|
||
|
82A000
|
trusted library allocation
|
page execute and read and write
|
||
|
850000
|
trusted library allocation
|
page read and write
|
||
|
5E3000
|
heap
|
page read and write
|
||
|
465000
|
heap
|
page read and write
|
||
|
4F70000
|
heap
|
page read and write
|
||
|
DA000
|
stack
|
page read and write
|
||
|
4AC000
|
stack
|
page read and write
|
||
|
7BB000
|
stack
|
page read and write
|
||
|
40000
|
unkown
|
page readonly
|
||
|
977000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D6000
|
stack
|
page read and write
|
||
|
489C000
|
stack
|
page read and write
|
||
|
7F7F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
51F0000
|
heap
|
page read and write
|
||
|
4C9E000
|
stack
|
page read and write
|
||
|
485F000
|
stack
|
page read and write
|
||
|
84A000
|
trusted library allocation
|
page execute and read and write
|
||
|
B66000
|
heap
|
page read and write
|
||
|
847000
|
trusted library allocation
|
page execute and read and write
|
||
|
2AFD000
|
stack
|
page read and write
|
||
|
516F000
|
stack
|
page read and write
|
||
|
4CDE000
|
stack
|
page read and write
|
||
|
500000
|
heap
|
page read and write
|
||
|
4970000
|
trusted library allocation
|
page read and write
|
||
|
AEF000
|
stack
|
page read and write
|
||
|
972000
|
trusted library allocation
|
page read and write
|
||
|
2F7F000
|
stack
|
page read and write
|
||
|
5C4000
|
heap
|
page read and write
|
||
|
4DF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
273B000
|
trusted library allocation
|
page read and write
|
||
|
48000
|
unkown
|
page readonly
|
||
|
275D000
|
stack
|
page read and write
|
||
|
B2C000
|
stack
|
page read and write
|
||
|
27D0000
|
heap
|
page read and write
|
||
|
76E000
|
stack
|
page read and write
|
||
|
2887000
|
trusted library allocation
|
page read and write
|
||
|
440000
|
heap
|
page read and write
|
||
|
592000
|
heap
|
page read and write
|
||
|
528000
|
heap
|
page read and write
|
||
|
49E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
49F0000
|
heap
|
page read and write
|
||
|
270F000
|
trusted library allocation
|
page read and write
|
||
|
36C1000
|
trusted library allocation
|
page read and write
|
||
|
27E0000
|
heap
|
page read and write
|
||
|
2E7E000
|
stack
|
page read and write
|
||
|
2E3F000
|
unkown
|
page read and write
|
||
|
83A000
|
trusted library allocation
|
page execute and read and write
|
||
|
832000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
27A0000
|
heap
|
page read and write
|
||
|
485D000
|
stack
|
page read and write
|
||
|
B40000
|
trusted library allocation
|
page read and write
|
||
|
52FD000
|
stack
|
page read and write
|
||
|
48DB000
|
stack
|
page read and write
|
||
|
4B9E000
|
stack
|
page read and write
|
||
|
2ABB000
|
trusted library allocation
|
page read and write
|
||
|
1D9000
|
stack
|
page read and write
|
||
|
55E000
|
heap
|
page read and write
|
||
|
49F3000
|
heap
|
page read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
852000
|
trusted library allocation
|
page execute and read and write
|
||
|
492C000
|
stack
|
page read and write
|
||
|
6080000
|
heap
|
page read and write
|
||
|
9BE000
|
stack
|
page read and write
|
||
|
2F80000
|
heap
|
page read and write
|
||
|
85A000
|
trusted library allocation
|
page execute and read and write
|
||
|
6090000
|
heap
|
page read and write
|
||
|
D60000
|
heap
|
page execute and read and write
|
||
|
2C0C000
|
heap
|
page read and write
|
||
|
4F60000
|
heap
|
page read and write
|
||
|
2D3E000
|
unkown
|
page read and write
|
||
|
52E000
|
heap
|
page read and write
|
||
|
810000
|
trusted library allocation
|
page read and write
|
||
|
460000
|
heap
|
page read and write
|
||
|
4ED000
|
stack
|
page read and write
|
||
|
4FE0000
|
heap
|
page read and write
|
||
|
822000
|
trusted library allocation
|
page execute and read and write
|
||
|
275F000
|
trusted library allocation
|
page read and write
|
||
|
4969000
|
stack
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
46C8000
|
trusted library allocation
|
page read and write
|
||
|
B50000
|
trusted library allocation
|
page execute and read and write
|
There are 87 hidden memdumps, click here to show them.