Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
WCcNzb83Y3.exe
|
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\WCcNzb83Y3.exe
|
"C:\Users\user\Desktop\WCcNzb83Y3.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://47.120.39.182:63306/Gs3p
|
|
||
|
https://47.120.39.182/
|
unknown
|
||
|
https://47.120.39.182:63306/Gs3p
|
unknown
|
||
|
https://47.120.39.182/#
|
unknown
|
||
|
https://47.120.39.182:63306/Gs3p%
|
unknown
|
||
|
http://127.0.0.1:%u/
|
unknown
|
||
|
https://47.120.39.182:63306/cx
|
unknown
|
||
|
https://47.120.39.182:63306/Gs3pM
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
47.120.39.182
|
unknown
|
China
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
14A000
|
stack
|
page read and write
|
|
|
|
2BF0000
|
direct allocation
|
page execute read
|
|
|
|
2B90000
|
direct allocation
|
page execute and read and write
|
|
|
|
30B0000
|
direct allocation
|
page execute and read and write
|
|
|
|
1B0000
|
direct allocation
|
page execute and read and write
|
|
|
|
2DAB000
|
stack
|
page read and write
|
||
|
2F2A000
|
heap
|
page read and write
|
||
|
2B2A000
|
heap
|
page read and write
|
||
|
544000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4E0000
|
heap
|
page read and write
|
||
|
2BD1000
|
direct allocation
|
page execute and read and write
|
||
|
2ED4000
|
heap
|
page read and write
|
||
|
2B26000
|
heap
|
page read and write
|
||
|
402000
|
unkown
|
page read and write
|
||
|
2B2A000
|
heap
|
page read and write
|
||
|
2B1E000
|
heap
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
2F79000
|
heap
|
page read and write
|
||
|
2F85000
|
heap
|
page read and write
|
||
|
2B7A000
|
heap
|
page read and write
|
||
|
2F81000
|
heap
|
page read and write
|
||
|
2BD7000
|
direct allocation
|
page execute and read and write
|
||
|
2BF1000
|
direct allocation
|
page execute and read and write
|
||
|
2B01000
|
heap
|
page read and write
|
||
|
2F2A000
|
heap
|
page read and write
|
||
|
2F85000
|
heap
|
page read and write
|
||
|
544000
|
heap
|
page read and write
|
||
|
2B7A000
|
heap
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2F86000
|
heap
|
page read and write
|
||
|
2B2C000
|
heap
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
2B24000
|
heap
|
page read and write
|
||
|
271F000
|
stack
|
page read and write
|
||
|
2828000
|
stack
|
page read and write
|
||
|
2B18000
|
heap
|
page read and write
|
||
|
576000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
565000
|
heap
|
page read and write
|
||
|
4FE000
|
heap
|
page read and write
|
||
|
2B1E000
|
heap
|
page read and write
|
||
|
2B26000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
2EFE000
|
heap
|
page read and write
|
||
|
2B7A000
|
heap
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
5AA000
|
heap
|
page read and write
|
||
|
2AB8000
|
heap
|
page read and write
|
||
|
2A7F000
|
stack
|
page read and write
|
||
|
2EFE000
|
heap
|
page read and write
|
||
|
2980000
|
remote allocation
|
page read and write
|
||
|
2B0F000
|
heap
|
page read and write
|
||
|
2980000
|
remote allocation
|
page read and write
|
||
|
576000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
7F5000
|
heap
|
page read and write
|
||
|
53C000
|
heap
|
page read and write
|
||
|
2B18000
|
heap
|
page read and write
|
||
|
2F85000
|
heap
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
2B2A000
|
heap
|
page read and write
|
||
|
2ADA000
|
heap
|
page read and write
|
||
|
2F4F000
|
heap
|
page read and write
|
||
|
2F4F000
|
heap
|
page read and write
|
||
|
2B26000
|
heap
|
page read and write
|
||
|
2F85000
|
heap
|
page read and write
|
||
|
2A91000
|
heap
|
page read and write
|
||
|
2EB0000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
2B1E000
|
heap
|
page read and write
|
||
|
2B24000
|
heap
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
5AA000
|
heap
|
page read and write
|
||
|
565000
|
heap
|
page read and write
|
||
|
2B4E000
|
heap
|
page read and write
|
||
|
51F000
|
heap
|
page read and write
|
||
|
2B2A000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2B18000
|
heap
|
page read and write
|
||
|
30EE000
|
direct allocation
|
page execute and read and write
|
||
|
521000
|
heap
|
page read and write
|
||
|
2EFF000
|
heap
|
page read and write
|
||
|
53C000
|
heap
|
page read and write
|
||
|
2B24000
|
heap
|
page read and write
|
||
|
2BDD000
|
direct allocation
|
page execute and read and write
|
||
|
2BD4000
|
direct allocation
|
page execute and read and write
|
||
|
5A7000
|
heap
|
page read and write
|
||
|
2F79000
|
heap
|
page read and write
|
||
|
4E6000
|
heap
|
page read and write
|
||
|
2B01000
|
heap
|
page read and write
|
||
|
4ED000
|
heap
|
page read and write
|
||
|
190000
|
heap
|
page read and write
|
||
|
2B5E000
|
heap
|
page read and write
|
||
|
2F81000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
2B13000
|
heap
|
page read and write
|
||
|
2B26000
|
heap
|
page read and write
|
||
|
2B7B000
|
heap
|
page read and write
|
||
|
2A90000
|
heap
|
page read and write
|
||
|
2B18000
|
heap
|
page read and write
|
||
|
2F82000
|
heap
|
page read and write
|
||
|
180000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
2B33000
|
heap
|
page read and write
|
||
|
2F7A000
|
heap
|
page read and write
|
||
|
2B01000
|
heap
|
page read and write
|
||
|
2980000
|
remote allocation
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
2B1E000
|
heap
|
page read and write
|
||
|
402000
|
unkown
|
page write copy
|
||
|
2F81000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
2F85000
|
heap
|
page read and write
|
||
|
2B01000
|
heap
|
page read and write
|
||
|
2EFF000
|
heap
|
page read and write
|
||
|
2F81000
|
heap
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
5C5000
|
heap
|
page read and write
|
||
|
57E000
|
heap
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
2BDB000
|
direct allocation
|
page execute and read and write
|
||
|
2B7A000
|
heap
|
page read and write
|
There are 119 hidden memdumps, click here to show them.