IOC Report
7.5RabbitFix_V9.exe

loading gif

Files

File Path
Type
Category
Malicious
7.5RabbitFix_V9.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixkyfz5h.ovy.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0s0kxo5.nzp.ps1
ASCII text, with no line terminators
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\7.5RabbitFix_V9.exe
"C:\Users\user\Desktop\7.5RabbitFix_V9.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
D4F000
heap
page read and write
7F2000
unkown
page readonly
7FF849020000
trusted library allocation
page execute and read and write
2B0E000
stack
page read and write
7E0000
unkown
page readonly
1B550000
heap
page read and write
7FF848FD0000
trusted library allocation
page read and write
D39000
heap
page read and write
1B77D000
heap
page read and write
7FF849170000
trusted library allocation
page read and write
7FF848E6C000
trusted library allocation
page execute and read and write
7FF849090000
trusted library allocation
page read and write
7F8000
unkown
page readonly
7FF849110000
trusted library allocation
page read and write
7FF849010000
trusted library allocation
page read and write
7FF848E30000
trusted library allocation
page read and write
1BD5B000
stack
page read and write
7FF848FC6000
trusted library allocation
page read and write
7FF4C4470000
trusted library allocation
page execute and read and write
7FF849160000
trusted library allocation
page read and write
7FF848ECC000
trusted library allocation
page execute and read and write
7F4000
unkown
page readonly
7FF849050000
trusted library allocation
page read and write
7FF8490C0000
trusted library allocation
page read and write
7FF849060000
trusted library allocation
page read and write
1BB5E000
stack
page read and write
3005000
trusted library allocation
page read and write
7FF849140000
trusted library allocation
page read and write
2A00000
heap
page execute and read and write
2D54000
trusted library allocation
page read and write
7E0000
unkown
page readonly
2EEF000
trusted library allocation
page read and write
7FF848E28000
trusted library allocation
page read and write
7FF849130000
trusted library allocation
page read and write
1B4E0000
heap
page execute and read and write
7FF8490E0000
trusted library allocation
page read and write
7FF849040000
trusted library allocation
page read and write
CD0000
heap
page read and write
FD0000
trusted library allocation
page read and write
F0F000
stack
page read and write
7FF849150000
trusted library allocation
page read and write
7FF848EF6000
trusted library allocation
page execute and read and write
7FF848E1D000
trusted library allocation
page execute and read and write
7FF8490A0000
trusted library allocation
page read and write
D51000
heap
page read and write
3098000
trusted library allocation
page read and write
7FF000
unkown
page readonly
3036000
trusted library allocation
page read and write
12B7F000
trusted library allocation
page read and write
F45000
heap
page read and write
1C6E8000
stack
page read and write
D81000
heap
page read and write
30A4000
trusted library allocation
page read and write
1B78A000
heap
page read and write
7FF848FF7000
trusted library allocation
page read and write
12B11000
trusted library allocation
page read and write
F40000
heap
page read and write
7FF849070000
trusted library allocation
page read and write
7FF848FE0000
trusted library allocation
page execute and read and write
3094000
trusted library allocation
page read and write
7FF848E12000
trusted library allocation
page read and write
7FF848E22000
trusted library allocation
page read and write
7FF848FC9000
trusted library allocation
page read and write
1B7F8000
heap
page read and write
7FF849120000
trusted library allocation
page read and write
7FF848E14000
trusted library allocation
page read and write
954000
stack
page read and write
7FF848EC6000
trusted library allocation
page read and write
7FF8490F0000
trusted library allocation
page read and write
7FF848FC0000
trusted library allocation
page read and write
F30000
trusted library allocation
page read and write
7FF848F30000
trusted library allocation
page execute and read and write
F10000
trusted library allocation
page read and write
7FF849000000
trusted library allocation
page execute and read and write
1AB40000
trusted library allocation
page read and write
1BC5E000
stack
page read and write
D16000
heap
page read and write
1B09D000
stack
page read and write
9A0000
heap
page read and write
FE5000
heap
page read and write
7FF848FB0000
trusted library allocation
page read and write
1B7D8000
heap
page read and write
9B0000
heap
page read and write
D95000
heap
page read and write
F53000
trusted library allocation
page read and write
1B4DE000
stack
page read and write
7FF8490B0000
trusted library allocation
page read and write
7FF848FF0000
trusted library allocation
page read and write
F50000
trusted library allocation
page read and write
7FF849030000
trusted library allocation
page read and write
1BA5E000
stack
page read and write
7FF848E34000
trusted library allocation
page read and write
2E6E000
trusted library allocation
page read and write
D1C000
heap
page read and write
7FF848E20000
trusted library allocation
page read and write
D10000
heap
page read and write
7FF848E2D000
trusted library allocation
page execute and read and write
D7B000
heap
page read and write
7FF848EC0000
trusted library allocation
page read and write
1B7DB000
heap
page read and write
F80000
heap
page read and write
2EC1000
trusted library allocation
page read and write
1B760000
heap
page read and write
7E2000
unkown
page readonly
7FF849080000
trusted library allocation
page read and write
7FF848FB8000
trusted library allocation
page read and write
7FF848E13000
trusted library allocation
page execute and read and write
7FF8490D0000
trusted library allocation
page read and write
7FF848ED0000
trusted library allocation
page execute and read and write
2B11000
trusted library allocation
page read and write
12B1F000
trusted library allocation
page read and write
1B680000
heap
page read and write
1B7E2000
heap
page read and write
7FF848E3B000
trusted library allocation
page execute and read and write
FE0000
heap
page read and write
2B8C000
trusted library allocation
page read and write
7FF849100000
trusted library allocation
page read and write
1AE96000
heap
page read and write
9D0000
heap
page read and write
1B77F000
heap
page read and write
There are 110 hidden memdumps, click here to show them.