Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

itVg5XA6eK.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.66426413554523
Filename:	itVg5XA6eK.exe
Filesize:	232960
MD5:	8533ef6f79e259e9e5fe7c28f1fcd372
SHA1:	48c1f9b2a798a374b6e8c2e5fb655c19e5fa2ed3
SHA256:	bbc8cabc1ba4f81d1ee316d3869ed8e61c91840cb533abee708a3099ab196470
SHA512:	533facb9e64028915336f7a7035e726409279309b05d2cf1e6def878513a85f49a9119f09e53bcc8371ff5bc8f91474b67934773e3c6a7ad12c3778ffa3f2697
SSDEEP:	3072:HSuZ00DVrF1rVcCPP+Tl6Ws5cUYTMExjHSTdMTfNlx35eRPG+79IwGrpc:J/2TAcZyOjNlri7Ww
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R[vc.................V...6.......t... ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Detected njRat	Remote Access Functionality	Remote Access Software
Malicious sample detected (through community Yara rule)	System Summary
Antivirus / Scanner detection for submitted sample	AV Detection
.NET source code references suspicious native API functions	HIPS / PFW / Operating System Protection Evasion	Native API
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
.NET source code contains potential unpacker	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary	Masquerading
Yara signature match	System Summary
Antivirus or Machine Learning detection for unpacked file	AV Detection	Software Packing
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Drops PE files	Persistence and Installation Behavior
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Uses an in-process (OLE) Automation server	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Reads ini files	System Summary	File and Directory Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Creates mutexes	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Uses new MSVCR Dlls	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\rejdit_free_fire.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\ProgramData\rejdit_free_fire.exe
Category:	dropped
Dump:	rejdit_free_fire.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\itVg5XA6eK.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.66426413554523
Encrypted:	false
Ssdeep:	3072:HSuZ00DVrF1rVcCPP+Tl6Ws5cUYTMExjHSTdMTfNlx35eRPG+79IwGrpc:J/2TAcZyOjNlri7Ww
Size:	232960
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder
Drops PE files to the startup folder	Boot Survival	Registry Run Keys / Startup Folder
Machine Learning detection for dropped file	AV Detection
Modifies the windows firewall	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Protects its processes via BreakOnTermination flag	Operating System Destruction
Uses netsh to modify the Windows network and firewall settings	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a start menu entry (Start Menu\Programs\Startup)	Boot Survival	Registry Run Keys / Startup Folder
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads the hosts file	System Summary	Remote System Discovery
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\itVg5XA6eK.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\itVg5XA6eK.exe.log
Category:	dropped
Dump:	itVg5XA6eK.exe.log.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\itVg5XA6eK.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.2874233355119316
Encrypted:	false
Ssdeep:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
Size:	525
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe
Category:	dropped
Dump:	869b16e2825dce24066aba38ee1a9add.exe.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\ProgramData\rejdit_free_fire.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.66426413554523
Encrypted:	false
Ssdeep:	3072:HSuZ00DVrF1rVcCPP+Tl6Ws5cUYTMExjHSTdMTfNlx35eRPG+79IwGrpc:J/2TAcZyOjNlri7Ww
Size:	232960
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Drops PE files to the startup folder	Boot Survival	Registry Run Keys / Startup Folder
Machine Learning detection for dropped file	AV Detection
Creates a start menu entry (Start Menu\Programs\Startup)	Boot Survival	Registry Run Keys / Startup Folder
Drops PE files	Persistence and Installation Behavior
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\rejdit_free_fire.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\rejdit_free_fire.exe.log
Category:	dropped
Dump:	rejdit_free_fire.exe.log.13.dr
ID:	dr_4
Target ID:	13
Process:	C:\ProgramData\rejdit_free_fire.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.2874233355119316
Encrypted:	false
Ssdeep:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
Size:	525
Whitelisted:	false
Reputation:	high

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Windows\SysWOW64\netsh.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.971939296804078
Encrypted:	false
Ssdeep:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
Size:	313
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\itVg5XA6eK.exe

