Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

44QHzbqD3m.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.072480224114925
Filename:	44QHzbqD3m.exe
Filesize:	312093
MD5:	11ae7e8293ed1c199cde872ee52d910d
SHA1:	e8acbfe5d1015b5554237749e5d270bc2efbf0ab
SHA256:	0d28a4525dba00368e0a1a146b0c1e75656215338358a7dbd65ee5ca2508cacf
SHA512:	716565498fb3d68927b2145ca16bc7e4d44eb60ace7e590180832d512352198289de0942bbfc434438a19f2d1d22c2aeba5b0262ad7184f726bc8835d2e22982
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information	Windows Management Instrumentation Security Software Discovery
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings	Windows Management Instrumentation Security Software Discovery
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops certificate files (DER)	E-Banking Fraud
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
SQL strings found in memory and binary data	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:29 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:29 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Entropy:	3.4564792794500083
Encrypted:	false
Ssdeep:	48:8ScdZTBnGRYrnvPdAKRkdAGdAKRFdAKR/U:8SaZ
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\44QHzbqD3m.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\44QHzbqD3m.exe.log
Category:	dropped
Dump:	44QHzbqD3m.exe.log.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3318368586986695
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
Size:	3274
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\Tmp7E50.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp7E50.tmp
Category:	dropped
Dump:	Tmp7E50.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\Tmp7E60.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp7E60.tmp
Category:	dropped
Dump:	Tmp7E60.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\44QHzbqD3m.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	2251
Whitelisted:	true
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\44QHzbqD3m.exe

"C:\Users\user\Desktop\44QHzbqD3m.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6344
Target ID:	0
Parent PID:	2580
Name:	44QHzbqD3m.exe
Path:	C:\Users\user\Desktop\44QHzbqD3m.exe
Commandline:	"C:\Users\user\Desktop\44QHzbqD3m.exe"
Size:	312093
MD5:	11AE7E8293ED1C199CDE872EE52D910D
Time:	12:36:59
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xdf0000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://tempuri.org/Entity/Id15V

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce4

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

http://tempuri.org/Entity/Id19Responseus

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://tempuri.org/Entity/Id4rA

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/Entity/Id8ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1

unknown

There are 90 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

103.113.70.99

unknown

India

Details

IP:	103.113.70.99
TargetID:	0
Current Path:	C:\Users\user\Desktop\44QHzbqD3m.exe
Country:	India
Countrycode:	IND
ASN number:	133973
ASN name:	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

