IOC Report
Wt3pGldAnr.exe

loading gif

Files

File Path
Type
Category
Malicious
Wt3pGldAnr.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\StartMenuExperienceHos.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\StartMenuExperienceHos.exe:Zone.Identifier
ASCII text, with CRLF line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Wt3pGldAnr.exe
"C:\Users\user\Desktop\Wt3pGldAnr.exe"
 malicious
C:\ProgramData\StartMenuExperienceHos.exe
"C:\ProgramData\StartMenuExperienceHos.exe"
 malicious
C:\Users\user\Desktop\Wt3pGldAnr.exe
C:\Users\user\Desktop\Wt3pGldAnr.exe
 malicious

URLs

Name
IP
Malicious
https://zh-hans.ipshu.com/my_infoInternetOpenUrl
unknown
https://zh-hans.ipshu.com/my_info
unknown

IPs

IP
Domain
Country
Malicious
156.255.0.191
unknown
Seychelles

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Console\0
d33f351a4aeea5e608853d1a56661059
HKEY_LOCAL_MACHINE\SOFTWARE
IpDates_info

Memdumps

Base Address
Regiontype
Protect
Malicious
AFC000
stack
page read and write
2DB3000
heap
page read and write
166F000
stack
page read and write
2DB0000
heap
page read and write
ECA000
unkown
page readonly
C60000
heap
page read and write
F10000
unkown
page write copy
361E000
stack
page read and write
F21000
unkown
page readonly
F18000
unkown
page read and write
70A000
unkown
page readonly
1093000
unkown
page readonly
30C0000
heap
page read and write
152E000
stack
page read and write
1090000
unkown
page readonly
136E000
stack
page read and write
ECA000
unkown
page readonly
145C000
heap
page read and write
C27000
heap
page read and write
2B50000
direct allocation
page read and write
12F0000
heap
page read and write
2DFE000
stack
page read and write
337B000
stack
page read and write
4376000
heap
page read and write
317F000
stack
page read and write
145F000
heap
page read and write
1237000
heap
page read and write
2B70000
direct allocation
page read and write
C10000
heap
page read and write
C6E000
stack
page read and write
C20000
heap
page read and write
30C3000
heap
page read and write
142E000
stack
page read and write
1427000
heap
page read and write
133B000
heap
page read and write
1295000
heap
page read and write
43C9000
heap
page read and write
2D90000
direct allocation
page read and write
3710000
heap
page read and write
117E000
heap
page read and write
1130000
heap
page read and write
43F1000
heap
page read and write
32E0000
direct allocation
page execute and read and write
147D000
heap
page read and write
ECA000
unkown
page readonly
ECA000
unkown
page readonly
347E000
stack
page read and write
4360000
trusted library allocation
page read and write
1338000
heap
page read and write
4360000
trusted library allocation
page read and write
761000
unkown
page readonly
4360000
trusted library allocation
page read and write
DA1000
unkown
page execute read
3920000
trusted library allocation
page read and write
8D0000
unkown
page readonly
2C40000
heap
page read and write
2B8A000
heap
page read and write
381D000
stack
page read and write
12D0000
heap
page read and write
2E00000
direct allocation
page read and write
1090000
unkown
page readonly
2E00000
direct allocation
page read and write
43CC000
heap
page read and write
DA1000
unkown
page execute read
1260000
heap
page read and write
1170000
heap
page read and write
1140000
heap
page read and write
11D0000
heap
page read and write
391E000
stack
page read and write
2C8D000
stack
page read and write
2E74000
heap
page read and write
34D2000
direct allocation
page execute and read and write
139F000
stack
page read and write
1330000
heap
page read and write
117A000
heap
page read and write
11FE000
stack
page read and write
5E0000
unkown
page readonly
11BF000
stack
page read and write
5E1000
unkown
page execute read
DA0000
unkown
page readonly
F21000
unkown
page readonly
2B86000
heap
page read and write
36DB000
stack
page read and write
1120000
heap
page read and write
1093000
unkown
page readonly
2B50000
direct allocation
page read and write
2C10000
direct allocation
page read and write
3180000
heap
page read and write
F10000
unkown
page write copy
1337000
heap
page read and write
2C10000
direct allocation
page read and write
F21000
unkown
page readonly
DA0000
unkown
page readonly
11D9000
heap
page read and write
5E0000
unkown
page readonly
8FB000
stack
page read and write
750000
unkown
page read and write
761000
unkown
page readonly
4365000
heap
page read and write
8D0000
unkown
page readonly
2E70000
heap
page read and write
2B4D000
stack
page read and write
2EB0000
heap
page read and write
11B7000
heap
page read and write
1230000
heap
page read and write
1160000
direct allocation
page read and write
8D3000
unkown
page readonly
1090000
unkown
page readonly
3480000
direct allocation
page execute and read and write
1093000
unkown
page readonly
4360000
trusted library allocation
page read and write
1455000
heap
page read and write
DA0000
unkown
page readonly
2E77000
heap
page read and write
750000
unkown
page write copy
1270000
heap
page read and write
421C000
stack
page read and write
DA1000
unkown
page execute read
7CB000
stack
page read and write
12FE000
heap
page read and write
2EA0000
heap
page read and write
156D000
stack
page read and write
1160000
heap
page read and write
10FE000
stack
page read and write
11B0000
heap
page read and write
425C000
stack
page read and write
44F0000
trusted library allocation
page read and write
365B000
stack
page read and write
DA1000
unkown
page execute read
351E000
stack
page read and write
117C000
stack
page read and write
2C90000
heap
page read and write
435D000
stack
page read and write
1420000
heap
page read and write
F10000
unkown
page read and write
2EB0000
heap
page read and write
2E50000
heap
page read and write
307D000
stack
page read and write
3280000
direct allocation
page read and write
2F7D000
stack
page read and write
C25000
heap
page read and write
2E60000
heap
page read and write
758000
unkown
page read and write
2EA4000
heap
page read and write
D6E000
stack
page read and write
F18000
unkown
page read and write
2EA7000
heap
page read and write
2B80000
heap
page read and write
1090000
unkown
page readonly
1461000
heap
page read and write
2D70000
heap
page read and write
F1E000
unkown
page read and write
B30000
heap
page read and write
DA0000
unkown
page readonly
D7E000
stack
page read and write
9FC000
stack
page read and write
2DD0000
heap
page read and write
F10000
unkown
page read and write
70A000
unkown
page readonly
1290000
heap
page read and write
43F0000
heap
page read and write
4360000
trusted library allocation
page read and write
11F0000
heap
page read and write
F21000
unkown
page readonly
5E1000
unkown
page execute read
D80000
heap
page read and write
12F9000
heap
page read and write
1250000
heap
page read and write
107B000
stack
page read and write
1160000
direct allocation
page read and write
2E70000
heap
page read and write
8D3000
unkown
page readonly
31C0000
heap
page read and write
369D000
stack
page read and write
2D73000
heap
page read and write
1093000
unkown
page readonly
There are 166 hidden memdumps, click here to show them.