IOC Report
XShSI2OXaC.exe

loading gif

Files

File Path
Type
Category
Malicious
XShSI2OXaC.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\hale4r.lnk
MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
dropped
C:\Users\user\AppData\Local\Temp\nszEF27.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
modified
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\Plugin_Status.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Contentness\Filialbestyrerens\Talkability\Platybrachycephalous\vfslog.c
C source, ASCII text
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Coronoid.Ano
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Tonefilmsgengiveren\Parfaits\Produktoversigts\Newcomers\Igennen\view-more-horizontal-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\XShSI2OXaC.exe
C:\Users\user\Desktop\XShSI2OXaC.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
C:\Users\user\Desktop\XShSI2OXaC.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://194.55.186.93/vUKwYAjoM37.ocx)Dp5
unknown
http://194.55.186.93/vUKwYAjoM37.ocx2S
unknown
http://crl.certum.pl/ctsca2021.crl0o
unknown
http://194.55.186.93/vUKwYAjoM37.ocx4S
unknown
http://194.55.186.93/vUKwYAjoM37.ocx9
unknown
http://repository.certum.pl/ctnca.cer09
unknown
http://194.55.186.93/vUKwYAjoM37.ocxx
unknown
http://194.55.186.93/vUKwYAjoM37.ocxw
unknown
http://crl.certum.pl/ctnca.crl0k
unknown
http://194.55.186.93/vUKwYAjoM37.ocxD
unknown
http://194.55.186.93/vUKwYAjoM37.ocxH
unknown
http://194.55.186.93/vUKwYAjoM37.ocxft
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://194.55.186.93/vUKwYAjoM37.ocxV
unknown
http://194.55.186.93/
unknown
http://repository.certum.pl/ctsca2021.cer0
unknown
http://subca.ocsp-certum.com05
unknown
http://194.55.186.93/vUKwYAjoM37.ocxb
unknown
http://subca.ocsp-certum.com02
unknown
http://194.55.186.93/vUKwYAjoM37.ocxa
unknown
http://subca.ocsp-certum.com01
unknown
http://194.55.186.93/vUKwYAjoM37.ocxf
unknown
http://crl.certum.pl/ctnca2.crl0l
unknown
http://repository.certum.pl/ctnca2.cer09
unknown
http://194.55.186.93/vUKwYAjoM37.ocx7DJ5
unknown
http://194.55.186.93/vUKwYAjoM37.ocxj
unknown
http://194.55.186.93/vUKwYAjoM37.ocxi
unknown
http://194.55.186.93/vUKwYAjoM37.ocxl
unknown
http://www.certum.pl/CPS0
unknown
http://194.55.186.93/vUKwYAjoM37.ocxr
unknown
http://194.55.186.93/vUKwYAjoM37.ocx1
unknown
http://194.55.186.93/vUKwYAjoM37.ocx
194.55.186.93
There are 22 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
194.55.186.93
unknown
Germany

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Undeprecative
Reinfestation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\One
Guli
HKEY_LOCAL_MACHINE\SOFTWARE\Limulus\tidliges
Arteriolith123
HKEY_CURRENT_USER\SOFTWARE\Tg\Cocinero\Kejserdoemme
Ordentlig
HKEY_LOCAL_MACHINE\SOFTWARE\jerkies
idiotiskes
HKEY_CURRENT_USER\SOFTWARE\forlagsboghandlerne\refugium
Summerendes

