Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

3q1lESMAMh.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.072306000159812
Filename:	3q1lESMAMh.exe
Filesize:	312107
MD5:	683f7f10d3bed4b98eb7c49d08e1529a
SHA1:	b0f755e1e567260255f1a2bb62989081357a19e3
SHA256:	91d1e460f32ef1914084e1cae335c4de321d1b69af18632eb80a55b924fca91d
SHA512:	60913e7f8fb8dc95a6605ec5dc922dfd868987c392c6cf9d0b6ec0d384ace4b3bc1d7c78c969d1eeecdfb340c88a68e4c17222cb26e9c2dda240f185311dc9f0
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops certificate files (DER)	E-Banking Fraud
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary	Windows Management Instrumentation System Information Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
SQL strings found in memory and binary data	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 06:54:36 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 06:54:36 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Entropy:	3.482059516919292
Encrypted:	false
Ssdeep:	48:8SR7dvTgtX0lRYrnvPdAKRkdAGdAKRFdAKRr:8SLcR7
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3q1lESMAMh.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3q1lESMAMh.exe.log
Category:	dropped
Dump:	3q1lESMAMh.exe.log.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3318368586986695
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
Size:	3274
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\Tmp6AD4.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp6AD4.tmp
Category:	dropped
Dump:	Tmp6AD4.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Local\Temp\Tmp6AE4.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp6AE4.tmp
Category:	dropped
Dump:	Tmp6AE4.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\3q1lESMAMh.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	2251
Whitelisted:	true
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\3q1lESMAMh.exe

"C:\Users\user\Desktop\3q1lESMAMh.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4024
Target ID:	0
Parent PID:	4056
Name:	3q1lESMAMh.exe
Path:	C:\Users\user\Desktop\3q1lESMAMh.exe
Commandline:	"C:\Users\user\Desktop\3q1lESMAMh.exe"
Size:	312107
MD5:	683F7F10D3BED4B98EB7C49D08E1529A
Time:	12:32:59
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x760000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://tempuri.org/Entity/Id15V

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/Entity/Id8ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1

unknown

There are 90 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

103.113.70.99

unknown

India

Details

IP:	103.113.70.99
TargetID:	0
Current Path:	C:\Users\user\Desktop\3q1lESMAMh.exe
Country:	India
Countrycode:	IND
ASN number:	133973
ASN name:	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

