IOCReport

loading gif

Files

File Path
Type
Category
Malicious
http___192.3.141.164_mal_win32.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\http___192.3.141.164_mal_win32.exe.log
ASCII text, with CRLF line terminators
dropped
malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\http___192.3.141.164_mal_win32.exe
'C:\Users\user\Desktop\http___192.3.141.164_mal_win32.exe'
malicious
C:\Users\user\Desktop\http___192.3.141.164_mal_win32.exe
C:\Users\user\Desktop\http___192.3.141.164_mal_win32.exe
malicious

URLs

Name
IP
Malicious
www.dragonpalcenk.com/k8n/
malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
clean
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
unknown
clean

IPs

IP
Domain
Country
Malicious
192.3.141.164
unknown
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3539000
unkown
page read and write
malicious
3671000
unkown
page read and write
malicious
400000
unkown
page execute and read and write
malicious
256F000
unkown
page read and write
malicious
400000
unkown
page execute and read and write
malicious
BA2000
unkown image
page readonly
clean
50B0000
unkown
page read and write
clean
25C82DD0000
unkown
page readonly
clean
995000
unkown
page read and write
clean
5C0000
unkown
page readonly
clean
AED000
unkown
page read and write
clean
AD40000
unkown
page read and write
clean
25C82F08000
unkown
page read and write
clean
786000
unkown
page execute and read and write
clean
977000
unkown
page read and write
clean
7FF5D47AA000
unkown
page readonly
clean
7FF5D4844000
unkown
page readonly
clean
7CE0000
unkown
page read and write
clean
45C0000
unkown
page read and write
clean
4530000
unkown
page read and write
clean
92F000
heap default
page read and write
clean
997000
unkown
page read and write
clean
25C82E55000
unkown
page read and write
clean
4550000
unkown
page read and write
clean
961000
unkown
page read and write
clean
979000
unkown
page read and write
clean
7FF5D3FAC000
unkown
page readonly
clean
76D000
unkown
page execute and read and write
clean
970000
unkown
page read and write
clean
A7C000
unkown
page read and write
clean
25C83602000
unkown
page read and write
clean
50B0000
unkown
page read and write
clean
25C82E4A000
unkown
page read and write
clean
78A000
unkown
page execute and read and write
clean
997000
unkown
page read and write
clean
50C0000
unkown
page read and write
clean
4E4C000
unkown
page read and write
clean
AF2E000
unkown
page read and write
clean
997000
unkown
page read and write
clean
4530000
unkown
page read and write
clean
C62000
unkown image
page readonly
clean
C76000
unkown image
page readonly
clean
8D0000
unkown
page read and write
clean
570E000
unkown
page read and write
clean
7FF5D44D7000
unkown
page readonly
clean
95F000
unkown
page read and write
clean
AD70000
unkown
page read and write
clean
770000
unkown
page read and write
clean
7FF5D46C4000
unkown
page readonly
clean
981000
unkown
page read and write
clean
4A90000
unkown
page read and write
clean
4540000
unkown
page read and write
clean
71C517E000
unkown
page read and write
clean
4AD0000
unkown
page read and write
clean
1104000
unkown
page read and write
clean
984000
unkown
page read and write
clean