Memdumps

Base Address
Regiontype
Protect
Malicious
FB0000
remote allocation
page execute and read and write
 malicious
3390000
direct allocation
page execute and read and write
 malicious
838000
heap
page read and write
838000
heap
page read and write
225EFAA0000
heap
page read and write
838000
heap
page read and write
450000
unkown
page read and write
40A000
unkown
page read and write
225EFCC7000
heap
page read and write
838000
heap
page read and write
225EFC89000
heap
page read and write
225EFC9E000
heap
page read and write
225EFC73000
heap
page read and write
838000
heap
page read and write
BF0000
heap
page read and write
838000
heap
page read and write
225EFCE5000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
635000
heap
page read and write
225EFCB5000
heap
page read and write
838000
heap
page read and write
FA0000
remote allocation
page read and write
140C000
heap
page read and write
225EFCC7000
heap
page read and write
46364FE000
stack
page read and write
1D0000
unclassified section
page readonly
225EFCC7000
heap
page read and write
2400000
heap
page read and write
23C0000
trusted library allocation
page read and write
838000
heap
page read and write
46361DD000
stack
page read and write
838000
heap
page read and write
FD7000
remote allocation
page execute and read and write
838000
heap
page read and write
1C48C000
heap
page read and write
FB0000
remote allocation
page execute and read and write
838000
heap
page read and write
29C711F0000
unclassified section
page readonly
225EFCB5000
heap
page read and write
20000
unclassified section
page readonly
2A0F000
stack
page read and write
838000
heap
page read and write
225EFC5F000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
408000
unkown
page readonly
29C7122A000
heap
page read and write
250F000
stack
page read and write
230E000
stack
page read and write
73C61000
unkown
page execute read
838000
heap
page read and write
838000
heap
page read and write
1418000
heap
page read and write
838000
heap
page read and write
401000
unkown
page execute read
838000
heap
page read and write
29C71265000
heap
page read and write
158E000
stack
page read and write
400000
unkown
page readonly
838000
heap
page read and write
838000
heap
page read and write
29C71254000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
F9096FF000
stack
page read and write
465000
unkown
page readonly
1408000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
2842DBF0000
heap
page read and write
225EFCC7000
heap
page read and write
838000
heap
page read and write
225F0C20000
trusted library allocation
page read and write
2510000
trusted library allocation
page read and write
13EB000
heap
page read and write
13F9000
heap
page read and write
225EFCE0000
heap
page read and write
838000
heap
page read and write
225EFDE0000
trusted library allocation
page read and write
1590000
trusted library allocation
page read and write
1D03E000
stack
page read and write
29C71200000
heap
page read and write
837000
heap
page read and write
838000
heap
page read and write
F90967C000
stack
page read and write
225EFCB5000
heap
page read and write
838000
heap
page read and write
1CBD0000
heap
page read and write
838000
heap
page read and write
400000
unkown
page readonly
838000
heap
page read and write
225EFCB5000
heap
page read and write
826000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
401000
unkown
page execute read
838000
heap
page read and write
11E0000
heap
page read and write
1CBD1000
heap
page read and write
838000
heap
page read and write
29C7127D000
heap
page read and write
637000
heap
page read and write
827000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
225EFCC7000
heap
page read and write
29C71286000
heap
page read and write
821000
heap
page read and write
838000
heap
page read and write
11E4000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
1403000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
225F0880000
trusted library allocation
page read and write
838000
heap
page read and write
2842DBF5000
heap
page read and write
225EFE25000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
13F9000
heap
page read and write
225EFC09000
heap
page read and write
225EFC24000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
225EFCC7000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
29C7128F000
heap
page read and write
838000
heap
page read and write
2A13000
trusted library allocation
page read and write
29C71246000
heap
page read and write
225EFCD9000
heap
page read and write
838000
heap
page read and write
225EFCE5000
heap
page read and write
225F0C10000
trusted library allocation
page read and write
838000
heap
page read and write
838000
heap
page read and write
2260000
heap
page read and write
225EFCE5000
heap
page read and write
30000
heap
page read and write
1D050000
heap
page read and write
465000
unkown
page readonly
225EFCBA000
heap
page read and write
838000
heap
page read and write
29C71213000
heap
page read and write
225F0650000
trusted library allocation
page read and write
838000
heap
page read and write
838000
heap
page read and write
34C0000
trusted library allocation
page read and write