3239000

trusted library allocation

page read and write

DF2000

unkown

page readonly

E22000

unkown

page readonly

18A3000

heap

page read and write

17AE000

stack

page read and write

32FD000

trusted library allocation

page read and write

8010000

trusted library allocation

page execute and read and write

56E0000

trusted library allocation

page read and write

45C6000

trusted library allocation

page read and write

44DF000

trusted library allocation

page read and write

419F000

trusted library allocation

page read and write

5650000

trusted library allocation

page read and write

43D1000

trusted library allocation

page read and write

6A20000

trusted library allocation

page execute and read and write

6EA0000

trusted library allocation

page read and write

7C95000

heap

page read and write

58D4000

trusted library allocation

page read and write

175E000

stack

page read and write

1504000

trusted library allocation

page read and write

45DE000

trusted library allocation

page read and write

5621000

trusted library allocation

page read and write

43F4000

trusted library allocation

page read and write

4314000

trusted library allocation

page read and write

44CD000

trusted library allocation

page read and write

45B5000

trusted library allocation

page read and write

565E000

trusted library allocation

page read and write

1536000

trusted library allocation

page execute and read and write

18E0000

heap

page read and write

41CC000

trusted library allocation

page read and write

45F7000

trusted library allocation

page read and write

685E000

stack

page read and write

3387000

trusted library allocation

page read and write

43EF000

trusted library allocation

page read and write

7C81000

heap

page read and write

6F10000

trusted library allocation

page read and write

43B0000

trusted library allocation

page read and write

4595000

trusted library allocation

page read and write

845E000

stack

page read and write

1560000

heap

page read and write

358D000

trusted library allocation

page read and write

4500000

trusted library allocation

page read and write

1610000

heap

page read and write

80DE000

stack

page read and write

55E0000

trusted library allocation

page read and write

1606000

heap

page read and write

45A8000

trusted library allocation

page read and write

7C4D000

heap

page read and write

730C000

stack

page read and write

452C000

trusted library allocation

page read and write

4437000

trusted library allocation

page read and write

3510000

trusted library allocation

page read and write

1532000

trusted library allocation

page read and write

45D0000

trusted library allocation

page read and write

7CCA000

heap

page read and write

15A0000

heap

page read and write

6EF2000

trusted library allocation

page read and write

45D3000

trusted library allocation

page read and write

41CF000

trusted library allocation

page read and write

43E9000

trusted library allocation

page read and write

44F0000

trusted library allocation

page read and write

6F25000

trusted library allocation

page read and write

162B000

heap

page read and write

6E95000

trusted library allocation

page read and write

1658000

heap

page read and write

7E10000

trusted library allocation

page execute and read and write

446B000

trusted library allocation

page read and write

1587000

heap

page read and write

151D000

trusted library allocation

page execute and read and write

5670000

trusted library allocation

page read and write

35EF000

trusted library allocation

page read and write

4460000

trusted library allocation

page read and write

7C73000

heap

page read and write

45E9000

trusted library allocation

page read and write

7030000

trusted library allocation

page execute and read and write

528C000

stack

page read and write

44E5000

trusted library allocation

page read and write

7453000

trusted library allocation

page read and write

6FD0000

trusted library allocation

page execute and read and write

1540000

trusted library allocation

page read and write

14EF000

stack

page read and write

7C6D000

heap

page read and write

17B8000

trusted library allocation

page read and write

4552000

trusted library allocation

page read and write

6DE5000

heap

page read and write

6EA9000

trusted library allocation

page read and write

7EAD000

trusted library allocation

page read and write

6968000

trusted library allocation

page read and write

3685000

trusted library allocation

page read and write

58E0000

heap

page execute and read and write

6D90000

heap

page read and write

43D6000

trusted library allocation

page read and write

157F000

heap

page read and write

8000000

trusted library allocation

page read and write

3507000

trusted library allocation

page read and write

35F8000

trusted library allocation

page read and write

7490000

trusted library allocation

page read and write

4212000

trusted library allocation

page read and write

7480000

trusted library allocation

page execute and read and write

13E5000

heap

page read and write

7EF40000

trusted library allocation

page execute and read and write

7160000

trusted library allocation

page read and write

7FC0000

trusted library allocation

page read and write

645E000

stack

page read and write

44FD000

trusted library allocation

page read and write

43DC000

trusted library allocation

page read and write

7C69000

heap

page read and write

15A2000

heap

page read and write

439B000

trusted library allocation

page read and write

5AEE000

stack

page read and write

560B000

trusted library allocation

page read and write

6FB0000

trusted library allocation

page read and write

1652000

heap

page read and write

43AA000

trusted library allocation

page read and write

7C10000

heap

page read and write

80F0000

heap

page read and write

3554000

trusted library allocation

page read and write

18C0000

heap

page read and write

6E85000

heap

page read and write

4615000

trusted library allocation

page read and write

434C000

trusted library allocation

page read and write

164D000

heap

page read and write

3564000

trusted library allocation

page read and write

6DD6000

heap

page read and write

1568000

heap

page read and write

6B1E000

stack

page read and write

355E000

trusted library allocation

page read and write

7C6B000

heap

page read and write

447E000

trusted library allocation

page read and write

7C37000

heap

page read and write

6EE1000

trusted library allocation

page read and write

7FF8000

trusted library allocation

page read and write

41D3000

trusted library allocation

page read and write

6A30000

