Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
xVcsGL5R1Nbh.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\xVcsGL5R1Nbh.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\xVcsGL5R1Nbh.exe
|
"C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xVcsGL5R1Nbh.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
patria.duckdns.org
|
|
||
|
http://go.microsoft.
|
unknown
|
||
|
http://go.microsoft.LinkId=42127
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
patria.duckdns.org
|
46.246.6.20
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
46.246.6.20
|
patria.duckdns.org
|
Sweden
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
||
|
HKEY_CURRENT_USER\SOFTWARE\4ee9f9af7e9
|
[kl]
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
352000
|
unkown
|
page readonly
|
|
|
|
2B31000
|
trusted library allocation
|
page read and write
|
|
|
|
B2A000
|
trusted library allocation
|
page execute and read and write
|
||
|
11B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
B57000
|
trusted library allocation
|
page execute and read and write
|
||
|
2BA9000
|
trusted library allocation
|
page read and write
|
||
|
2C05000
|
trusted library allocation
|
page read and write
|
||
|
3090000
|
heap
|
page read and write
|
||
|
2AFD000
|
stack
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
4C80000
|
trusted library allocation
|
page read and write
|
||
|
2C4E000
|
unkown
|
page read and write
|
||
|
7ED000
|
stack
|
page read and write
|
||
|
3EA000
|
stack
|
page read and write
|
||
|
117E000
|
stack
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
B40000
|
trusted library allocation
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
50EF000
|
stack
|
page read and write
|
||
|
851000
|
heap
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
FD0000
|
heap
|
page execute and read and write
|
||
|
765000
|
heap
|
page read and write
|
||
|
DF6000
|
heap
|
page read and write
|
||
|
4D00000
|
trusted library allocation
|
page execute and read and write
|
||
|
350000
|
unkown
|
page readonly
|
||
|
4D6E000
|
stack
|
page read and write
|
||
|
FE8000
|
trusted library allocation
|
page read and write
|
||
|
543F000
|
stack
|
page read and write
|
||
|
DAE000
|
stack
|
page read and write
|
||
|
B52000
|
trusted library allocation
|
page read and write
|
||
|
5100000
|
trusted library allocation
|
page execute and read and write
|
||
|
4BBC000
|
stack
|
page read and write
|
||
|
5280000
|
heap
|
page read and write
|
||
|
5610000
|
heap
|
page read and write
|
||
|
2E0C000
|
heap
|
page read and write
|
||
|
FCC000
|
stack
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
5290000
|
heap
|
page read and write
|
||
|
2C25000
|
trusted library allocation
|
page read and write
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
553D000
|
stack
|
page read and write
|
||
|
4C90000
|
trusted library allocation
|
page read and write
|
||
|
2B8B000
|
trusted library allocation
|
page read and write
|
||
|
7FAF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
B22000
|
trusted library allocation
|
page execute and read and write
|
||
|
4E6E000
|
stack
|
page read and write
|
||
|
2B85000
|
trusted library allocation
|
page read and write
|
||
|
A5E000
|
stack
|
page read and write
|
||
|
B42000
|
trusted library allocation
|
page execute and read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
6F9000
|
stack
|
page read and write
|
||
|
63A0000
|
heap
|
page read and write
|
||
|
4C3C000
|
stack
|
page read and write
|
||
|
2DD3000
|
trusted library allocation
|
page read and write
|
||
|
2E00000
|
heap
|
page read and write
|
||
|
B3A000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FEE000
|
stack
|
page read and write
|
||
|
4EAE000
|
stack
|
page read and write
|
||
|
B5B000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C79000
|
stack
|
page read and write
|
||
|
11A3000
|
heap
|
page read and write
|
||
|
3B31000
|
trusted library allocation
|
page read and write
|
||
|
63B0000
|
heap
|
page read and write
|
||
|
62A8000
|
heap
|
page read and write
|
||
|
358000
|
unkown
|
page readonly
|
||
|
4FAF000
|
stack
|
page read and write
|
||
|
1190000
|
trusted library allocation
|
page read and write
|
||
|
5160000
|
heap
|
page read and write
|
||
|
B4A000
|
trusted library allocation
|
page execute and read and write
|
||
|
810000
|
heap
|
page read and write
|
||
|
B20000
|
trusted library allocation
|
page read and write
|
||
|
DF0000
|
heap
|
page read and write
|
||
|
7AC000
|
stack
|
page read and write
|
||
|
2D4F000
|
unkown
|
page read and write
|
||
|
B37000
|
trusted library allocation
|
page execute and read and write
|
||
|
278D000
|
stack
|
page read and write
|
||
|
B12000
|
trusted library allocation
|
page execute and read and write
|
||
|
11A0000
|
heap
|
page read and write
|
||
|
AAC000
|
stack
|
page read and write
|
||
|
6F6000
|
stack
|
page read and write
|
||
|
B00000
|
trusted library allocation
|
page read and write
|
||
|
27F0000
|
heap
|
page read and write
|
||
|
8B7000
|
heap
|
page read and write
|
||
|
2FFF000
|
stack
|
page read and write
|
||
|
81E000
|
heap
|
page read and write
|
||
|
B9E000
|
stack
|
page read and write
|
||
|
2D8E000
|
stack
|
page read and write
|
||
|
B1A000
|
trusted library allocation
|
page execute and read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
4BFB000
|
stack
|
page read and write
|
There are 82 hidden memdumps, click here to show them.