Details

Is windows:	false
Is dropped:	false
PID:	6104
Target ID:	0
Parent PID:	3452
Name:	itVg5XA6eK.exe
Path:	C:\Users\user\Desktop\itVg5XA6eK.exe
Commandline:	C:\Users\user\Desktop\itVg5XA6eK.exe
Size:	232960
MD5:	8533EF6F79E259E9E5FE7C28F1FCD372
Time:	19:41:59
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x440000
Modulesize:	253952
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\rejdit_free_fire.exe

"C:\ProgramData\rejdit_free_fire.exe"

Details

Is windows:	false
Is dropped:	true
PID:	1852
Target ID:	1
Parent PID:	6104
Name:	rejdit_free_fire.exe
Path:	C:\ProgramData\rejdit_free_fire.exe
Commandline:	"C:\ProgramData\rejdit_free_fire.exe"
Size:	232960
MD5:	8533EF6F79E259E9E5FE7C28F1FCD372
Time:	19:42:06
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb0000
Modulesize:	253952
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Modifies the windows firewall	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Uses netsh to modify the Windows network and firewall settings	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Found malware configuration	AV Detection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\ProgramData\rejdit_free_fire.exe" "rejdit_free_fire.exe" ENABLE

Details

Is windows:	true
Is dropped:	false
PID:	2436
Target ID:	2
Parent PID:	1852
Name:	netsh.exe
Path:	C:\Windows\SysWOW64\netsh.exe
Commandline:	netsh firewall add allowedprogram "C:\ProgramData\rejdit_free_fire.exe" "rejdit_free_fire.exe" ENABLE
Size:	82944
MD5:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Time:	19:42:14
Date:	24/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x10f0000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Modifies the windows firewall	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Uses netsh to modify the Windows network and firewall settings	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Spawns processes	System Summary	Process Injection

C:\ProgramData\rejdit_free_fire.exe

"C:\ProgramData\rejdit_free_fire.exe" ..

Details

Is windows:	false
Is dropped:	true
PID:	644
Target ID:	13
Parent PID:	3452
Name:	rejdit_free_fire.exe
Path:	C:\ProgramData\rejdit_free_fire.exe
Commandline:	"C:\ProgramData\rejdit_free_fire.exe" ..
Size:	232960
MD5:	8533EF6F79E259E9E5FE7C28F1FCD372
Time:	19:42:29
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x670000
Modulesize:	253952
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Modifies the windows firewall	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Uses netsh to modify the Windows network and firewall settings	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Found malware configuration	AV Detection
Spawns processes	System Summary	Process Injection

C:\ProgramData\rejdit_free_fire.exe

"C:\ProgramData\rejdit_free_fire.exe" ..

Details

Is windows:	false
Is dropped:	true
PID:	1280
Target ID:	14
Parent PID:	3452
Name:	rejdit_free_fire.exe
Path:	C:\ProgramData\rejdit_free_fire.exe
Commandline:	"C:\ProgramData\rejdit_free_fire.exe" ..
Size:	232960
MD5:	8533EF6F79E259E9E5FE7C28F1FCD372
Time:	19:42:37
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x980000
Modulesize:	253952
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Modifies the windows firewall	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Uses netsh to modify the Windows network and firewall settings	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Found malware configuration	AV Detection
Spawns processes	System Summary	Process Injection

C:\ProgramData\rejdit_free_fire.exe

"C:\ProgramData\rejdit_free_fire.exe" ..