trusted library allocation

page execute and read and write

7FC5000

trusted library allocation

page read and write

7C18000

heap

page read and write

7FBD000

stack

page read and write

6F2E000

trusted library allocation

page read and write

4602000

trusted library allocation

page read and write

440C000

trusted library allocation

page read and write

7B10000

heap

page read and write

3677000

trusted library allocation

page read and write

4364000

trusted library allocation

page read and write

1320000

heap

page read and write

5604000

trusted library allocation

page read and write

7180000

trusted library allocation

page read and write

153A000

trusted library allocation

page execute and read and write

35FC000

trusted library allocation

page read and write

6960000

trusted library allocation

page read and write

80E0000

trusted library allocation

page read and write

6E5F000

heap

page read and write

3521000

trusted library allocation

page read and write

438F000

trusted library allocation

page read and write

136E000

stack

page read and write

7EA9000

trusted library allocation

page read and write

41B2000

trusted library allocation

page read and write

337B000

trusted library allocation

page read and write

435C000

trusted library allocation

page read and write

71A0000

trusted library allocation

page execute and read and write

3561000

trusted library allocation

page read and write

3512000

trusted library allocation

page read and write

442A000

trusted library allocation

page read and write

44B4000

trusted library allocation

page read and write

6283000

heap

page read and write

41C0000

trusted library allocation

page read and write

6DA4000

heap

page read and write

1503000

trusted library allocation

page execute and read and write

58D0000

trusted library allocation

page read and write

366D000

trusted library allocation

page read and write

5632000

trusted library allocation

page read and write

671F000

stack

page read and write

6E51000

heap

page read and write

43A0000

trusted library allocation

page read and write

7170000

trusted library allocation

page read and write

7FDA000

trusted library allocation

page read and write

4345000

trusted library allocation

page read and write

436F000

trusted library allocation

page read and write

43C3000

trusted library allocation

page read and write

18A0000

heap

page read and write

4443000

trusted library allocation

page read and write

56E2000

trusted library allocation

page read and write

4388000

trusted library allocation

page read and write

13AE000

stack

page read and write

457A000

trusted library allocation

page read and write

35BC000

trusted library allocation

page read and write

875E000

stack

page read and write

3656000

trusted library allocation

page read and write

7E70000

trusted library allocation

page read and write

188B000

stack

page read and write

809E000

stack

page read and write

4533000

trusted library allocation

page read and write

4458000

trusted library allocation

page read and write

45FC000

trusted library allocation

page read and write

6DE3000

heap

page read and write

FD7000

stack

page read and write

6F40000

trusted library allocation

page read and write

3528000

trusted library allocation

page read and write

6F20000

trusted library allocation

page read and write

8030000

trusted library allocation

page read and write

1601000

heap

page read and write

1510000

trusted library allocation

page read and write

7CE3000

heap

page read and write

5600000

trusted library allocation

page read and write

156E000

heap

page read and write

154B000

trusted library allocation

page execute and read and write

6287000

heap

page read and write

43FE000

trusted library allocation

page read and write

592E000

stack

page read and write

6E8A000

heap

page read and write

4526000

trusted library allocation

page read and write

7C63000

heap

page read and write

7150000

trusted library allocation

page read and write

4356000

trusted library allocation

page read and write

44AC000

trusted library allocation

page read and write

7C3A000

heap

page read and write

569E000

trusted library allocation

page read and write

815E000

stack

page read and write

7FC9000

trusted library allocation

page read and write

6F70000

trusted library allocation

page read and write

45C1000

trusted library allocation

page read and write

6E7B000

heap

page read and write

851E000

stack

page read and write

4382000

trusted library allocation

page read and write

6E62000

heap

page read and write

365F000

trusted library allocation

page read and write

3515000

trusted library allocation

page read and write

6E4D000

heap

page read and write

5B2E000

stack

page read and write

3689000

trusted library allocation

page read and write

1240000

heap

page read and write

56F0000

trusted library allocation

page execute and read and write

6FA0000

trusted library allocation

page read and write

6E9A000

trusted library allocation

page read and write

4455000

trusted library allocation

page read and write

44A9000

trusted library allocation

page read and write

561E000

trusted library allocation

page read and write

7FE5000

trusted library allocation

page read and write

351E000

trusted library allocation

page read and write

5665000

trusted library allocation

page read and write

44D8000

trusted library allocation

page read and write

44EB000

trusted library allocation

page read and write

1542000

trusted library allocation

page read and write

5690000

trusted library allocation

page read and write

4609000

trusted library allocation

page read and write

4321000

trusted library allocation

page read and write

1760000

trusted library allocation

page read and write

3585000

trusted library allocation

page read and write

744C000

stack

page read and write

8160000

trusted library allocation

page read and write

443D000

trusted library allocation

page read and write

4508000

trusted library allocation

page read and write

55D0000

trusted library allocation

page execute and read and write

7CB6000

heap

page read and write

6E6E000

heap

page read and write

6EDB000

trusted library allocation

page read and write

4395000

trusted library allocation

page read and write

14F0000

trusted library allocation

page read and write

3191000

trusted library allocation

page read and write

4430000

trusted library allocation

page read and write

4425000

trusted library allocation

page read and write

43E3000

trusted library allocation

page read and write

4513000

trusted library allocation

page read and write

5660000