29C71090000
heap
page read and write
838000
heap
page read and write
225F0660000
trusted library allocation
page read and write
838000
heap
page read and write
225F0C00000
heap
page readonly
2842D9E8000
heap
page read and write
800000
heap
page read and write
838000
heap
page read and write
2D80000
trusted library allocation
page read and write
838000
heap
page read and write
225EFCB5000
heap
page read and write
13F1000
heap
page read and write
F7C000
stack
page read and write
225EFC35000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
1D1FE000
stack
page read and write
838000
heap
page read and write
E7C000
stack
page read and write
29C71240000
heap
page read and write
1CD50000
trusted library allocation
page read and write
838000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
427000
unkown
page read and write
808000
heap
page read and write
2A15000
trusted library allocation
page read and write
838000
heap
page read and write
836000
heap
page read and write
838000
heap
page read and write
29C71C02000
trusted library allocation
page read and write
838000
heap
page read and write
838000
heap
page read and write
25C0000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
122E000
stack
page read and write
838000
heap
page read and write
13EB000
heap
page read and write
838000
heap
page read and write
199000
stack
page read and write
463615F000
stack
page read and write
1D34B000
stack
page read and write
29C71400000
unclassified section
page readonly
408000
unkown
page readonly
838000
heap
page read and write
838000
heap
page read and write
225EFC00000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
2320000
heap
page read and write
462000
unkown
page read and write
40A000
unkown
page write copy
1D24D000
stack
page read and write
225F0C70000
trusted library allocation
page read and write
225EFD00000
heap
page read and write
29C7126E000
heap
page read and write
838000
heap
page read and write
139B000
heap
page read and write
132F000
stack
page read and write
1CF3E000
stack
page read and write
1C7E0000
heap
page read and write
73C64000
unkown
page readonly
5C0000
trusted library allocation
page read and write
F90977D000
stack
page read and write
225EFCE0000
heap
page read and write
838000
heap
page read and write
7EE000
heap
page read and write
225EFCB3000
heap
page read and write
838000
heap
page read and write
2842DAE0000
heap
page read and write
225EFC36000
heap
page read and write
838000
heap
page read and write
1402000
heap
page read and write
2325000
heap
page read and write
225EFCE5000
heap
page read and write
225F0BF0000
trusted library allocation
page read and write
225EFCD9000
heap
page read and write
73C66000
unkown
page readonly
838000
heap
page read and write
29C71A00000
trusted library allocation
page read and write
137E000
stack
page read and write
29C71249000
heap
page read and write
838000
heap
page read and write
7C7000
heap
page read and write
838000
heap
page read and write
7C0000
heap
page read and write
73C60000
unkown
page readonly
1390000
heap
page read and write
13D7000
heap
page read and write
225EFE30000
trusted library allocation
page read and write
42D000
unkown
page read and write
29C71410000
heap
page read and write
225EFCB5000
heap
page read and write
1C480000
heap
page read and write
225EFCD2000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
29C710F0000
heap
page read and write
225EFCB5000
heap
page read and write
838000
heap
page read and write
1CD10000
trusted library allocation
page read and write
838000
heap
page read and write
1330000
heap
page read and write
225EFCC7000
heap
page read and write
838000
heap
page read and write
13F1000
heap
page read and write
838000
heap
page read and write
29C71302000
heap
page read and write
435000
unkown
page read and write
FD2DEBB000
stack
page read and write
FD2E47E000
stack
page read and write
25C4000
heap
page read and write
225EFCE5000
heap
page read and write
96000
stack
page read and write
1D0FD000
stack
page read and write
838000
heap
page read and write
838000
heap
page read and write
225EFCE5000
heap
page read and write
838000
heap
page read and write
838000
heap
page read and write
29C71251000
heap
page read and write
838000
heap
page read and write
225F05F0000
trusted library allocation
page read and write
225EFE20000
heap
page read and write
46360DB000
stack
page read and write
225EFCD2000
heap
page read and write
82C000
heap
page read and write
3310000
trusted library allocation
page read and write
29C71232000
heap
page read and write
2842DB50000
heap
page read and write
838000
heap
page read and write
34F9000
trusted library allocation
page read and write
13F1000
heap
page read and write
FD2E57E000
stack
page read and write
236E000
stack
page read and write
2842DA3C000
heap
page read and write
225EFD70000
heap
page read and write
29C7123C000
heap
page read and write
FD2E67A000
stack
page read and write
2842D840000
heap
page read and write
29C7127E000
heap
page read and write
630000
heap
page read and write
2842D9E0000
heap
page read and write
225EFC23000
heap
page read and write
There are 290 hidden memdumps, click here to show them.