Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
x7RZVIWaDKb5.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\x7RZVIWaDKb5.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\x7RZVIWaDKb5.exe
|
"C:\Users\user\Desktop\x7RZVIWaDKb5.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\x7RZVIWaDKb5.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
rusia.duckdns.org
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
rusia.duckdns.org
|
46.246.14.17
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
46.246.14.17
|
rusia.duckdns.org
|
Sweden
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
||
|
HKEY_CURRENT_USER\SOFTWARE\7fc3d7b5df89403
|
[kl]
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
EA2000
|
unkown
|
page readonly
|
|
|
|
149A000
|
trusted library allocation
|
page execute and read and write
|
||
|
14A2000
|
trusted library allocation
|
page read and write
|
||
|
EA8000
|
unkown
|
page readonly
|
||
|
3602000
|
trusted library allocation
|
page read and write
|
||
|
5C3F000
|
stack
|
page read and write
|
||
|
2E20000
|
heap
|
page read and write
|
||
|
171E000
|
stack
|
page read and write
|
||
|
325F000
|
stack
|
page read and write
|
||
|
15D4000
|
heap
|
page read and write
|
||
|
140C000
|
stack
|
page read and write
|
||
|
14A0000
|
trusted library allocation
|
page read and write
|
||
|
5B3E000
|
stack
|
page read and write
|
||
|
1520000
|
heap
|
page read and write
|
||
|
315F000
|
unkown
|
page read and write
|
||
|
1560000
|
heap
|
page read and write
|
||
|
12F6000
|
stack
|
page read and write
|
||
|
18A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A70000
|
heap
|
page execute and read and write
|
||
|
18C0000
|
heap
|
page read and write
|
||
|
3608000
|
trusted library allocation
|
page read and write
|
||
|
2ECE000
|
stack
|
page read and write
|
||
|
59FE000
|
stack
|
page read and write
|
||
|
187C000
|
stack
|
page read and write
|
||
|
3561000
|
trusted library allocation
|
page read and write
|
||
|
12F9000
|
stack
|
page read and write
|
||
|
146A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1820000
|
heap
|
page read and write
|
||
|
15A5000
|
heap
|
page read and write
|
||
|
FEE000
|
stack
|
page read and write
|
||
|
6FE0000
|
heap
|
page read and write
|
||
|
148A000
|
trusted library allocation
|
page execute and read and write
|
||
|
4561000
|
trusted library allocation
|
page read and write
|
||
|
1A1E000
|
stack
|
page read and write
|
||
|
59BE000
|
stack
|
page read and write
|
||
|
5D70000
|
heap
|
page read and write
|
||
|
6240000
|
heap
|
page read and write
|
||
|
56FC000
|
stack
|
page read and write
|
||
|
5740000
|
trusted library allocation
|
page read and write
|
||
|
1916000
|
heap
|
page read and write
|
||
|
57B3000
|
heap
|
page read and write
|
||
|
2E40000
|
heap
|
page read and write
|
||
|
14AB000
|
trusted library allocation
|
page execute and read and write
|
||
|
3606000
|
trusted library allocation
|
page read and write
|
||
|
152E000
|
heap
|
page read and write
|
||
|
2CFC000
|
stack
|
page read and write
|
||
|
152A000
|
heap
|
page read and write
|
||
|
2F82000
|
heap
|
page read and write
|
||
|
578C000
|
stack
|
page read and write
|
||
|
14FE000
|
stack
|
page read and write
|
||
|
1490000
|
trusted library allocation
|
page read and write
|
||
|
1472000
|
trusted library allocation
|
page execute and read and write
|
||
|
147A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
1492000
|
trusted library allocation
|
page execute and read and write
|
||
|
175D000
|
unkown
|
page read and write
|
||
|
61AE000
|
stack
|
page read and write
|
||
|
1576000
|
heap
|
page read and write
|
||
|
57B0000
|
heap
|
page read and write
|
||
|
2F93000
|
heap
|
page read and write
|
||
|
7F2F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1890000
|
trusted library allocation
|
page read and write
|
||
|
57A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
57F9000
|
stack
|
page read and write
|
||
|
60AB000
|
stack
|
page read and write
|
||
|
35FE000
|
trusted library allocation
|
page read and write
|
||
|
2D40000
|
heap
|
page read and write
|
||
|
1487000
|
trusted library allocation
|
page execute and read and write
|
||
|
F3A000
|
stack
|
page read and write
|
||
|
56FF000
|
stack
|
page read and write
|
||
|
2F6B000
|
heap
|
page read and write
|
||
|
1425000
|
heap
|
page read and write
|
||
|
29DD000
|
stack
|
page read and write
|
||
|
1470000
|
trusted library allocation
|
page read and write
|
||
|
6ED8000
|
heap
|
page read and write
|
||
|
573B000
|
stack
|
page read and write
|
||
|
1450000
|
trusted library allocation
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
1420000
|
heap
|
page read and write
|
||
|
190C000
|
stack
|
page read and write
|
||
|
5790000
|
trusted library allocation
|
page read and write
|
||
|
58BE000
|
stack
|
page read and write
|
||
|
1583000
|
heap
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
2E8E000
|
unkown
|
page read and write
|
||
|
1480000
|
trusted library allocation
|
page read and write
|
||
|
1910000
|
heap
|
page read and write
|
||
|
5C50000
|
trusted library allocation
|
page execute and read and write
|
||
|
5CD0000
|
heap
|
page read and write
|
||
|
1462000
|
trusted library allocation
|
page execute and read and write
|
||
|
6FD0000
|
heap
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
5CE0000
|
heap
|
page read and write
|
||
|
5AFF000
|
stack
|
page read and write
|
||
|
14A7000
|
trusted library allocation
|
page execute and read and write
|
||
|
EA0000
|
unkown
|
page readonly
|
There are 87 hidden memdumps, click here to show them.