trusted library allocation

page read and write

437D000

trusted library allocation

page read and write

6EE6000

trusted library allocation

page read and write

4359000

trusted library allocation

page read and write

5BAE000

stack

page read and write

150D000

trusted library allocation

page execute and read and write

3381000

trusted library allocation

page read and write

720C000

stack

page read and write

7FC2000

trusted library allocation

page read and write

7EA0000

trusted library allocation

page read and write

4448000

trusted library allocation

page read and write

431E000

trusted library allocation

page read and write

1520000

heap

page read and write

448B000

trusted library allocation

page read and write

EDA000

stack

page read and write

7190000

trusted library allocation

page read and write

1530000

trusted library allocation

page read and write

4491000

trusted library allocation

page read and write

41C5000

trusted library allocation

page read and write

4521000

trusted library allocation

page read and write

1545000

trusted library allocation

page execute and read and write

6FC0000

trusted library allocation

page execute and read and write

6E90000

trusted library allocation

page read and write

4497000

trusted library allocation

page read and write

1527000

heap

page read and write

5B6E000

stack

page read and write

339A000

trusted library allocation

page read and write

4191000

trusted library allocation

page read and write

4636000

trusted library allocation

page read and write

3385000

trusted library allocation

page read and write

625E000

stack

page read and write

41B9000

trusted library allocation

page read and write

3625000

trusted library allocation

page read and write

453F000

trusted library allocation

page read and write

432C000

trusted library allocation

page read and write

45D6000

trusted library allocation

page read and write

3577000

trusted library allocation

page read and write

337F000

trusted library allocation

page read and write

7EA7000

trusted library allocation

page read and write

5A2F000

stack

page read and write

6D8F000

stack

page read and write

734E000

stack

page read and write

356C000

trusted library allocation

page read and write

8020000

trusted library allocation

page read and write

7C9B000

heap

page read and write

4484000

trusted library allocation

page read and write

44BF000

trusted library allocation

page read and write

4618000

trusted library allocation

page read and write

7C49000

heap

page read and write

449C000

trusted library allocation

page read and write

6F01000

trusted library allocation

page read and write

35CB000

trusted library allocation

page read and write

18B0000

heap

page read and write

6C1E000

stack

page read and write

1547000

trusted library allocation

page execute and read and write

6EFE000

trusted library allocation

page read and write

E36000

unkown

page readonly

1890000

heap

page execute and read and write

6EA5000

trusted library allocation

page read and write

6F2B000

trusted library allocation

page read and write

6F50000

trusted library allocation

page read and write

6EA7000

trusted library allocation

page read and write

318E000

stack

page read and write

7EB0000

heap

page read and write

6A10000

heap

page read and write

7FDF000

trusted library allocation

page read and write

44D2000

trusted library allocation

page read and write

45BA000

trusted library allocation

page read and write

6E76000

heap

page read and write

6271000

heap

page read and write

6E30000

heap

page read and write

13E0000

heap

page read and write

6F30000

trusted library allocation

page read and write

4417000

trusted library allocation

page read and write

3552000

trusted library allocation

page read and write

DF0000

unkown

page readonly

6E5A000

heap

page read and write

44A6000

trusted library allocation

page read and write

55F0000

trusted library allocation

page read and write

43B8000

trusted library allocation

page read and write

4479000

trusted library allocation

page read and write

458A000

trusted library allocation

page read and write

6F60000

trusted library allocation

page read and write

4404000

trusted library allocation

page read and write

43AD000

trusted library allocation

page read and write

5626000

trusted library allocation

page read and write

4401000

trusted library allocation

page read and write

44FA000

trusted library allocation

page read and write

6980000

trusted library allocation

page read and write

7C2B000

heap

page read and write

7FEF000

trusted library allocation

page read and write

8110000

trusted library allocation

page execute and read and write

6ED0000

trusted library allocation

page read and write

4539000

trusted library allocation

page read and write

7FD8000

trusted library allocation

page read and write

4452000

trusted library allocation

page read and write

7FF0000

trusted library allocation

page read and write

7020000

trusted library allocation

page execute and read and write

865D000

stack

page read and write

5640000

trusted library allocation

page read and write

7FEA000

trusted library allocation

page read and write

3377000

trusted library allocation

page read and write

695F000

stack

page read and write

861E000

stack

page read and write

71C0000

trusted library allocation

page execute and read and write

7C21000

heap

page read and write

5A30000

heap

page read and write

56D0000

heap

page read and write

18E6000

heap

page read and write

6DED000

heap

page read and write

45AE000

trusted library allocation

page read and write

7E6B000

stack

page read and write

7C28000

heap

page read and write

7C41000

heap

page read and write

4324000

trusted library allocation

page read and write

562D000

trusted library allocation

page read and write

6C8E000

stack

page read and write

18EE000

heap

page read and write

7C57000

heap

page read and write

7450000

trusted library allocation

page read and write

4337000

trusted library allocation

page read and write

6970000

trusted library allocation

page read and write

1500000

trusted library allocation

page read and write

681E000

stack

page read and write

E27000

unkown

page readonly

45A3000

trusted library allocation

page read and write

3680000

trusted library allocation

page read and write

460E000

trusted library allocation

page read and write

There are 379 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
44QHzbqD3m.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report44QHzbqD3m.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
44QHzbqD3m.exe