IOC Report
BW38j8Jkbl.exe

loading gif

Files

File Path
Type
Category
Malicious
BW38j8Jkbl.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\6000093.bat
ASCII text, with CRLF, CR line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\BW38j8Jkbl.exe
"C:\Users\user\Desktop\BW38j8Jkbl.exe"
 malicious
C:\Users\user\Desktop\BW38j8Jkbl.exe
"C:\Users\user\Desktop\BW38j8Jkbl.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\6000093.bat" "C:\Users\user\Desktop\BW38j8Jkbl.exe" "
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://smartoffice-eg.com/include/rili/shit.exe
144.76.41.117
 malicious
http://smartoffice-eg.com/include/rili/gate.php
malicious
https://smartoffice-eg.com/include/rili/shit.exe
144.76.41.117
 malicious
http://https://ftp://operawand.dat_Software
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://smartoffice-eg.com/include/rili/gate.phphttp://smartoffice-eg.com/include/rili/shit.exeYUIPWD
unknown
https://duckduckgo.com/ac/?q=
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
ftp://http://https://ftp.fireFTPsites.datSeaMonkey
unknown
http://www.ibsensoftware.com/
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
smartoffice-eg.com
144.76.41.117
 malicious

IPs

IP
Domain
Country
Malicious
144.76.41.117
smartoffice-eg.com
Germany
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\WinRAR
HWID

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
4296000
direct allocation
page execute and read and write
 malicious
6B5000
heap
page read and write
2238000
heap
page read and write
28AF000
stack
page read and write
B26000
heap
page read and write
4291000
direct allocation
page execute and read and write
2DB0000
heap
page read and write
6AF000
heap
page read and write
67E000
heap
page read and write
22F0000
heap
page read and write
26AD000
stack
page read and write
1F0000
heap
page read and write
6B5000
heap
page read and write
22A0000
heap
page read and write
2DAF000
stack
page read and write
2140000
trusted library allocation
page read and write
570000
heap
page read and write
2260000
heap
page read and write
2390000
heap
page read and write
19B000
stack
page read and write
55E000
stack
page read and write
682000
heap
page read and write
6B3000
heap
page read and write
AC0000
heap
page read and write
683000
heap
page read and write
29EF000
stack
page read and write
2140000
trusted library allocation
page read and write
2354000
heap
page read and write
2C6F000
stack
page read and write
40A0000
heap
page read and write
2B2F000
stack
page read and write
498000
unkown
page read and write
2CAE000
stack
page read and write
64E000
stack
page read and write
4F0000
heap
page read and write
6B3000
heap
page read and write
6AC000
heap
page read and write
6AC000
heap
page read and write
400000
unkown
page readonly
6AE000
heap
page read and write
683000
heap
page read and write
400000
unkown
page readonly
305D000
stack
page read and write
9B000
stack
page read and write
2B6E000
stack
page read and write
630000
heap
page read and write
6AC000
heap
page read and write
A6F000
stack
page read and write
6B3000
heap
page read and write
670000
heap
page read and write
22D0000
direct allocation
page read and write
28EE000
stack
page read and write
6B3000
heap
page read and write
59E000
stack
page read and write
695000
heap
page read and write
401000
unkown
page execute read
96F000
stack
page read and write
68E000
heap
page read and write
401000
unkown
page execute read
92F000
stack
page read and write
6AD000
heap
page read and write
688000
heap
page read and write
6B3000
heap
page read and write
49A000
unkown
page readonly
6B5000
heap
page read and write
49A000
unkown
page readonly
2F5C000
stack
page read and write
580000
heap
page read and write
6AD000
heap
page read and write
B20000
heap
page read and write
60E000
stack
page read and write
21AC000
stack
page read and write
82F000
stack
page read and write
2270000
heap
page read and write
5CE000
stack
page read and write
2210000
trusted library allocation
page execute read
69A000
heap
page read and write
2250000
heap
page read and write
2350000
heap
page read and write
688000
heap
page read and write
515000
heap
page read and write
6B3000
heap
page read and write
86F000
stack
page read and write
49A000
unkown
page readonly
19B000
stack
page read and write
2230000
heap
page read and write
27AF000
stack
page read and write
97000
stack
page read and write
6B5000
heap
page read and write
2A2E000
stack
page read and write
6AD000
heap
page read and write
510000
heap
page read and write
401000
unkown
page execute read
694000
heap
page read and write
21EE000
stack
page read and write
23A0000
trusted library allocation
page read and write
400000
unkown
page readonly
1F0000
heap
page read and write
22C0000
direct allocation
page execute and read and write
6AD000
heap
page read and write
67A000
heap
page read and write
222E000
stack
page read and write
638000
heap
page read and write
There are 94 hidden memdumps, click here to show them.