IOC Report
bUHF.exe

loading gif

Files

File Path
Type
Category
Malicious
bUHF.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bUHF.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\bUHF.exe
"C:\Users\user\Desktop\bUHF.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\bUHF.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
rusia.duckdns.org
malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown
http://go.micros
unknown

Domains

Name
IP
Malicious
rusia.duckdns.org
46.246.84.12
 malicious

IPs

IP
Domain
Country
Malicious
46.246.84.12
rusia.duckdns.org
Sweden
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
HKEY_CURRENT_USER\SOFTWARE\aed0817703934
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
22000
unkown
page readonly
 malicious
4B0000
heap
page read and write
410000
heap
page read and write
340E000
unkown
page read and write
2FE0000
heap
page read and write
34F7000
heap
page read and write
4A5000
heap
page read and write
420000
heap
page read and write
561000
heap
page read and write
2AC6000
trusted library allocation
page read and write
A66000
heap
page read and write
81A000
trusted library allocation
page execute and read and write
1B6000
stack
page read and write
4A3E000
stack
page read and write
850000
heap
page read and write
75E000
stack
page read and write
28000
unkown
page readonly
812000
trusted library allocation
page execute and read and write
4C7F000
stack
page read and write
55F000
heap
page read and write
4E50000
heap
page read and write
2727000
trusted library allocation
page read and write
A30000
trusted library allocation
page execute and read and write
27FA000
trusted library allocation
page read and write
36D1000
trusted library allocation
page read and write
20000
unkown
page readonly
842000
trusted library allocation
page read and write
80A000
trusted library allocation
page execute and read and write
493C000
stack
page read and write
26D1000
trusted library allocation
page read and write
48F0000
heap
page read and write
2AB2000
trusted library allocation
page read and write
50E000
heap
page read and write
847000
trusted library allocation
page execute and read and write
4D0000
heap
page read and write
5B30000
heap
page read and write
82A000
trusted library allocation
page execute and read and write
26D4000
trusted library allocation
page read and write
274B000
trusted library allocation
page read and write
48F3000
heap
page read and write
7FB50000
trusted library allocation
page execute and read and write
2FD0000
heap
page read and write
827000
trusted library allocation
page execute and read and write
57D000
heap
page read and write
4A0000
heap
page read and write
46D8000
trusted library allocation
page read and write
1B9000
stack
page read and write
4D8000
heap
page read and write
830000
trusted library allocation
page read and write
B6F000
stack
page read and write
48EB000
stack
page read and write
36EF000
unkown
page read and write
37EF000
stack
page read and write
4978000
stack
page read and write
344E000
stack
page read and write
32FC000
stack
page read and write
5290000
heap
page read and write
BD0000
trusted library allocation
page execute and read and write
48AC000
stack
page read and write
A20000
trusted library allocation
page read and write
9EC000
stack
page read and write
7F0000
trusted library allocation
page read and write
A10000
heap
page execute and read and write
99E000
stack
page read and write
4DBE000
stack
page read and write
5B20000
heap
page read and write
4DE000
heap
page read and write
A50000
trusted library allocation
page read and write
A60000
heap
page read and write
54A000
heap
page read and write
A6A000
heap
page read and write
B9000
stack
page read and write
486D000
stack
page read and write
510F000
stack
page read and write
4CBE000
stack
page read and write
4E60000
heap
page read and write
34F0000
heap
page read and write
5A28000
heap
page read and write
4E80000
heap
page read and write
2AC2000
trusted library allocation
page read and write
BE0000
heap
page read and write
4B3E000
stack
page read and write
7AB000
stack
page read and write
2F5D000
stack
page read and write
BC0000
trusted library allocation
page read and write
520D000
stack
page read and write
84B000
trusted library allocation
page execute and read and write
38A0000
heap
page read and write
27BB000
trusted library allocation
page read and write
2F90000
heap
page read and write
46C000
stack
page read and write
4B7E000
stack
page read and write
810000
trusted library allocation
page read and write
802000
trusted library allocation
page execute and read and write
486F000
stack
page read and write
83A000
trusted library allocation
page execute and read and write
3512000
heap
page read and write
6DC000
stack
page read and write
4DD0000
trusted library allocation
page execute and read and write
832000
trusted library allocation
page execute and read and write
There are 90 hidden memdumps, click here to show them.