IOC Report

loading gif

Files

File Path
Type
Category
Malicious
G47wmLn8uy.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Temp\~DFAFA5F207726209AF.TMP
Composite Document File V2 Document, Cannot read section info
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\G47wmLn8uy.exe
"C:\Users\user\Desktop\G47wmLn8uy.exe"
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\subideal\Eyeliners
HARNISKKLDT
clean

Memdumps

Base Address
Regiontype
Protect
Malicious
4D10000
unkown
page execute and read and write
malicious
7FF5A7368000
unkown image
page readonly
clean
2D5AF38D000
unkown
page read and write
clean
7FF50ACB4000
unkown image
page readonly
clean
7DF51E112000
unkown image
page readonly
clean
7FF51B1E2000
unkown image
page readonly
clean
2D5AF38E000
unkown
page read and write
clean
610000
heap private
page read and write
clean
1DEE284B000
unkown
page read and write
clean
DF6C67F000
stack
page read and write
clean
1E2C4230000
unkown image
page readonly
clean
7FF5A73CC000
unkown image
page readonly
clean
1DEE2900000
unkown
page read and write
clean
2D5AF202000
unkown
page read and write
clean
2D5AF391000
unkown
page read and write
clean
2D5AEA00000
unkown
page read and write
clean
7FF5842C8000
unkown image
page readonly
clean
2050000
unkown
page read and write
clean
2D5AF366000
unkown
page read and write
clean
7FF5A72A1000
unkown image
page readonly
clean
1DEE2886000
unkown
page read and write
clean
1D790B30000
unkown image
page readonly
clean
2B59000
heap private
page read and write
clean
2D5AF35D000
unkown
page read and write
clean
7FF51B107000
unkown image
page readonly
clean
1E2C3DB0000
unkown image
page readonly
clean
2D5AEA48000
unkown
page read and write
clean
2D5AF802000
unkown
page read and write
clean
7FF5841C4000
unkown image
page readonly
clean
29A000
unkown
page read and write
clean
1D51E83C000
unkown
page read and write
clean
1E2C3E86000
heap default
page read and write
clean
7FF51B11F000
unkown image
page readonly
clean
2D5AF366000
unkown
page read and write
clean
7FF50A820000
unkown image
page readonly
clean
7DF5BC5D0000
unkown image
page readonly
clean
2D5AF120000
unkown
page read and write
clean
1D790E00000
unkown image
page readonly
clean
19C000
unkown
page read and write
clean
7FF51B0FB000
unkown image
page readonly
clean
7FF50ABAD000
unkown image
page readonly
clean
2D5AF388000
unkown
page read and write
clean
7FF50AC4C000
unkown image
page readonly
clean
7FF51B158000
unkown image
page readonly
clean
2D5AF364000
unkown
page read and write
clean
2D5AE8A0000
heap private
page read and write
clean
1D791402000
unkown
page read and write
clean
7FF509008000
unkown image
page readonly
clean
1D51ED80000
unkown image
page readonly
clean
7FF50AAB1000
unkown image
page readonly
clean
7FF5A7026000
unkown image
page readonly
clean
20B0000
heap private
page read and write
clean
2D5AF38E000
unkown
page read and write
clean
2C336CC000
unkown
page read and write
clean
1D790C7B000
unkown
page read and write
clean
7FF5A744A000
unkown image
page readonly
clean
1D51E640000
heap private
page read and write
clean
1D790C50000
unkown
page read and write
clean
2D5AF397000
unkown
page read and write
clean
1DEE2879000
unkown
page read and write
clean
2C33CF7000
stack
page read and write
clean
1D790C13000
unkown
page read and write
clean
2D5AF380000
unkown
page read and write
clean
7FF51B0DC000
unkown image
page readonly
clean
2204000
heap private
page read and write
clean
7FF5A6DB3000
unkown image
page readonly
clean
234D07B000
unkown
page read and write
clean
2060000
unkown
page execute read
clean
7FF50ACBF000
unkown image
page readonly
clean
1DEE2650000
unkown image
page read and write
clean
2D5AF802000
unkown
page read and write
clean
7FF5A7465000
unkown image
page readonly
clean
2D5AF38E000
unkown
page read and write
clean