2BE8000

trusted library allocation

page read and write

762000

unkown

page readonly

4FB2000

trusted library allocation

page read and write

75D4000

heap

page read and write

2CB6000

trusted library allocation

page read and write

559C000

heap

page read and write

2B41000

trusted library allocation

page read and write

77D0000

trusted library allocation

page read and write

2DA5000

trusted library allocation

page read and write

2D9C000

trusted library allocation

page read and write

2CC2000

trusted library allocation

page read and write

5C7E000

stack

page read and write

D15000

heap

page read and write

7616000

heap

page read and write

645C000

heap

page read and write

771B000

heap

page read and write

10D5000

trusted library allocation

page execute and read and write

10A0000

trusted library allocation

page read and write

10A3000

trusted library allocation

page execute and read and write

3EEE000

trusted library allocation

page read and write

5DBE000

stack

page read and write

76AE000

heap

page read and write

6DE0000

trusted library allocation

page read and write

BC0000

heap

page read and write

77FA000

trusted library allocation

page read and write

77EF000

trusted library allocation

page read and write

5340000

heap

page read and write

7810000

trusted library allocation

page read and write

3050000

trusted library allocation

page read and write

6856000

trusted library allocation

page read and write

6B7C000

stack

page read and write

63BE000

heap

page read and write

3EDD000

trusted library allocation

page read and write

668E000

stack

page read and write

CAD000

heap

page read and write

113E000

stack

page read and write

76AC000

heap

page read and write

2CEB000

trusted library allocation

page read and write

BB0000

heap

page read and write

3F08000

trusted library allocation

page read and write

6808000

trusted library allocation

page read and write

68D0000

trusted library allocation

page read and write

775E000

heap

page read and write

61FE000

stack

page read and write

1090000

trusted library allocation

page read and write

2DF3000

trusted library allocation

page read and write

5581000

heap

page read and write

2DE7000

trusted library allocation

page read and write

2A88000

trusted library allocation

page read and write

7763000

heap

page read and write

77D2000

trusted library allocation

page read and write

63A0000

trusted library allocation

page execute and read and write

6B00000

trusted library allocation

page read and write

6840000

trusted library allocation

page read and write

63B0000

heap

page read and write

11DE000

heap

page read and write

6E20000

trusted library allocation

page read and write

3EBD000

trusted library allocation

page read and write

C14000

heap

page read and write

4F9E000

trusted library allocation

page read and write

7661000

heap

page read and write

546E000

stack

page read and write

6990000

trusted library allocation

page execute and read and write

2CF2000

trusted library allocation

page read and write

6810000

trusted library allocation

page read and write

2E0E000

trusted library allocation

page read and write

E30000

heap

page read and write

763F000

heap

page read and write

3F7E000

trusted library allocation

page read and write

2D0A000

trusted library allocation

page read and write

3EF9000

trusted library allocation

page read and write

768D000

heap

page read and write

6AC0000

trusted library allocation

page read and write

10D0000

trusted library allocation

page read and write

6E30000

trusted library allocation

page read and write

6AF0000

trusted library allocation

page read and write

3F35000

trusted library allocation

page read and write

797000

unkown

page readonly

2A7F000

stack

page read and write

6E26000

trusted library allocation

page read and write

75F6000

heap

page read and write

870E000

stack

page read and write

6E54000

trusted library allocation

page read and write

B57000

stack

page read and write

3F96000

trusted library allocation

page read and write

2DD5000

trusted library allocation

page read and write

CE0000

heap

page read and write

5593000

heap

page read and write

3F67000

trusted library allocation

page read and write

6380000

heap

page read and write

62FE000

stack

page read and write

75E4000

heap

page read and write

88D0000

trusted library allocation

page read and write

6E40000

trusted library allocation

page execute and read and write

BEE000

heap

page read and write

2B30000

heap

page read and write

50BE000

stack

page read and write

10D2000

trusted library allocation

page read and write

3F83000

trusted library allocation

page read and write

7621000

heap

page read and write

2DC7000

trusted library allocation

page read and write

F7E000

stack

page read and write

6457000

heap

page read and write

10B0000

trusted library allocation

page read and write

76B6000

heap

page read and write

6E50000

trusted library allocation

page read and write

3F21000

trusted library allocation

page read and write

6800000

trusted library allocation

page read and write

2E03000

trusted library allocation

page read and write

10C0000

trusted library allocation

page read and write

5042000

trusted library allocation

page read and write

6940000

trusted library allocation

page execute and read and write

7704000

heap

page read and write

6890000

trusted library allocation

page read and write

C59000

heap

page read and write

2DDC000

trusted library allocation

page read and write

77E8000

