IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
http://www.opengis.net/gml
unknown
https://api.ip.sb/ip
unknown
https://api.ip.s
unknown
https://sectigo.com/CPS0
unknown
http://www.georss.org/georss
unknown
http://ocsp.sectigo.com0
unknown
http://www.iana.org/assignments/relation/
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
https://discord.com/api/v9/users/
unknown
http://ConstBaseUri/ConstService.svc/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
fp2e7a.wpc.phicdn.net
192.229.221.95

Memdumps

Base Address
Regiontype
Protect
Malicious
22000
unkown
page readonly
malicious
3BE9000
trusted library allocation
page read and write
malicious
37AF000
trusted library allocation
page read and write
malicious
3D22000
trusted library allocation
page read and write
malicious
402000
remote allocation
page execute and read and write
malicious
3D8A000
trusted library allocation
page read and write
malicious
3120000
heap
page read and write
123A000
stack
page read and write
27DD000
trusted library allocation
page read and write
572E000
trusted library allocation
page read and write
5770000
trusted library allocation
page read and write
7E94000
heap
page read and write
970000
trusted library allocation
page read and write
2791000
trusted library allocation
page read and write
27C1000
trusted library allocation
page read and write
57B0000
trusted library allocation
page read and write
27A8000
trusted library allocation
page read and write
3050000
heap
page execute and read and write
4BE0000
trusted library allocation
page execute and read and write
3469000
trusted library allocation
page read and write
33BA000
trusted library allocation
page read and write
27D0000
trusted library allocation
page read and write
D50000
trusted library allocation
page execute and read and write
5A15000
heap
page read and write
1337000
stack
page read and write
7EC1000
heap
page read and write
2810000
trusted library allocation
page read and write
5AA0000
trusted library allocation
page read and write
37AD000
trusted library allocation
page read and write
5720000
trusted library allocation
page read and write
2772000
trusted library allocation
page read and write
4231000
trusted library allocation
page read and write
34A4000
trusted library allocation
page read and write
75EE000
stack
page read and write
3480000
trusted library allocation
page read and write
2793000
trusted library allocation
page read and write
27A0000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
3408000
trusted library allocation
page read and write
9A6000
trusted library allocation
page execute and read and write
33FF000
trusted library allocation
page read and write
278F000
trusted library allocation
page read and write
9B7000
trusted library allocation
page execute and read and write
27A6000
trusted library allocation
page read and write
33E6000
trusted library allocation
page read and write
30E0000
heap
page read and write
2755000
trusted library allocation
page read and write
AD2000
heap
page read and write
5A00000
trusted library allocation
page execute and read and write
92E000
stack
page read and write
5D50000
trusted library allocation
page read and write
1398000
heap
page read and write
309E000
stack
page read and write
5A10000
heap
page read and write
E00000
heap
page read and write
33E4000
trusted library allocation
page read and write
573E000
trusted library allocation
page read and write
27F3000
trusted library allocation
page read and write
27D2000
trusted library allocation
page read and write
27F8000
trusted library allocation
page read and write
484E000
stack
page read and write
2749000
trusted library allocation
page read and write
5BCD000
stack
page read and write
3418000
trusted library allocation
page read and write
5BE0000
heap
page read and write
141E000
heap
page read and write
2770000
trusted library allocation
page read and write
27DA000
trusted library allocation
page read and write
5A80000
heap
page read and write
33D1000
trusted library allocation
page read and write
7E90000
heap
page read and write
180E000
stack
page read and write
5D90000
trusted library allocation
page execute and read and write
2753000
trusted library allocation
page read and write
A34000
heap
page read and write