IOC Report
Documento_Remisorio_Activo_N#8475684756..exe

loading gif

Files

File Path
Type
Category
Malicious
Documento_Remisorio_Activo_N#8475684756..exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\Documents\ChromeUpdate\cr0wdik.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Documento_Remisorio_Activo_N#8475684756..exe
"C:\Users\user\Desktop\Documento_Remisorio_Activo_N#8475684756..exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
 malicious

URLs

Name
IP
Malicious
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
http://www.360totalsecurity.com/d/ts/%s/%s/channelOpen
unknown
http://ocsp.sectigo.com0
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
http://s.360safe.com/safei18n/
unknown
https://sectigo.com/CPS0D
unknown

Domains

Name
IP
Malicious
procesolargovalelapena222.dynuddns.net
45.95.169.113
 malicious

IPs

IP
Domain
Country
Malicious
45.95.169.113
procesolargovalelapena222.dynuddns.net
Croatia (LOCAL Name: Hrvatska)
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Muhandra

Memdumps

Base Address
Regiontype
Protect
Malicious
AA2000
remote allocation
page execute and read and write
 malicious
C02000
direct allocation
page execute and read and write
 malicious
4D4000
unkown
page execute and read and write
 malicious
A69000
stack
page read and write
6B70000
trusted library allocation
page read and write
510A000
trusted library allocation
page execute and read and write
51E3000
heap
page read and write
150F000
stack
page read and write
6C40000
heap
page execute and read and write
5107000
trusted library allocation
page execute and read and write
6C30000
trusted library allocation
page read and write
6B50000
trusted library allocation
page read and write
6B2D000
stack
page read and write
5430000
heap
page read and write
C90000
heap
page read and write
1E0000
heap
page read and write
5180000
heap
page read and write
6B60000
trusted library allocation
page read and write
9C000
stack
page read and write
AA0000
remote allocation
page execute and read and write
97BE000
stack
page read and write
511B000
trusted library allocation
page execute and read and write
6C50000
heap
page read and write
B46000
stack
page read and write
401000
unkown
page execute read
E10000
heap
page read and write
51E3000
heap
page read and write
51F2000
heap
page read and write
50F0000
trusted library allocation
page read and write
50ED000
trusted library allocation
page execute and read and write
6B30000
heap
page read and write
51E3000
heap
page read and write
51B8000
heap
page read and write
6B60000
trusted library allocation
page read and write
96BE000
stack
page read and write
51FF000
heap
page read and write
6C30000
trusted library allocation
page read and write
5410000
trusted library allocation
page execute and read and write
51E3000
heap
page read and write
917E000
stack
page read and write
BCE000
stack
page read and write
B8E000
stack
page read and write
400000
unkown
page readonly
50E4000
trusted library allocation
page read and write
51E3000
heap
page read and write
517E000
stack
page read and write
4A7000
unkown
page readonly
5209000
heap
page read and write
4D4000
unkown
page readonly
6B50000
trusted library allocation
page read and write
AAE000
remote allocation
page execute and read and write
1B0F000
stack
page read and write
86C000
stack
page read and write
6D70000
heap
page execute and read and write
5130000
trusted library allocation
page read and write
5110000
trusted library allocation
page read and write
97FE000
stack
page read and write
6BBE000
stack
page read and write
51AB000
heap
page read and write
34A0000
direct allocation
page read and write
5258000
heap
page read and write
6C30000
trusted library allocation
page read and write
C05000
heap
page read and write
6C30000
trusted library allocation
page read and write
6F7F000
stack
page read and write
51F8000
heap
page read and write
401000
unkown
page execute read
5188000
heap
page read and write
4CA000
unkown
page write copy
7F81000
trusted library allocation
page read and write
6C36000
trusted library allocation
page read and write
5420000
trusted library allocation
page read and write
4E1000
unkown
page readonly
6B50000
trusted library allocation
page read and write
BD0000
heap
page readonly
50E3000
trusted library allocation
page execute and read and write
C00000
direct allocation
page execute and read and write
6C10000
trusted library allocation
page read and write
51EF000
heap
page read and write
D60000
heap
page read and write
5214000
heap
page read and write
98FE000
stack
page read and write
6D50000
trusted library allocation
page read and write
5100000
trusted library allocation
page read and write
BE0000
heap
page read and write
E1A000
heap
page read and write
400000
unkown
page readonly
6F81000
trusted library allocation
page read and write
3490000
heap
page read and write
6C0E000
stack
page read and write
4EC000
unkown
page readonly
100000
heap
page read and write
4C9000
unkown
page write copy
4A7000
unkown
page readonly
5117000
trusted library allocation
page execute and read and write
51B6000
heap
page read and write
4EC000
unkown
page readonly
5102000
trusted library allocation
page read and write
6BC0000
heap
page read and write
6C51000
heap
page read and write
E1E000
heap
page read and write
6C30000
trusted library allocation
page read and write
AF0000
heap
page read and write
50D0000
trusted library allocation
page read and write
C0E000
direct allocation
page execute and read and write
4C9000
unkown
page read and write
C00000
heap
page read and write
There are 97 hidden memdumps, click here to show them.