trusted library allocation

page read and write

10D7000

trusted library allocation

page execute and read and write

68C0000

trusted library allocation

page read and write

88B2000

trusted library allocation

page read and write

74D0000

heap

page read and write

787D000

stack

page read and write

4FF0000

trusted library allocation

page read and write

CB4000

heap

page read and write

77F5000

trusted library allocation

page read and write

943E000

stack

page read and write

2DF8000

trusted library allocation

page read and write

317C000

trusted library allocation

page read and write

689E000

trusted library allocation

page read and write

3F14000

trusted library allocation

page read and write

3ED7000

trusted library allocation

page read and write

860E000

stack

page read and write

4FC0000

trusted library allocation

page read and write

77D9000

trusted library allocation

page read and write

680A000

trusted library allocation

page read and write

686E000

trusted library allocation

page read and write

6406000

heap

page read and write

11C0000

trusted library allocation

page read and write

78BE000

stack

page read and write

E37000

heap

page read and write

10BD000

trusted library allocation

page execute and read and write

5030000

heap

page read and write

3F02000

trusted library allocation

page read and write

4FA1000

trusted library allocation

page read and write

3F8C000

trusted library allocation

page read and write

6CBE000

stack

page read and write

7C6F000

stack

page read and write

3B4F000

trusted library allocation

page read and write

88AB000

stack

page read and write

5DFE000

stack

page read and write

7693000

heap

page read and write

63CC000

heap

page read and write

3BC4000

trusted library allocation

page read and write

2E55000

trusted library allocation

page read and write

2DAD000

trusted library allocation

page read and write

50D3000

heap

page read and write

2D1A000

trusted library allocation

page read and write

88B0000

trusted library allocation

page read and write

4FC5000

trusted library allocation

page read and write

799E000

stack

page read and write

6B30000

trusted library allocation

page execute and read and write

3F7A000

trusted library allocation

page read and write

556F000

stack

page read and write

2D25000

trusted library allocation

page read and write

3EF3000

trusted library allocation

page read and write

68B0000

trusted library allocation

page read and write

7604000

heap

page read and write

6871000

trusted library allocation

page read and write

684B000

trusted library allocation

page read and write

10AD000

trusted library allocation

page execute and read and write

2D0E000

trusted library allocation

page read and write

77FF000

trusted library allocation

page read and write

88F0000

heap

page read and write

CBF000

heap

page read and write

3B41000

trusted library allocation

page read and write

3F52000

trusted library allocation

page read and write

67CF000

stack

page read and write

4FAD000

trusted library allocation

page read and write

3F4D000

trusted library allocation

page read and write

3B83000

trusted library allocation

page read and write

E2D000

stack

page read and write

6EDF1000

unkown

page execute read

3EF7000

trusted library allocation

page read and write

2CDE000

trusted library allocation

page read and write

10C6000

trusted library allocation

page execute and read and write

876E000

stack

page read and write

642D000

heap

page read and write

689B000

trusted library allocation

page read and write

6AE0000

trusted library allocation

page read and write

D10000

heap

page read and write

2CC5000

trusted library allocation

page read and write

5350000

trusted library allocation

page read and write

5040000

trusted library allocation

page read and write

77EA000

trusted library allocation

page read and write

792000

unkown

page readonly

795E000

stack

page read and write

75D0000

heap

page read and write

3181000

trusted library allocation

page read and write

7664000

heap

page read and write

2CAE000

trusted library allocation

page read and write

3F74000

trusted library allocation

page read and write

5680000

trusted library allocation

page read and write

11D6000

heap

page read and write

6E3A000

trusted library allocation

page read and write

3177000

trusted library allocation

page read and write

5358000

trusted library allocation

page read and write

658E000

stack

page read and write

3EEA000

trusted library allocation

page read and write

2ECF000

trusted library allocation

page read and write

64AA000

heap

page read and write

4C3C000

stack

page read and write

4F8B000

trusted library allocation

page read and write

6920000

trusted library allocation

page read and write

76C6000

heap

page read and write

7F760000

trusted library allocation

page execute and read and write

6851000

trusted library allocation

page read and write

68A0000

trusted library allocation

page read and write

3F89000

trusted library allocation

page read and write

6DE4000

trusted library allocation

page read and write

4FFE000

trusted library allocation

page read and write

7741000

heap

page read and write

3DC4000

trusted library allocation

page read and write

7CA0000

heap

page read and write

66CE000

stack

page read and write

7C90000

trusted library allocation

page execute and read and write

3B62000

trusted library allocation

page read and write

3F87000

trusted library allocation

page read and write

531E000

stack

page read and write

