Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

XHr735qu8v.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.061353871330497
Filename:	XHr735qu8v.exe
Filesize:	312989
MD5:	dcf8679430bc69cfc5eb65f4dabf4f09
SHA1:	9710f630423d29c6f3b5896eb47de41a57086275
SHA256:	53e9bec7369824cc6c1c0823afd428d6c8b3156870527b72916c1cb898e3f43d
SHA512:	3e685e2cae493a05c8a5a13d9513cb9b2e94054e7da92a34e87d2eba549e43801664e0beaa3229d9f4389911868bd31a66563c445055e18e648d7c893299b2bf
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Security Software Discovery
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information	Data from Local System
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp Security Software Discovery
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Security Software Discovery Archive Collected Data Encrypted Channel
Drops certificate files (DER)	E-Banking Fraud
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Security Software Discovery System Information Discovery
Sample file is different than original file name gathered from version info	System Summary	Security Software Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse usering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary	Security Software Discovery
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary	Windows Management Instrumentation
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking	Security Software Discovery
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:17 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\Desktop\XHr735qu8v.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:17 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Entropy:	3.4685717994045424
Encrypted:	false
Ssdeep:	48:8Swd5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8Saby7
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XHr735qu8v.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XHr735qu8v.exe.log
Category:	dropped
Dump:	XHr735qu8v.exe.log.1.dr
ID:	dr_4
Target ID:	1
Process:	C:\Users\user\Desktop\XHr735qu8v.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3318368586986695
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
Size:	3274
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\Tmp4DC2.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp4DC2.tmp
Category:	dropped
Dump:	Tmp4DC2.tmp.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\XHr735qu8v.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\Tmp4DE2.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp4DE2.tmp
Category:	dropped
Dump:	Tmp4DE2.tmp.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\XHr735qu8v.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\Desktop\XHr735qu8v.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	2251
Whitelisted:	true
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\XHr735qu8v.exe

"C:\Users\user\Desktop\XHr735qu8v.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1808
Target ID:	1
Parent PID:	4004
Name:	XHr735qu8v.exe
Path:	C:\Users\user\Desktop\XHr735qu8v.exe
Commandline:	"C:\Users\user\Desktop\XHr735qu8v.exe"
Size:	312989
MD5:	DCF8679430BC69CFC5EB65F4DABF4F09
Time:	14:41:55
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xbc0000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/Entity/Id8ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust

unknown

There are 90 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

103.113.70.99

unknown

India

Details

IP:	103.113.70.99
TargetID:	1
Current Path:	C:\Users\user\Desktop\XHr735qu8v.exe
Country:	India
Countrycode:	IND
ASN number:	133973
ASN name:	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	1
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

