IOC Report
HDPh51eN5s

loading gif

Files

File Path
Type
Category
Malicious
HDPh51eN5s.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HDPh51eN5s.exe.log
ASCII text, with CRLF line terminators
dropped
malicious
C:\Windows\System32\Windows\RuntimeBroker.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
malicious
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\HDPh51eN5s.exe
"C:\Users\user\Desktop\HDPh51eN5s.exe"
malicious
C:\Windows\System32\schtasks.exe
"schtasks" /create /tn "Google Update" /sc ONLOGON /tr "C:\Users\user\Desktop\HDPh51eN5s.exe" /rl HIGHEST /f
malicious
C:\Windows\System32\Windows\RuntimeBroker.exe
C:\Windows\system32\Windows\RuntimeBroker.exe
malicious
C:\Users\user\Desktop\HDPh51eN5s.exe
C:\Users\user\Desktop\HDPh51eN5s.exe
malicious
C:\Windows\System32\schtasks.exe
"schtasks" /create /tn "Google Update" /sc ONLOGON /tr "C:\Windows\system32\Windows\RuntimeBroker.exe" /rl HIGHEST /f
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://go.michv
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

IPs

IP
Domain
Country
Malicious
82.211.246.53
unknown
Denmark
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
1C3E0000
trusted library section
page read and write
malicious
12E41000
trusted library allocation
page read and write
malicious
1584C000
trusted library allocation
page read and write
malicious
134FA000
trusted library allocation
page read and write
malicious
15501000
trusted library allocation
page read and write
malicious
7FFC012DD000
trusted library allocation
page execute and read and write
1BEF64E0000
heap
page read and write
139F4000000
heap
page read and write
1B7F0000
trusted library allocation
page read and write
1DC30000
trusted library allocation
page read and write
2E11000
trusted library allocation
page read and write
1BA00000
trusted library allocation
page read and write
2E10000
trusted library allocation
page read and write
1D160000
trusted library allocation
page read and write
1B6E0000
trusted library allocation
page read and write
1BA50000
trusted library allocation
page read and write
16E0000
trusted library allocation
page read and write
166F383C000
heap
page read and write
1B4D2E65000
heap
page read and write
1740000
trusted library allocation
page read and write
2C20000
trusted library allocation
page read and write
2C38000
trusted library allocation
page read and write
1D114000
trusted library allocation
page read and write
19BD000
trusted library allocation
page read and write
1BA10000
trusted library allocation
page read and write
166F4169000
heap
page read and write
1B7A2000
trusted library allocation
page read and write
2F446590000
trusted library allocation
page read and write
24676FF0000
unkown
page readonly
2F446DFC000
heap
page read and write
10E9000
heap
page read and write
139F4102000
heap
page read and write
1402000
heap
page read and write
2C69000
heap
page read and write
166F38A8000
heap
page read and write
10017E000
stack
page read and write
1021000
heap
page read and write
1BA90000
trusted library allocation
page read and write
28C28590000
heap
page read and write
2F446A34000
heap
page read and write
1B780000
trusted library allocation
page read and write
2F446700000
trusted library allocation
page read and write
1BA00000
trusted library allocation
page read and write
103F000
heap
page read and write
1BA00000
trusted library allocation
page read and write
2F446590000
trusted library allocation
page read and write
1D130000
trusted library allocation
page read and write
D007BDE000
stack
page read and write
2F446A26000
heap
page read and write
2F446C24000
heap
page read and write
19F0000
trusted library allocation
page read and write
AC2000
unkown
page execute and read and write