IOC Report
xuI8pQHlxExL.exe

loading gif

Files

File Path
Type
Category
Malicious
xuI8pQHlxExL.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\xuI8pQHlxExL.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\xuI8pQHlxExL.exe
"C:\Users\user\Desktop\xuI8pQHlxExL.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xuI8pQHlxExL.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
resilencia2023.duckdns.org
malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown

Domains

Name
IP
Malicious
resilencia2023.duckdns.org
179.14.8.182
 malicious

IPs

IP
Domain
Country
Malicious
179.14.8.182
resilencia2023.duckdns.org
Colombia
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
HKEY_CURRENT_USER\SOFTWARE\8abd92e56969
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
9C2000
unkown
page readonly
 malicious
3021000
trusted library allocation
page read and write
 malicious
52E0000
heap
page read and write
1302000
trusted library allocation
page read and write
69C0000
heap
page read and write
1368000
trusted library allocation
page read and write
5CC0000
heap
page read and write
5D30000
heap
page read and write
52AC000
stack
page read and write
10DA000
trusted library allocation
page execute and read and write
E40000
heap
page read and write
52C0000
trusted library allocation
page execute and read and write
F85000
heap
page read and write
E20000
heap
page read and write
F73000
heap
page read and write
3075000
trusted library allocation
page read and write
1307000
trusted library allocation
page execute and read and write
5770000
trusted library allocation
page execute and read and write
EE0000
heap
page read and write
10BA000
trusted library allocation
page execute and read and write
358A000
trusted library allocation
page read and write
53EE000
stack
page read and write
5CBD000
stack
page read and write
5BBB000
stack
page read and write
10E0000
trusted library allocation
page read and write
2E20000
heap
page read and write
F90000
heap
page read and write
1070000
heap
page read and write
10B2000
trusted library allocation
page execute and read and write
134E000
stack
page read and write
6AD0000
heap
page read and write
2F90000
heap
page read and write
2F7E000
stack
page read and write
D56000
stack
page read and write
566E000
stack
page read and write
2F80000
heap
page read and write
6AC0000
heap
page read and write
E26000
heap
page read and write
5329000
stack
page read and write
5170000
trusted library allocation
page execute and read and write
F7A000
heap
page read and write
9C0000
unkown
page readonly
3590000
trusted library allocation
page read and write
F44000
heap
page read and write
7FC40000
trusted library allocation
page execute and read and write
552E000
stack
page read and write
30BE000
trusted library allocation
page read and write
E0C000
stack
page read and write
1400000
heap
page read and write
562F000
stack
page read and write
10D0000
trusted library allocation
page read and write
2BBD000
stack
page read and write
54EE000
stack
page read and write
57F0000
heap
page read and write
10C2000
trusted library allocation
page execute and read and write
C5A000
stack
page read and write
10F0000
heap
page read and write
F6A000
heap
page read and write
10CA000
trusted library allocation
page execute and read and write
35B0000
trusted library allocation
page read and write
10A0000
trusted library allocation
page read and write
DC0000
heap
page read and write
E45000
heap
page read and write
2CDE000
stack
page read and write
515F000
stack
page read and write
1100000
heap
page read and write
5160000
trusted library allocation
page read and write
10D7000
trusted library allocation
page execute and read and write
9C8000
unkown
page readonly
525B000
stack
page read and write
5800000
heap
page read and write
EAE000
heap
page read and write
1300000
trusted library allocation
page read and write
D59000
stack
page read and write
5D35000
heap
page read and write
F4F000
heap
page read and write
130B000
trusted library allocation
page execute and read and write
F6E000
heap
page read and write
2ABD000
stack
page read and write
515D000
stack
page read and write
5260000
trusted library allocation
page read and write
52B0000
trusted library allocation
page read and write
3410000
heap
page read and write
1430000
heap
page execute and read and write
309E000
unkown
page read and write
309A000
trusted library allocation
page read and write
32FF000
stack
page read and write
DB0000
heap
page read and write
10C0000
trusted library allocation
page read and write
310C000
heap
page read and write
10EA000
trusted library allocation
page execute and read and write
521C000
stack
page read and write
10E2000
trusted library allocation
page execute and read and write
F48000
heap
page read and write
F11000
heap
page read and write
2F3E000
unkown
page read and write
5880000
heap
page read and write
EA0000
heap
page read and write
4021000
trusted library allocation
page read and write
35B8000
trusted library allocation
page read and write
576E000
stack
page read and write
E8C000
stack
page read and write
52E3000
heap
page read and write
505B000
stack
page read and write
3100000
heap
page read and write
There are 95 hidden memdumps, click here to show them.