BC2000

unkown

page readonly

3037000

trusted library allocation

page read and write

7B47000

heap

page read and write

40A8000

trusted library allocation

page read and write

11E0000

trusted library allocation

page read and write

810F000

stack

page read and write

59A0000

trusted library allocation

page read and write

155E000

stack

page read and write

5710000

trusted library allocation

page read and write

33AF000

trusted library allocation

page read and write

7C75000

trusted library allocation

page read and write

6C60000

trusted library allocation

page read and write

31D5000

trusted library allocation

page read and write

796B000

unkown

page read and write

423A000

trusted library allocation

page read and write

40F1000

trusted library allocation

page read and write

858E000

stack

page read and write

C06000

unkown

page readonly

5600000

heap

page execute and read and write

3513000

trusted library allocation

page read and write

7250000

trusted library allocation

page execute and read and write

143F000

heap

page read and write

32C5000

trusted library allocation

page read and write

DA7000

stack

page read and write

16E6000

heap

page read and write

3411000

trusted library allocation

page read and write

41B0000

trusted library allocation

page read and write

6F70000

trusted library allocation

page execute and read and write

6CFE000

trusted library allocation

page read and write

68BE000

heap

page read and write

1010000

heap

page read and write

4096000

trusted library allocation

page read and write

627E000

stack

page read and write

4148000

trusted library allocation

page read and write

142C000

heap

page read and write

591E000

stack

page read and write

7CF0000

trusted library allocation

page read and write

54C0000

trusted library allocation

page execute and read and write

33C5000

trusted library allocation

page read and write

354C000

trusted library allocation

page read and write

1185000

heap

page read and write

3F9F000

trusted library allocation

page read and write

4220000

trusted library allocation

page read and write

16D0000

trusted library allocation

page read and write

53F6000

trusted library allocation

page read and write

6908000

heap

page read and write

6F50000

trusted library allocation

page read and write

413B000

trusted library allocation

page read and write

40F9000

trusted library allocation

page read and write

34F4000

trusted library allocation

page read and write

40DC000

trusted library allocation

page read and write

15F8000

trusted library allocation

page read and write

1207000

trusted library allocation

page execute and read and write

41EE000

trusted library allocation

page read and write

7230000

trusted library allocation

page execute and read and write

60A3000

heap

page read and write

6CF5000

trusted library allocation

page read and write

6D20000

trusted library allocation

page read and write

421A000

trusted library allocation

page read and write

3392000

trusted library allocation

page read and write

7C8F000

trusted library allocation

page read and write

1202000

trusted library allocation

page read and write

54A0000

heap

page read and write

3567000

trusted library allocation

page read and write

7EFE0000

trusted library allocation

page execute and read and write

607E000

stack

page read and write

6C6A000

trusted library allocation

page read and write

7C72000

trusted library allocation

page read and write

6D70000

trusted library allocation

page read and write

133F000

stack

page read and write

5420000

trusted library allocation

page read and write

5720000

heap

page read and write

6C68000

trusted library allocation

page read and write

7C79000

trusted library allocation

page read and write

7B19000

heap

page read and write

11DD000

trusted library allocation

page execute and read and write

81AE000

stack

page read and write

159E000

stack

page read and write

3364000

trusted library allocation

page read and write

40AF000

trusted library allocation

page read and write

6D00000

trusted library allocation

page read and write

6B4E000

stack

page read and write

435C000

trusted library allocation

page read and write

32A4000

trusted library allocation

page read and write

3417000

trusted library allocation

page read and write

11D4000

trusted library allocation

page read and write

72B7000

trusted library allocation

page read and write

546E000

trusted library allocation

page read and write

11D3000

trusted library allocation

page execute and read and write

7ABF000

heap

page read and write

113E000

stack

page read and write

407C000

trusted library allocation

page read and write

416E000

trusted library allocation

page read and write

7CB0000

trusted library allocation

page read and write

40D5000

trusted library allocation

page read and write

7AF5000

heap

page read and write

7D9E000

stack

page read and write

40CE000

trusted library allocation

page read and write

68EB000

heap

page read and write

136E000

heap

page read and write

3466000

trusted library allocation

page read and write

6C77000

trusted library allocation

page read and write

6CFB000

trusted library allocation

page read and write

5435000

trusted library allocation

page read and write

327B000

trusted library allocation

page read and write

68C1000

heap

page read and write

13A2000

heap

page read and write

30FE000

trusted library allocation

page read and write

345B000

trusted library allocation

page read and write

1220000

trusted library allocation

page read and write

7C9A000

trusted library allocation

page read and write

BC0000

unkown

page readonly

53D4000

trusted library allocation

page read and write

401B000

trusted library allocation

page read and write

4342000

trusted library allocation

page read and write

6CB1000

trusted library allocation

page read and write

348E000

trusted library allocation

page read and write

32BE000

trusted library allocation

page read and write

6CE0000

trusted library allocation

page read and write

6AEE000

stack

page read and write

582F000

stack

page read and write

6D40000

trusted library allocation

page read and write

7CA0000

trusted library allocation

page read and write

3454000

trusted library allocation

page read and write

1350000

trusted library allocation

page execute and read and write

508C000

stack

page read and write

7E2E000

stack

page read and write

7A70000

heap

