IOC Report
PASS-1234.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PASS-1234.exe
"C:\Users\user\Desktop\PASS-1234.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
demonstationfukewko.shop
malicious
incredibleextedwj.shop
malicious
sideindexfollowragelrew.pw
malicious
shortsvelventysjo.shop
malicious
shatterbreathepsw.shop
malicious
productivelookewr.shop
malicious
tolerateilusidjukl.shop
malicious
liabilitynighstjsko.shop
malicious
alcojoldwograpciw.shop
malicious
https://productivelookewr.shop/
unknown
https://productivelookewr.shop/apis
unknown
https://productivelookewr.shop/api
104.21.11.250
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
productivelookewr.shop
104.21.11.250
 malicious
sideindexfollowragelrew.pw
unknown
 malicious

IPs

IP
Domain
Country
Malicious
104.21.11.250
productivelookewr.shop
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
FFF000
stack
page read and write
7AD000
stack
page read and write
E22000
unkown
page write copy
DAB000
unkown
page execute read
14DE000
heap
page read and write
2F8D000
stack
page read and write
12F7000
stack
page read and write
B10000
heap
page read and write
C0E000
heap
page read and write
318F000
stack
page read and write
151B000
heap
page read and write
380B000
trusted library allocation
page read and write
E23000
unkown
page write copy
3980000
trusted library allocation
page read and write
150C000
heap
page read and write
146D000
stack
page read and write
DC7000
unkown
page write copy
10FF000
stack
page read and write
1578000
heap
page read and write
44A000
remote allocation
page execute and read and write
DAB000
unkown
page execute read
B20000
heap
page read and write
15A2000
heap
page read and write
E28000
unkown
page readonly
E28000
unkown
page readonly
E26000
unkown
page readonly
F60000
heap
page read and write
F80000
heap
page read and write
3880000
heap
page read and write
12D0000
heap
page read and write
376E000
stack
page read and write
378E000
trusted library allocation
page read and write
3E60000
heap
page read and write
1562000
heap
page read and write
D0F000
unkown
page execute read
378A000
trusted library allocation
page read and write
14CA000
heap
page read and write
E12000
unkown
page execute and read and write
2E8E000
stack
page read and write
DC7000
unkown
page read and write
142E000
stack
page read and write
14FD000
heap
page read and write
380F000
trusted library allocation
page read and write
14F0000
heap
page read and write
D0F000
unkown
page execute read
DB3000
unkown
page readonly
14C0000
heap
page read and write
37CE000
trusted library allocation
page read and write
C0A000
heap
page read and write
37B4000
trusted library allocation
page read and write
F65000
heap
page read and write
AFD000
stack
page read and write
E22000
unkown
page read and write
362F000
stack
page read and write
D0B000
unkown
page execute read
37C4000
trusted library allocation
page read and write
D00000
unkown
page readonly
14AE000
stack
page read and write
37AE000
trusted library allocation
page read and write
13D0000
heap
page read and write
E24000
unkown
page read and write
3813000
trusted library allocation
page read and write
F90000
heap
page read and write
B6E000
stack
page read and write
3780000
trusted library allocation
page read and write
37C9000
trusted library allocation
page read and write
366D000
stack
page read and write
1770000
heap
page read and write
FFE000
stack
page read and write
D00000
unkown
page readonly
F0B000
stack
page read and write
BDE000
stack
page read and write
E26000
unkown
page readonly
D0B000
unkown
page execute read
3CDF000
stack
page read and write
14F5000
heap
page read and write
C1B000
heap
page read and write
D01000
unkown
page execute read
308E000
stack
page read and write
D01000
unkown
page execute read
352E000
stack
page read and write
3BDE000
stack
page read and write
DB3000
unkown
page readonly
15B5000
heap
page read and write
C00000
heap
page read and write
B90000
heap
page read and write
There are 77 hidden memdumps, click here to show them.