Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
xyyDAUDPeYEH.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\xyyDAUDPeYEH.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\xyyDAUDPeYEH.exe
|
"C:\Users\user\Desktop\xyyDAUDPeYEH.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xyyDAUDPeYEH.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
rusia.duckdns.org
|
|
||
|
http://go.microsoft.
|
unknown
|
||
|
http://go.microsoft.LinkId=42127
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
rusia.duckdns.org
|
46.246.6.20
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
46.246.6.20
|
rusia.duckdns.org
|
Sweden
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
A72000
|
unkown
|
page readonly
|
|
|
|
3091000
|
trusted library allocation
|
page read and write
|
|
|
|
1382000
|
heap
|
page read and write
|
||
|
6B90000
|
heap
|
page read and write
|
||
|
109A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1386000
|
heap
|
page read and write
|
||
|
BBE000
|
stack
|
page read and write
|
||
|
106A000
|
trusted library allocation
|
page execute and read and write
|
||
|
10A7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
1046000
|
heap
|
page read and write
|
||
|
52A0000
|
heap
|
page read and write
|
||
|
1290000
|
heap
|
page read and write
|
||
|
EF9000
|
stack
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
A78000
|
unkown
|
page readonly
|
||
|
1092000
|
trusted library allocation
|
page execute and read and write
|
||
|
225D000
|
stack
|
page read and write
|
||
|
2621000
|
heap
|
page read and write
|
||
|
1087000
|
trusted library allocation
|
page execute and read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
5A9C000
|
stack
|
page read and write
|
||
|
6B80000
|
heap
|
page read and write
|
||
|
27E0000
|
heap
|
page read and write
|
||
|
5290000
|
trusted library allocation
|
page read and write
|
||
|
55CE000
|
stack
|
page read and write
|
||
|
1090000
|
trusted library allocation
|
page read and write
|
||
|
235C000
|
stack
|
page read and write
|
||
|
108A000
|
trusted library allocation
|
page execute and read and write
|
||
|
10A0000
|
trusted library allocation
|
page read and write
|
||
|
7F180000
|
trusted library allocation
|
page execute and read and write
|
||
|
2600000
|
heap
|
page read and write
|
||
|
131B000
|
heap
|
page read and write
|
||
|
52A3000
|
heap
|
page read and write
|
||
|
1062000
|
trusted library allocation
|
page execute and read and write
|
||
|
3128000
|
trusted library allocation
|
page read and write
|
||
|
1070000
|
trusted library allocation
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
3122000
|
trusted library allocation
|
page read and write
|
||
|
311E000
|
trusted library allocation
|
page read and write
|
||
|
296E000
|
stack
|
page read and write
|
||
|
1080000
|
trusted library allocation
|
page read and write
|
||
|
1072000
|
trusted library allocation
|
page execute and read and write
|
||
|
1040000
|
heap
|
page read and write
|
||
|
2C40000
|
heap
|
page read and write
|
||
|
2A6F000
|
stack
|
page read and write
|
||
|
11CE000
|
stack
|
page read and write
|
||
|
536C000
|
stack
|
page read and write
|
||
|
10C0000
|
heap
|
page read and write
|
||
|
1320000
|
heap
|
page read and write
|
||
|
5420000
|
trusted library allocation
|
page execute and read and write
|
||
|
10AB000
|
trusted library allocation
|
page execute and read and write
|
||
|
532B000
|
stack
|
page read and write
|
||
|
570E000
|
stack
|
page read and write
|
||
|
558E000
|
stack
|
page read and write
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
10A2000
|
trusted library allocation
|
page read and write
|
||
|
580E000
|
stack
|
page read and write
|
||
|
282E000
|
unkown
|
page read and write
|
||
|
10C5000
|
heap
|
page read and write
|
||
|
5D6E000
|
stack
|
page read and write
|
||
|
23C0000
|
heap
|
page read and write
|
||
|
12BE000
|
heap
|
page read and write
|
||
|
A70000
|
unkown
|
page readonly
|
||
|
1389000
|
heap
|
page read and write
|
||
|
52EC000
|
stack
|
page read and write
|
||
|
56CE000
|
stack
|
page read and write
|
||
|
522C000
|
stack
|
page read and write
|
||
|
1333000
|
heap
|
page read and write
|
||
|
128C000
|
stack
|
page read and write
|
||
|
5DF0000
|
heap
|
page read and write
|
||
|
BFE000
|
stack
|
page read and write
|
||
|
260C000
|
heap
|
page read and write
|
||
|
59D0000
|
heap
|
page read and write
|
||
|
5990000
|
heap
|
page read and write
|
||
|
53A9000
|
stack
|
page read and write
|
||
|
1240000
|
heap
|
page execute and read and write
|
||
|
6A88000
|
heap
|
page read and write
|
||
|
12A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
292F000
|
unkown
|
page read and write
|
||
|
5C6B000
|
stack
|
page read and write
|
||
|
1362000
|
heap
|
page read and write
|
||
|
14AE000
|
stack
|
page read and write
|
||
|
2631000
|
heap
|
page read and write
|
||
|
548E000
|
stack
|
page read and write
|
||
|
12EF000
|
heap
|
page read and write
|
||
|
EF6000
|
stack
|
page read and write
|
||
|
53B0000
|
trusted library allocation
|
page read and write
|
||
|
5ADD000
|
stack
|
page read and write
|
||
|
59A0000
|
heap
|
page read and write
|
||
|
5820000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D4E000
|
stack
|
page read and write
|
||
|
120E000
|
stack
|
page read and write
|
||
|
1230000
|
trusted library allocation
|
page read and write
|
||
|
B09000
|
stack
|
page read and write
|
||
|
23D0000
|
heap
|
page read and write
|
||
|
107A000
|
trusted library allocation
|
page execute and read and write
|
||
|
4091000
|
trusted library allocation
|
page read and write
|
||
|
1050000
|
trusted library allocation
|
page read and write
|
||
|
2A70000
|
heap
|
page read and write
|
There are 90 hidden memdumps, click here to show them.