Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

ciKdWsb5h4.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.082418228904906
Filename:	ciKdWsb5h4.exe
Filesize:	311296
MD5:	bd129b2710c1f8fa9aa98dcc35c5b6b9
SHA1:	572034f781967e768d6d9b49de62217561538a45
SHA256:	62c2c1f7335ed8b0a2120b1cf42a4c55cae1869a0245bef10d51de037e0d7ddf
SHA512:	abb8770681cd51454d3f2f4539f58133af88168d35934a4638a611c579d07018f256a9a8358c9723c8a985254bcf593556a886692781fa57016a82475f147e86
SSDEEP:	6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops certificate files (DER)	E-Banking Fraud
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:32 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\ciKdWsb5h4.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:32 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Entropy:	3.4601743543125636
Encrypted:	false
Ssdeep:	48:8SDdPTndGRYrnvPdAKRkdAGdAKRFdAKR/U:8SR5
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\Tmp434B.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp434B.tmp
Category:	dropped
Dump:	Tmp434B.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\ciKdWsb5h4.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\Tmp435C.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp435C.tmp
Category:	dropped
Dump:	Tmp435C.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\ciKdWsb5h4.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\ciKdWsb5h4.exe
Type:	data
Entropy:	7.634466947125037
Encrypted:	false
Ssdeep:	48:S7SjQDUCrOSnnq8e8ychIa6kmJsrgvfTxbchRayHllRchxZ:ASUDn28yla6kVgvlgtFY5
Size:	2251
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\ciKdWsb5h4.exe

"C:\Users\user\Desktop\ciKdWsb5h4.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7632
Target ID:	0
Parent PID:	2580
Name:	ciKdWsb5h4.exe
Path:	C:\Users\user\Desktop\ciKdWsb5h4.exe
Commandline:	"C:\Users\user\Desktop\ciKdWsb5h4.exe"
Size:	311296
MD5:	BD129B2710C1F8FA9AA98DCC35C5B6B9
Time:	05:57:56
Date:	25/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x30000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

103.113.70.99:2630

http://tempuri.org/Entity/Id24LR

unknown

http://tempuri.org/Entity/Id22LR

unknown

http://tempuri.org/Entity/Id20LR

unknown

http://tempuri.org/Entity/Id15Responsex

unknown

http://tempuri.org/Entity/Id18Responsex

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id19LR

unknown

http://tempuri.org/Entity/Id17LR

unknown

http://tempuri.org/Entity/Id22Responsex

unknown

http://tempuri.org/Entity/Id6

unknown

http://tempuri.org/Entity/Id15LR

unknown

http://tempuri.org/Entity/Id9LR

unknown

http://tempuri.org/Entity/Id10Responsex

unknown

http://tempuri.org/Entity/Id19Responsex

unknown

http://tempuri.org/Entity/Id13LR

unknown

http://tempuri.org/Entity/Id7LR

unknown

http://tempuri.org/Entity/Id11LR

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse

unknown

http://tempuri.org/Entity/Id1LR

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id5LR

unknown

http://tempuri.org/Entity/Id3LR

unknown

http://tempuri.org/Entity/Id6Responsex

unknown

http://tempuri.org/Entity/Id7Responsex

unknown

http://tempuri.org/Entity/Id1Responsex

unknown

http://tempuri.org/Entity/Id21Responsex

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty

unknown

https://api.ip.sb/ip

unknown

http://tempuri.org/Entity/Id23Responsex

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement

unknown

http://tempuri.org/Entity/Id23LR

unknown

http://tempuri.org/Entity/Id21LR

unknown

http://tempuri.org/Entity/Id5Responsex

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

unknown

http://tempuri.org/Entity/Id14Responsex

unknown

http://tempuri.org/Entity/Id2Responsex

unknown

http://tempuri.org/Entity/Id11Responsex

unknown

http://tempuri.org/Entity/Id20Responsex

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://tempuri.org/Entity/Id8Responsex

unknown

http://tempuri.org/Entity/Id18LR

unknown

http://tempuri.org/Entity/Id13Responsex

unknown

http://tempuri.org/Entity/Id16Responsex

unknown

http://tempuri.org/Entity/Id16LR

unknown

http://tempuri.org/Entity/Id8LR

unknown

http://tempuri.org/Entity/Id14LR

unknown

http://tempuri.org/Entity/Id6LR

unknown

http://tempuri.org/Entity/

unknown

http://tempuri.org/Entity/Id12LR

unknown

http://tempuri.org/Entity/Id9Responsex

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://tempuri.org/Entity/Id10LR

unknown

http://tempuri.org/Entity/Id3Responsex

unknown

http://tempuri.org/Entity/Id4LR

unknown

http://tempuri.org/Entity/Id24Responsex

unknown

http://tempuri.org/Entity/Id2LR

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage

unknown

http://tempuri.org/Entity/Id12Responsex

unknown

http://tempuri.org/Entity/Id17Responsex

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence

unknown

http://schemas.xmlsoap.org/soap/actor/next

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id4Responsex

unknown

There are 57 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

103.113.70.99

unknown

India

Details

IP:	103.113.70.99
TargetID:	0
Current Path:	C:\Users\user\Desktop\ciKdWsb5h4.exe
Country:	India
Countrycode:	IND
ASN number:	133973
ASN name:	NETCONNECTWIFI-ASNetConnectWifiPvtLtdIN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