page read and write

7B67000

heap

page read and write

7CC0000

trusted library allocation

page read and write

7DA0000

trusted library allocation

page read and write

7B13000

heap

page read and write

3520000

trusted library allocation

page read and write

711E000

stack

page read and write

40EF000

trusted library allocation

page read and write

4058000

trusted library allocation

page read and write

3290000

trusted library allocation

page read and write

7AA3000

heap

page read and write

4203000

trusted library allocation

page read and write

4183000

trusted library allocation

page read and write

3427000

trusted library allocation

page read and write

6CA0000

trusted library allocation

page read and write

53D0000

trusted library allocation

page read and write

82B0000

heap

page read and write

55CE000

stack

page read and write

72A0000

heap

page read and write

7CA4000

trusted library allocation

page read and write

409D000

trusted library allocation

page read and write

342A000

trusted library allocation

page read and write

328D000

trusted library allocation

page read and write

11FA000

trusted library allocation

page execute and read and write

7C95000

trusted library allocation

page read and write

7270000

trusted library allocation

page read and write

7B93000

heap

page read and write

5402000

trusted library allocation

page read and write

6CF0000

trusted library allocation

page read and write

31B0000

trusted library allocation

page read and write

4223000

trusted library allocation

page read and write

7220000

trusted library allocation

page read and write

68FE000

heap

page read and write

3296000

trusted library allocation

page read and write

11D0000

trusted library allocation

page read and write

7CD0000

trusted library allocation

page execute and read and write

7B32000

heap

page read and write

4209000

trusted library allocation

page read and write

6CD1000

trusted library allocation

page read and write

3FB2000

trusted library allocation

page read and write

CAA000

stack

page read and write

1200000

trusted library allocation

page read and write

5708000

trusted library allocation

page read and write

34BD000

trusted library allocation

page read and write

11F0000

trusted library allocation

page read and write

40F4000

trusted library allocation

page read and write

3267000

trusted library allocation

page read and write

3424000

trusted library allocation

page read and write

7A85000

heap

page read and write

422E000

trusted library allocation

page read and write

68F8000

heap

page read and write

3248000

trusted library allocation

page read and write

41D2000

trusted library allocation

page read and write

144C000

heap

page read and write

6C75000

trusted library allocation

page read and write

1205000

trusted library allocation

page execute and read and write

6C65000

trusted library allocation

page read and write

7AB5000

heap

page read and write

6F40000

trusted library allocation

page read and write

667E000

stack

page read and write

11F6000

trusted library allocation

page execute and read and write

3371000

trusted library allocation

page read and write

814F000

stack

page read and write

6800000

trusted library allocation

page execute and read and write

6CB6000

trusted library allocation

page read and write

689F000

heap

page read and write

82AE000

stack

page read and write

31FF000

trusted library allocation

page read and write

6091000

heap

page read and write

7ADE000

heap

page read and write

6D10000

trusted library allocation

page read and write

340B000

trusted library allocation

page read and write

7DAD000

trusted library allocation

page read and write

41DD000

trusted library allocation

page read and write

41F9000

trusted library allocation

page read and write

54B0000

trusted library allocation

page read and write

34FE000

trusted library allocation

page read and write

1690000

heap

page read and write

53EE000

trusted library allocation

page read and write

7A8E000

heap

page read and write

83EE000

stack

page read and write

3540000

trusted library allocation

page read and write

340F000

trusted library allocation

page read and write

33BA000

trusted library allocation

page read and write

3274000

trusted library allocation

page read and write

4210000

trusted library allocation

page read and write

1360000

heap

page read and write

53FD000

trusted library allocation

page read and write

355C000

trusted library allocation

page read and write

72B0000

trusted library allocation

page read and write

4070000

trusted library allocation

page read and write

40E6000

trusted library allocation

page read and write

7B3B000

heap

page read and write

40B9000

trusted library allocation

page read and write

6867000

heap

page read and write

40C4000

trusted library allocation

page read and write

32D6000

trusted library allocation

page read and write

32E1000

trusted library allocation

page read and write

67E0000

heap

page read and write

32B1000

trusted library allocation

page read and write

8160000

trusted library allocation

page execute and read and write

5410000

heap

page read and write

3160000

trusted library allocation

page read and write

16B0000

trusted library allocation

page read and write

7AFD000

heap

page read and write

7A7A000

heap

page read and write

7C70000

trusted library allocation

page read and write

72BA000

trusted library allocation

page read and write

6810000

heap

page read and write

3547000

trusted library allocation

page read and write

32D1000

trusted library allocation

page read and write

346D000

trusted library allocation

page read and write

68A3000

heap

page read and write

7A72000

heap

page read and write

10F0000

heap

page read and write

6E00000

trusted library allocation

page execute and read and write

7AD8000

heap

page read and write

16C0000

trusted library allocation

page read and write

BF2000

unkown

page readonly

3506000

trusted library allocation

page read and write

40E2000

trusted library allocation

page read and write

2F8E000

stack

page read and write

3260000

trusted library allocation

page read and write

40B4000

trusted library allocation

page read and write

68DF000

heap

page read and write

415C000

trusted library allocation

page read and write

7DEE000

stack

page read and write

60A7000

heap

page read and write

3551000

trusted library allocation

page read and write

