IOC Report
mdWXrbOxsY.exe

loading gif

Files

File Path
Type
Category
Malicious
mdWXrbOxsY.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\mdWXrbOxsY.exe
"C:\Users\user\Desktop\mdWXrbOxsY.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://t.me/xehook
unknown
http://unotree.ru
unknown
https://aiwhcpoaw.ru/
unknown
https://unotree.ru/
172.67.169.128
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://crl.mF
unknown
http://ip-api.com/json/?fields=11827
unknown
https://unotree.ru
unknown
https://unotree.ru/getjson.php?id=88
172.67.169.128
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
unotree.ru
172.67.169.128
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
172.67.169.128
unotree.ru
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
31E2000
trusted library allocation
page read and write
A7B000
unkown
page write copy
59FE000
stack
page read and write
A60000
unkown
page readonly
A74000
unkown
page readonly
316B000
trusted library allocation
page read and write
2CD0000
trusted library allocation
page read and write
A74000
unkown
page readonly
61EE000
stack
page read and write
2D5E000
stack
page read and write
3168000
trusted library allocation
page read and write
2EF0000
trusted library allocation
page execute and read and write
3199000
trusted library allocation
page read and write
3179000
trusted library allocation
page read and write
2CFA000
trusted library allocation
page execute and read and write
12A0000
heap
page read and write
3226000
trusted library allocation
page read and write
A92000
unkown
page read and write
676E000
stack
page read and write
2D02000
trusted library allocation
page read and write
2EAE000
stack
page read and write
A0E000
stack
page read and write
6372000
heap
page read and write
132D000
heap
page read and write
2E5E000
stack
page read and write
A61000
unkown
page execute read
1180000
heap
page read and write
E0E000
heap
page read and write
A93000
unkown
page readonly
58BE000
stack
page read and write
400000
remote allocation
page execute and read and write
2CE0000
trusted library allocation
page read and write
2CF0000
trusted library allocation
page read and write
C50000
heap
page read and write
646E000
stack
page read and write
5CE000
stack
page read and write
7EFB0000
trusted library allocation
page execute and read and write
60EE000
stack
page read and write
A93000
unkown
page readonly
31A6000
trusted library allocation
page read and write
65EE000
stack
page read and write
12E1000
heap
page read and write
6330000
heap
page read and write
5596000
trusted library allocation
page read and write
D5F000
stack
page read and write
A91000
unkown
page execute and read and write
103C000
stack
page read and write
57B0000
heap
page execute and read and write
1270000
heap
page read and write
3000000
heap
page read and write
2890000
heap
page read and write
574D000
stack
page read and write
3111000
trusted library allocation
page read and write
2CD3000
trusted library allocation
page execute and read and write
2D0B000
trusted library allocation
page execute and read and write
318A000
trusted library allocation
page read and write
1510000
heap
page read and write
578E000
stack
page read and write
622E000
stack
page read and write
12AB000
heap
page read and write
402000
remote allocation
page execute and read and write
14EF000
stack
page read and write
3170000
trusted library allocation
page read and write
31A2000
trusted library allocation
page read and write
E0A000
heap
page read and write
632E000
stack
page read and write
2D00000
trusted library allocation
page read and write
2F40000
heap
page execute and read and write
656F000
stack
page read and write
65AE000
stack
page read and write
6366000
heap
page read and write
135B000
heap
page read and write
2D07000
trusted library allocation
page execute and read and write
3254000
trusted library allocation
page read and write
E00000
heap
page read and write
2CC0000
trusted library allocation
page read and write
5590000
trusted library allocation
page read and write
59BF000
stack
page read and write
3222000
trusted library allocation
page read and write
4111000
trusted library allocation
page read and write
67AE000
stack
page read and write
2CD4000
trusted library allocation
page read and write
1297000
heap
page read and write
580000
heap
page read and write
31AA000
trusted library allocation
page read and write
310F000
stack
page read and write
1388000
heap
page read and write
520D000
stack
page read and write
3237000
trusted library allocation
page read and write
2E60000
trusted library allocation
page read and write
3247000
trusted library allocation
page read and write
55A0000
trusted library allocation
page read and write
1190000
heap
page read and write
50C000
stack
page read and write
1195000
heap
page read and write
672E000
stack
page read and write
570000
heap
page read and write
3184000
trusted library allocation
page read and write
2F30000
trusted library allocation
page read and write
5AFE000
stack
page read and write
637F000
heap
page read and write
5585000
trusted library allocation
page read and write
2CF6000
trusted library allocation
page execute and read and write
1138000
stack
page read and write
2EEC000
stack
page read and write
2F00000
heap
page read and write
2F20000
trusted library allocation
page read and write
12CD000
heap
page read and write
8FD000
stack
page read and write
A7B000
unkown
page read and write
B9F000
stack
page read and write
12D4000
heap
page read and write
A60000
unkown
page readonly
2CDD000
trusted library allocation
page execute and read and write
13EE000
stack
page read and write
67D0000
heap
page read and write
A61000
unkown
page execute read
31CD000
trusted library allocation
page read and write
4117000
trusted library allocation
page read and write
1290000
heap
page read and write
662E000
stack
page read and write
There are 111 hidden memdumps, click here to show them.