Memdumps

Base Address

Regiontype

Protect

Malicious

32000

unkown

page readonly

4820000

trusted library allocation

page read and write

190000

heap

page read and write

76000

unkown

page readonly

950000

trusted library allocation

page read and write

5E90000

heap

page read and write

4834000

trusted library allocation

page read and write

2290000

heap

page read and write

980000

trusted library allocation

page read and write

81E000

heap

page read and write

4895000

trusted library allocation

page read and write

750000

heap

page read and write

553E000

stack

page read and write

33E1000

trusted library allocation

page read and write

48D3000

heap

page read and write

4890000

trusted library allocation

page read and write

4B80000

heap

page execute and read and write

5FE6000

trusted library allocation

page read and write

758000

heap

page read and write

81C000

heap

page read and write

597E000

stack

page read and write

22D0000

heap

page read and write

960000

trusted library allocation

page read and write

4920000

trusted library allocation

page read and write

593E000

stack

page read and write

6270000

trusted library allocation

page read and write

600A000

trusted library allocation

page read and write

5FA7000

trusted library allocation

page read and write

483E000

trusted library allocation

page read and write

4836000

trusted library allocation

page read and write

6060000

trusted library allocation

page read and write

A40000

heap

page read and write

44DE000

stack

page read and write

484E000

trusted library allocation

page read and write

5FDB000

trusted library allocation

page read and write

6030000

trusted library allocation

page read and write

6025000

trusted library allocation

page read and write

4E80000

trusted library allocation

page read and write

33EF000

trusted library allocation

page read and write

5FF2000

trusted library allocation

page read and write

5EB5000

heap

page read and write

602E000

trusted library allocation

page read and write

5EE3000

heap

page read and write

30000

unkown

page readonly

4E70000

trusted library allocation

page read and write

6130000

trusted library allocation

page execute and read and write

5EF1000

heap

page read and write

485D000

trusted library allocation

page read and write

602B000

trusted library allocation

page read and write

5A7E000

stack

page read and write

6050000

trusted library allocation

page read and write

5A80000

trusted library allocation

page read and write

4F7000

stack

page read and write

97A000

trusted library allocation

page execute and read and write

972000

trusted library allocation

page read and write

96D000

trusted library allocation

page execute and read and write

4E78000

trusted library allocation

page read and write

5FD0000

trusted library allocation

page read and write

740000

trusted library allocation

page read and write

9EE000

stack

page read and write

953000

trusted library allocation

page execute and read and write

60D0000

trusted library allocation

page execute and read and write

60A0000

trusted library allocation

page read and write

5F5000

heap

page read and write

4910000

heap

page read and write

5F9B000

trusted library allocation

page read and write

5E5F000

stack

page read and write

5FA5000

trusted library allocation

page read and write

180000

heap

page read and write

5FE1000

trusted library allocation

page read and write

22B0000

trusted library allocation

page execute and read and write

5D5E000

stack

page read and write

954000

trusted library allocation

page read and write

3402000

trusted library allocation

page read and write

75E000

heap

page read and write

6020000

trusted library allocation

page read and write

6260000

trusted library allocation

page read and write

777000

heap

page read and write

5F90000

trusted library allocation

page read and write

6001000

trusted library allocation

page read and write

4830000

trusted library allocation

page read and write

23E1000

trusted library allocation

page read and write

6250000

trusted library allocation

page read and write

791000

heap

page read and write

62000

unkown

page readonly

11A000

stack

page read and write

583E000

stack

page read and write

4888000

trusted library allocation

page read and write

5FA0000

trusted library allocation

page read and write

98B000

trusted library allocation

page execute and read and write

483B000

trusted library allocation

page read and write

48A0000

trusted library allocation

page read and write

48C0000

trusted library allocation

page read and write

5B20000

trusted library allocation

page execute and read and write

60C0000

trusted library allocation

page execute and read and write

4CE1000

heap

page read and write

4842000

trusted library allocation

page read and write

5FA9000

trusted library allocation

page read and write

5D1E000

stack

page read and write

4856000

trusted library allocation

page read and write

67000

unkown

page readonly

6010000

trusted library allocation

page read and write

4E0E000

stack

page read and write

4870000

trusted library allocation

page read and write

6070000

trusted library allocation

page read and write

5EA0000

heap

page read and write

4930000

trusted library allocation

page execute and read and write

5F0000

heap

page read and write

6120000

trusted library allocation

page execute and read and write

963000

trusted library allocation

page read and write

4862000

trusted library allocation

page read and write

5E94000

heap

page read and write

840000

heap

page read and write

95D000

trusted library allocation

page execute and read and write

5FFE000

trusted library allocation

page read and write

5C1E000

stack

page read and write

4970000

heap

page read and write

4851000

trusted library allocation

page read and write

22C0000

trusted library allocation

page read and write

4922000

trusted library allocation

page read and write

970000

trusted library allocation

page read and write

A46000

heap

page read and write

987000

trusted library allocation

page execute and read and write

845000

heap

page read and write

9F0000

heap

page execute and read and write

1E0000

heap

page read and write

23DE000

stack

page read and write

4880000

trusted library allocation

page read and write

5B10000

heap

page read and write

7C4000

heap

page read and write

982000

trusted library allocation

page read and write

A3D000

stack

page read and write

5F95000

trusted library allocation

page read and write

5B30000

trusted library allocation

page execute and read and write

48CE000

trusted library allocation

page read and write

7F870000

trusted library allocation

page execute and read and write

48D0000

heap

page read and write

6040000

trusted library allocation

page read and write

985000

trusted library allocation

page execute and read and write

60B0000

trusted library allocation

page read and write

976000

trusted library allocation

page execute and read and write

There are 131 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
ciKdWsb5h4.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportciKdWsb5h4.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
ciKdWsb5h4.exe