6C4E000

stack

page read and write

68B3000

heap

page read and write

1387000

heap

page read and write

1340000

heap

page read and write

117E000

stack

page read and write

3FC2000

trusted library allocation

page read and write

339D000

trusted library allocation

page read and write

412F000

trusted library allocation

page read and write

3286000

trusted library allocation

page read and write

16E0000

heap

page read and write

3482000

trusted library allocation

page read and write

3472000

trusted library allocation

page read and write

BF7000

unkown

page readonly

3415000

trusted library allocation

page read and write

11ED000

trusted library allocation

page execute and read and write

3352000

trusted library allocation

page read and write

54B2000

trusted library allocation

page read and write

5430000

trusted library allocation

page read and write

6DA0000

trusted library allocation

page execute and read and write

15E0000

heap

page execute and read and write

7C9F000

trusted library allocation

page read and write

7D5D000

stack

page read and write

41CA000

trusted library allocation

page read and write

41B3000

trusted library allocation

page read and write

4228000

trusted library allocation

page read and write

53F1000

trusted library allocation

page read and write

681C000

heap

page read and write

3237000

trusted library allocation

page read and write

3F91000

trusted library allocation

page read and write

83F0000

trusted library allocation

page read and write

7B23000

heap

page read and write

7CE0000

trusted library allocation

page read and write

1237000

heap

page read and write

58DE000

stack

page read and write

3256000

trusted library allocation

page read and write

6C79000

trusted library allocation

page read and write

653E000

stack

page read and write

69ED000

stack

page read and write

4155000

trusted library allocation

page read and write

6D30000

trusted library allocation

page read and write

7B8F000

heap

page read and write

4235000

trusted library allocation

page read and write

41E4000

trusted library allocation

page read and write

4089000

trusted library allocation

page read and write

335C000

trusted library allocation

page read and write

338B000

trusted library allocation

page read and write

67F0000

trusted library allocation

page execute and read and write

7AD4000

heap

page read and write

6CAB000

trusted library allocation

page read and write

7C88000

trusted library allocation

page read and write

1180000

heap

page read and write

33AA000

trusted library allocation

page read and write

6F90000

trusted library allocation

page execute and read and write

337E000

trusted library allocation

page read and write

3409000

trusted library allocation

page read and write

1395000

heap

page read and write

7AF2000

heap

page read and write

141B000

heap

page read and write

6F60000

trusted library allocation

page read and write

6D80000

trusted library allocation

page read and write

343A000

trusted library allocation

page read and write

3240000

trusted library allocation

page read and write

599E000

stack

page read and write

331B000

trusted library allocation

page read and write

595E000

stack

page read and write

7226000

trusted library allocation

page read and write

5700000

trusted library allocation

page read and write

324A000

trusted library allocation

page read and write

352D000

trusted library allocation

page read and write

3534000

trusted library allocation

page read and write

4167000

trusted library allocation

page read and write

13A0000

heap

page read and write

690E000

heap

page read and write

55F0000

trusted library allocation

page read and write

3447000

trusted library allocation

page read and write

6DF0000

trusted library allocation

page execute and read and write

41E9000

trusted library allocation

page read and write

7B61000

heap

page read and write

6F20000

trusted library allocation

page read and write

41A4000

trusted library allocation

page read and write

434F000

trusted library allocation

page read and write

663E000

stack

page read and write

6CC2000

trusted library allocation

page read and write

68C9000

heap

page read and write

7CB8000

trusted library allocation

page read and write

5413000

heap

page read and write

53DB000

trusted library allocation

page read and write

677E000

stack

page read and write

1230000

heap

page read and write

5460000

trusted library allocation

page read and write

15DB000

stack

page read and write

4225000

trusted library allocation

page read and write

7A6E000

stack

page read and write

4216000

trusted library allocation

page read and write

41BD000

trusted library allocation

page read and write

40EB000

trusted library allocation

page read and write

120B000

trusted library allocation

page execute and read and write

16EE000

heap

page read and write

6CCE000

trusted library allocation

page read and write

33A4000

trusted library allocation

page read and write

11C0000

trusted library allocation

page read and write

7E30000

heap

page read and write

7C8A000

trusted library allocation

page read and write

6F30000

trusted library allocation

page read and write

40FE000

trusted library allocation

page read and write

5440000

trusted library allocation

page read and write

4173000

trusted library allocation

page read and write

3433000

trusted library allocation

page read and write

3477000

trusted library allocation

page read and write

682D000

heap

page read and write

3FEA000

trusted library allocation

page read and write

7B77000

heap

page read and write

4178000

trusted library allocation

page read and write

721C000

stack

page read and write

70DC000

stack

page read and write

6C70000

trusted library allocation

page read and write

4351000

trusted library allocation

page read and write

6D90000

trusted library allocation

page execute and read and write

32EC000

trusted library allocation

page read and write

6FDC000

stack

page read and write

418D000

trusted library allocation

page read and write

7240000

trusted library allocation

page read and write

2F91000

trusted library allocation

page read and write

11F2000

trusted library allocation

page read and write

There are 370 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
XHr735qu8v.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportXHr735qu8v.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
XHr735qu8v.exe