IOC Report
conhost.exe

loading gif

Files

File Path
Type
Category
Malicious
conhost.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\Windows\Tasks\wow64.job
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\conhost.exe
C:\Users\user\Desktop\conhost.exe
malicious
C:\Users\user\Desktop\conhost.exe
C:\Users\user\Desktop\conhost.exe start
malicious

URLs

Name
IP
Malicious
207.148.1.174
malicious
146.70.53.169
malicious

IPs

IP
Domain
Country
Malicious
207.148.1.174
unknown
United States
malicious
146.70.53.169
unknown
United Kingdom
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2B60000
direct allocation
page execute and read and write
malicious
28E0000
direct allocation
page execute and read and write
malicious
2B50000
direct allocation
page execute and read and write
malicious
400000
unkown
page execute and read and write
malicious
14741402000
trusted library allocation
page read and write
14740C62000
heap
page read and write
3B1C27E000
stack
page read and write
5CA000
heap
page read and write
14740C67000
heap
page read and write
14740C2E000
heap
page read and write
6388A7F000
stack
page read and write
14740BB0000
trusted library allocation
page read and write
14740C13000
heap
page read and write
14740C7B000
heap
page read and write
401000
unkown
page execute read
2B30000
direct allocation
page execute and read and write
3B1BFFB000
stack
page read and write
1CFFD122000
heap
page read and write
14740C49000
heap
page read and write
48E000
unkown
page readonly
498000
unkown
page execute and read and write
14740C4F000
heap
page read and write
1F7837D0000
remote allocation
page read and write
8CE000
stack
page read and write
B0F000
stack
page read and write
1F7837D0000
remote allocation
page read and write
14740C6D000
heap
page read and write
14740A40000
heap
page read and write
2D60000
trusted library allocation
page read and write
24C0000
trusted library allocation
page read and write
1F0000
heap
page read and write
14740C4B000
heap
page read and write
22F1BA2F000
heap
page read and write
1CFFC643000
heap
page read and write
14740C46000
heap
page read and write
14740C2D000
heap
page read and write
14740C4E000
heap
page read and write
88F000
stack
page read and write
2BAA000
stack
page read and write
14740C44000
heap
page read and write
3B1C47E000
stack
page read and write
638897C000
stack
page read and write
14740C50000
heap
page read and write
3B1C2FE000
stack
page read and write
2990000
direct allocation
page execute and read and write
1CFFC690000
heap
page read and write
1CFFC643000
heap
page read and write
5C0000
heap
page read and write
22F1BA52000
heap
page read and write
14740A50000
heap
page read and write
3B1C77F000
stack
page read and write
2B40000
direct allocation
page execute and read and write
14740C40000
heap
page read and write
1CFFD122000
heap
page read and write
1F7837D0000
remote allocation
page read and write
3B1C57E000
stack
page read and write
22F1B820000
heap
page read and write
14740C3D000
heap
page read and write
22F1B810000
heap
page read and write
22F1BA3D000
heap
page read and write
22F1BA29000
heap
page read and write
14740C00000
heap
page read and write
14740C84000
heap
page read and write
24D0000
direct allocation
page execute and read and write
1CFFC65E000
heap
page read and write
22F1BA4A000
heap
page read and write
14740C45000
heap
page read and write
14740C77000
heap
page read and write
49F000
unkown
page execute and read and write
14740C7A000
heap
page read and write
5EC000
heap
page read and write
489000
unkown
page write copy
14740C56000
heap
page read and write
22F1B870000
heap
page read and write
486000
unkown
page write copy
23B3000
heap
page read and write
23E0000
heap
page read and write
3B1C67E000
stack
page read and write
400000
unkown
page readonly
19B000
stack
page read and write
14740C42000
heap
page read and write