Details

Is windows:	false
Is dropped:	true
PID:	1112
Target ID:	15
Parent PID:	3452
Name:	rejdit_free_fire.exe
Path:	C:\ProgramData\rejdit_free_fire.exe
Commandline:	"C:\ProgramData\rejdit_free_fire.exe" ..
Size:	232960
MD5:	8533EF6F79E259E9E5FE7C28F1FCD372
Time:	19:42:45
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xd70000
Modulesize:	253952
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Njrat	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Modifies the windows firewall	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Uses netsh to modify the Windows network and firewall settings	Lowering of HIPS / PFW / Operating System Security Settings	Disable or Modify Tools
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Found malware configuration	AV Detection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	732
Target ID:	3
Parent PID:	2436
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	19:42:15
Date:	24/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff745070000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

h43vipforyou.ddns.net

Details

Name:	h43vipforyou.ddns.net
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\itVg5XA6eK.exe
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

Domains

Name

Malicious

h43vipforyou.ddns.net

41.109.68.239

Details

Name:	h43vipforyou.ddns.net
IP:	41.109.68.239
TargetID:	1
Current Path:	C:\ProgramData\rejdit_free_fire.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

41.109.68.239

h43vipforyou.ddns.net

Algeria

Details

IP:	41.109.68.239
TargetID:	1
Current Path:	C:\ProgramData\rejdit_free_fire.exe
Country:	Algeria
Countrycode:	DZA
ASN number:	36947
ASN name:	ALGTEL-ASDZ
Private:	false
Domain:	h43vipforyou.ddns.net

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

Registry

Path

Value

Malicious

HKEY_CURRENT_USER

Details

TargetID:	0
Path:	HKEY_CURRENT_USER
Value name:	di
Value data:	!

Signature Hits	Behavior Group	Mitre Attack
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Reads software policies	System Summary	System Information Discovery

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

869b16e2825dce24066aba38ee1a9add

Details

TargetID:	1
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value name:	869b16e2825dce24066aba38ee1a9add
Value data:	"C:\ProgramData\rejdit_free_fire.exe" ..

Signature Hits	Behavior Group	Mitre Attack
Creates autostart registry keys with suspicious names	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Environment

SEE_MASK_NOZONECHECKS

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

869b16e2825dce24066aba38ee1a9add

HKEY_CURRENT_USER\Software\869b16e2825dce24066aba38ee1a9add

[kl]

Memdumps

Base Address

Regiontype

Protect

Malicious

3AB4000

trusted library allocation

page read and write

2965000

trusted library allocation

page read and write

442000

unkown

page readonly

21448FC7000

heap

page read and write

6DA000

trusted library allocation

page execute and read and write

21449030000

heap

page read and write

E89000

heap

page read and write

56FE000

stack

page read and write

2B2C9E78000

heap

page read and write

EFA000

heap

page read and write

3351000

trusted library allocation

page read and write

A58000

heap

page read and write

DE4000

heap

page read and write

94FB2FD000

stack

page read and write

1C3ED502000

heap

page read and write

10CB000

trusted library allocation

page execute and read and write

E6B000

heap

page read and write

E9D000

heap

page read and write

12BA4A50000

heap

page read and write

960000

unkown

page readonly

12BA5402000

trusted library allocation

page read and write

533A000

trusted library allocation

page read and write

572F000

stack

page read and write

DE4000

heap

page read and write

21448613000

heap

page read and write

DF0000

trusted library allocation

page read and write

E55000

heap

page read and write

6BDC69B000

stack

page read and write

1FD23C4E000

heap

page read and write

F4D000

heap

page read and write

533E000

trusted library allocation

page read and write

266CF500000

heap

page read and write

6BDCE7E000

stack

page read and write

1D84B302000

heap

page read and write

DF8000

heap

page read and write

E94000

heap

page read and write

530F000

trusted library allocation

page read and write

4A0000

heap

page read and write

97E000

stack

page read and write

970000

unkown

page readonly

E93000

heap

page read and write

5309000

trusted library allocation

page read and write

3961000

trusted library allocation

page read and write

5316000

trusted library allocation

page read and write

1C3ED42A000

heap

page read and write

EB5000

heap

page read and write

24B0000

heap

page execute and read and write

A0E000

stack

page read and write

4A80000

trusted library allocation

page execute and read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
itVg5XA6eK.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportitVg5XA6eK.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
itVg5XA6eK.exe