IOC Report
elBAfme5gQ

loading gif

Files

File Path
Type
Category
Malicious
elBAfme5gQ.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\A3MiXbeK\WINMM.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\WRsLe\DUI70.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\daH0n9\credui.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\A3MiXbeK\PresentationSettings.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\WRsLe\DmNotificationBroker.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\daH0n9\WFS.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\pEcAZnNU3\DUI70.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\pEcAZnNU3\DmNotificationBroker.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a
data
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\elBAfme5gQ.dll"
malicious
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\elBAfme5gQ.dll",#1
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\elBAfme5gQ.dll,CreateXmlReader
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\elBAfme5gQ.dll",#1
malicious
C:\Windows\explorer.exe
C:\Windows\Explorer.EXE
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\elBAfme5gQ.dll,CreateXmlReaderInputWithEncodingCodePage
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\elBAfme5gQ.dll,CreateXmlReaderInputWithEncodingName
malicious
C:\Windows\System32\PresentationSettings.exe
C:\Windows\system32\PresentationSettings.exe
malicious
C:\Users\user\AppData\Local\A3MiXbeK\PresentationSettings.exe
C:\Users\user\AppData\Local\A3MiXbeK\PresentationSettings.exe
malicious
C:\Windows\System32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
malicious
C:\Users\user\AppData\Local\WRsLe\DmNotificationBroker.exe
C:\Users\user\AppData\Local\WRsLe\DmNotificationBroker.exe
malicious
C:\Windows\System32\WFS.exe
C:\Windows\system32\WFS.exe
malicious
C:\Users\user\AppData\Local\daH0n9\WFS.exe
C:\Users\user\AppData\Local\daH0n9\WFS.exe
malicious
C:\Windows\System32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
malicious
C:\Users\user\AppData\Local\pEcAZnNU3\DmNotificationBroker.exe
C:\Users\user\AppData\Local\pEcAZnNU3\DmNotificationBroker.exe
malicious
C:\Windows\System32\wusa.exe
C:\Windows\system32\wusa.exe
C:\Windows\System32\SystemSettingsRemoveDevice.exe
C:\Windows\system32\SystemSettingsRemoveDevice.exe
There are 7 hidden processes, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{CC67E16B-D7A7-A849-FCD2-573E3EF5AE60}\ShellFolder
{D2484701-257A-0A3D-D692-7BEB29F73749}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{11EB41D4-9441-012C-D8E5-9DDE1EC51626}\ShellFolder
{534E41FE-102F-FB71-3892-BE6C2F00A428}

Memdumps

Base Address
Regiontype
Protect
Malicious
7FFC66921000
unkown
page execute read
malicious
7FFC646C1000
unkown
page execute read
malicious
7FFC646C1000
unkown
page execute read
malicious
7FFC67881000
unkown
page execute read
malicious
7FFC646C1000
unkown
page execute read
malicious
7FFC646C1000
unkown
page execute read
malicious
7FFC66971000
unkown
page execute read
malicious
7FFC646C1000
unkown
page execute read
malicious
7FFC66971000
unkown
page execute read
malicious
7FF5913E8000
unkown
page readonly
173C5200000
heap
page read and write
7FF7E0793000
unkown
page readonly
3EA0000
unkown
page read and write
7FF59132E000
unkown
page readonly
1DD4D1A0000
heap
page read and write
7FF5910C2000
unkown
page readonly
1E3BB476000
heap
page read and write
2780000
unkown
page read and write
2680000
unkown
page read and write
7FFC6E48A000
unkown
page read and write
DB0C000
stack
page read and write
25EA0A89000
heap
page read and write
6D4E000
unkown
page readonly
476E000
stack
page read and write
1A45B600000
heap
page read and write
1C6C3A30000
heap
page read and write
1A4601C0000
trusted library allocation
page read and write
D8AC000
unkown
page read and write
19211C02000
heap
page read and write
4C20000
unkown
page readonly
225FDF10000
heap
page read and write
1F555EBB000
heap
page read and write
A650000
unkown
page readonly