IOC Report
DCwTjs2dTP.exe

loading gif

Files

File Path
Type
Category
Malicious
DCwTjs2dTP.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DCwTjs2dTP.exe.log
ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Roaming\sihost.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61712 bytes, 1 file
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
modified
C:\Users\user\AppData\Local\Temp\tmp53F0.tmp.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
\Device\Null
ASCII text, with CRLF line terminators, with overstriking
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DCwTjs2dTP.exe
"C:\Users\user\Desktop\DCwTjs2dTP.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sihost" /tr '"C:\Users\user\AppData\Roaming\sihost.exe"' & exit
malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp53F0.tmp.bat""
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "sihost" /tr '"C:\Users\user\AppData\Roaming\sihost.exe"'
malicious
C:\Users\user\AppData\Roaming\sihost.exe
"C:\Users\user\AppData\Roaming\sihost.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout 3

URLs

Name
IP
Malicious
hsolic.duckdns.org
malicious
techandro.giize.com
malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
techandro.giize.com
182.186.88.126
malicious

IPs

IP
Domain
Country
Malicious
182.186.88.126
techandro.giize.com
Pakistan
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
Version
HKEY_CURRENT_USER\Software\C4D93783EC1A25CC28F9
94E168CABBEA0702E60265D1291BE8FE7C37724D89001E7AE9A73817F84114EF

Memdumps

Base Address
Regiontype
Protect
Malicious
2ACF000
trusted library allocation
page read and write
malicious
2D39000
trusted library allocation
page read and write
malicious
ABB0000
trusted library section
page read and write
malicious
AF90000
trusted library allocation
page read and write
55D0000
trusted library allocation
page read and write
14007FE3000
heap
page read and write
14007629000
heap
page read and write
960000
heap
page read and write
1400D7CE000
heap
page read and write
B0B0000
trusted library allocation
page read and write
5201000
trusted library allocation
page read and write
A946000
trusted library allocation
page read and write
1400D42D000
heap
page read and write
986000
heap
page read and write
A8C1000
trusted library allocation
page read and write
B3C0000
trusted library allocation
page read and write
2C88000
trusted library allocation
page read and write
2CF613F0000
trusted library section
page readonly
12AC4480000
heap
page read and write
4F20000
trusted library allocation
page read and write
3007000
trusted library allocation
page read and write
3039000
trusted library allocation
page read and write
5370000
trusted library allocation
page read and write
C2E000
stack
page read and write
1400D513000
heap
page read and write
47CF87D000
stack
page read and write
12AC4602000
heap
page read and write
140077EB000
heap
page read and write
1400CEA0000
trusted library allocation
page read and write
1400D6A3000
heap
page read and write
1400D757000
heap
page read and write
4395000
trusted library allocation
page read and write
AF60000
trusted library allocation
page read and write
A956000
trusted library allocation
page read and write
2C4C000
trusted library allocation
page read and write
D9D000
unkown
page read and write
2B3E9850000
heap
page read and write
14007430000
heap
page read and write
1400D602000
heap
page read and write
5200000
trusted library allocation
page read and write
A94E000
trusted library allocation
page read and write
1400D57F000
heap
page read and write
B3D0000
trusted library allocation
page read and write