IOC Report
xkzdRi6nGpg3.exe

loading gif

Files

File Path
Type
Category
Malicious
xkzdRi6nGpg3.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\xkzdRi6nGpg3.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\xkzdRi6nGpg3.exe
"C:\Users\user\Desktop\xkzdRi6nGpg3.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\xkzdRi6nGpg3.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
rusia.duckdns.org
malicious

Domains

Name
IP
Malicious
rusia.duckdns.org
46.246.84.12
 malicious

IPs

IP
Domain
Country
Malicious
46.246.84.12
rusia.duckdns.org
Sweden
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
HKEY_CURRENT_USER\SOFTWARE\5e13091123
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
CA2000
unkown
page readonly
 malicious
139A000
trusted library allocation
page execute and read and write
3414000
trusted library allocation
page read and write
D3A000
stack
page read and write
3471000
trusted library allocation
page read and write
140E000
heap
page read and write
7F360000
trusted library allocation
page execute and read and write
1362000
trusted library allocation
page execute and read and write
9AC000
heap
page read and write
2DAF000
stack
page read and write
DEC000
stack
page read and write
348F000
trusted library allocation
page read and write
16F6000
heap
page read and write
5B60000
heap
page read and write
1910000
trusted library allocation
page read and write
CA8000
unkown
page readonly
13A0000
trusted library allocation
page read and write
5630000
heap
page read and write
14B7000
heap
page read and write
1850000
trusted library allocation
page read and write
1372000
trusted library allocation
page execute and read and write
13AB000
trusted library allocation
page execute and read and write
34BA000
trusted library allocation
page read and write
1648000
trusted library allocation
page read and write
16F0000
heap
page read and write
C10000
heap
page read and write
5AD000
stack
page read and write
1370000
trusted library allocation
page read and write
56DE000
stack
page read and write
6BB0000
heap
page read and write
558C000
stack
page read and write
1240000
heap
page read and write
190C000
stack
page read and write
131B000
stack
page read and write
B9E000
unkown
page read and write
136A000
trusted library allocation
page execute and read and write
3446000
trusted library allocation
page read and write
34CE000
trusted library allocation
page read and write
850000
heap
page read and write
55E0000
trusted library allocation
page execute and read and write
5A1F000
unkown
page read and write
4411000
trusted library allocation
page read and write
1387000
trusted library allocation
page execute and read and write
137A000
trusted library allocation
page execute and read and write
13E0000
heap
page read and write
1400000
heap
page read and write
96E000
unkown
page read and write
138A000
trusted library allocation
page execute and read and write
1800000
heap
page execute and read and write
550D000
stack
page read and write
CA0000
unkown
page readonly
10F9000
stack
page read and write
554B000
stack
page read and write
BDE000
stack
page read and write
1860000
trusted library allocation
page execute and read and write
13A2000
trusted library allocation
page read and write
13C0000
heap
page read and write
1478000
heap
page read and write
34D1000
trusted library allocation
page read and write
1489000
heap
page read and write
13A7000
trusted library allocation
page execute and read and write
D90000
heap
page read and write
5E10000
heap
page read and write
120C000
stack
page read and write
6BA0000
heap
page read and write
55C9000
stack
page read and write
10F6000
stack
page read and write
DA0000
heap
page read and write
55D0000
trusted library allocation
page read and write
57DE000
stack
page read and write
5633000
heap
page read and write
810000
heap
page read and write
3411000
trusted library allocation
page read and write
1350000
trusted library allocation
page read and write
5620000
trusted library allocation
page execute and read and write
34B3000
trusted library allocation
page read and write
1390000
trusted library allocation
page read and write
143F000
heap
page read and write
9A0000
heap
page read and write
820000
heap
page read and write
6AA8000
heap
page read and write
346A000
trusted library allocation
page read and write
1392000
trusted library allocation
page execute and read and write
1380000
trusted library allocation
page read and write
12CE000
stack
page read and write
17FF000
stack
page read and write
5AD0000
heap
page read and write
581E000
stack
page read and write
4AD000
stack
page read and write
1245000
heap
page read and write
5AE0000
heap
page read and write
163E000
stack
page read and write
5DDD000
stack
page read and write
591E000
stack
page read and write
1920000
heap
page read and write
184B000
stack
page read and write
There are 86 hidden memdumps, click here to show them.