6930000

trusted library allocation

page execute and read and write

6AD0000

trusted library allocation

page read and write

78D0000

trusted library allocation

page read and write

6880000

trusted library allocation

page read and write

6EE0D000

unkown

page read and write

6E23000

trusted library allocation

page read and write

118B000

stack

page read and write

6DC0000

trusted library allocation

page execute and read and write

4F80000

trusted library allocation

page read and write

7729000

heap

page read and write

7756000

heap

page read and write

75DA000

heap

page read and write

6EE0F000

unkown

page readonly

6472000

heap

page read and write

764D000

heap

page read and write

3F47000

trusted library allocation

page read and write

2DEE000

trusted library allocation

page read and write

3F2E000

trusted library allocation

page read and write

2DBA000

trusted library allocation

page read and write

2CFD000

trusted library allocation

page read and write

50D0000

heap

page read and write

7A6000

unkown

page readonly

6819000

trusted library allocation

page read and write

60BE000

stack

page read and write

11D0000

heap

page read and write

6EDF0000

unkown

page readonly

CA4000

heap

page read and write

3056000

trusted library allocation

page read and write

3EFC000

trusted library allocation

page read and write

2D04000

trusted library allocation

page read and write

7678000

heap

page read and write

6B10000

trusted library allocation

page execute and read and write

7C70000

trusted library allocation

page read and write

3EC2000

trusted library allocation

page read and write

10CA000

trusted library allocation

page execute and read and write

762C000

heap

page read and write

3187000

trusted library allocation

page read and write

5D7F000

stack

page read and write

2CAB000

trusted library allocation

page read and write

3EE4000

trusted library allocation

page read and write

7711000

heap

page read and write

316B000

trusted library allocation

page read and write

771F000

heap

page read and write

BE0000

heap

page read and write

3ECD000

trusted library allocation

page read and write

6815000

trusted library allocation

page read and write

7800000

trusted library allocation

page read and write

2B20000

trusted library allocation

page read and write

A59000

stack

page read and write

8710000

trusted library allocation

page read and write

4F84000

trusted library allocation

page read and write

5320000

heap

page read and write

5050000

trusted library allocation

page execute and read and write

78C0000

trusted library allocation

page read and write

2E78000

trusted library allocation

page read and write

3158000

trusted library allocation

page read and write

10A4000

trusted library allocation

page read and write

3F41000

trusted library allocation

page read and write

645A000

heap

page read and write

76ED000

heap

page read and write

760000

unkown

page readonly

C22000

heap

page read and write

1190000

trusted library allocation

page execute and read and write

11B0000

trusted library allocation

page read and write

5670000

trusted library allocation

page read and write

61BF000

stack

page read and write

6895000

trusted library allocation

page read and write

3058000

trusted library allocation

page read and write

77D5000

trusted library allocation

page read and write

646C000

heap

page read and write

64AE000

heap

page read and write

89FD000

stack

page read and write

953E000

stack

page read and write

63BA000

heap

page read and write

8720000

trusted library allocation

page execute and read and write

6862000

trusted library allocation

page read and write

6817000

trusted library allocation

page read and write

3F5D000

trusted library allocation

page read and write

69A0000

trusted library allocation

page execute and read and write

643C000

heap

page read and write

107E000

stack

page read and write

886E000

stack

page read and write

7628000

heap

page read and write

2CD1000

trusted library allocation

page read and write

6910000

trusted library allocation

page read and write

68E0000

trusted library allocation

page read and write

2C47000

trusted library allocation

page read and write

11A0000

trusted library allocation

page read and write

6C7C000

stack

page read and write

3F92000

trusted library allocation

page read and write

6DBC000

stack

page read and write

3F6D000

trusted library allocation

page read and write

10C2000

trusted library allocation

page read and write

4FA6000

trusted library allocation

page read and write

10F0000

trusted library allocation

page read and write

BFF000

heap

page read and write

5360000

heap

page execute and read and write

1140000

heap

page execute and read and write

791E000

stack

page read and write

F3E000

stack

page read and write

6390000

trusted library allocation

page execute and read and write

76D6000

heap

page read and write

CC4000

heap

page read and write

10DB000

trusted library allocation

page execute and read and write

6EE06000

unkown

page readonly

6488000

heap

page read and write

6805000

trusted library allocation

page read and write

2CB9000

trusted library allocation

page read and write

4FD0000

trusted library allocation

page read and write

3CC4000

trusted library allocation

page read and write

There are 328 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
3q1lESMAMh.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report3q1lESMAMh.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
3q1lESMAMh.exe