IOC Report
conhost.exe

loading gif

Files

File Path
Type
Category
Malicious
conhost.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Windows\Tasks\wow64.job
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\conhost.exe
C:\Users\user\Desktop\conhost.exe
 malicious
C:\Users\user\Desktop\conhost.exe
C:\Users\user\Desktop\conhost.exe start
 malicious

URLs

Name
IP
Malicious
207.148.1.174
malicious
146.70.53.169
malicious

IPs

IP
Domain
Country
Malicious
207.148.1.174
unknown
United States
malicious
146.70.53.169
unknown
United Kingdom
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2B60000
direct allocation
page execute and read and write
 malicious
28E0000
direct allocation
page execute and read and write
 malicious
2B50000
direct allocation
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
14741402000
trusted library allocation
page read and write
14740C62000
heap
page read and write
3B1C27E000
stack
page read and write
5CA000
heap
page read and write
14740C67000
heap
page read and write
14740C2E000
heap
page read and write
6388A7F000
stack
page read and write
14740BB0000
trusted library allocation
page read and write
14740C13000
heap
page read and write
14740C7B000
heap
page read and write
401000
unkown
page execute read
2B30000
direct allocation
page execute and read and write
3B1BFFB000
stack
page read and write
1CFFD122000
heap
page read and write
14740C49000
heap
page read and write
48E000
unkown
page readonly
498000
unkown
page execute and read and write
14740C4F000
heap
page read and write
1F7837D0000
remote allocation
page read and write
8CE000
stack
page read and write
B0F000
stack
page read and write
1F7837D0000
remote allocation
page read and write
14740C6D000
heap
page read and write
14740A40000
heap
page read and write
2D60000
trusted library allocation
page read and write
24C0000
trusted library allocation
page read and write
1F0000
heap
page read and write
14740C4B000
heap
page read and write
22F1BA2F000
heap
page read and write
1CFFC643000
heap
page read and write
14740C46000
heap
page read and write
14740C2D000
heap
page read and write
14740C4E000
heap
page read and write
88F000
stack
page read and write
2BAA000
stack
page read and write
14740C44000
heap
page read and write
3B1C47E000
stack
page read and write
638897C000
stack
page read and write
14740C50000
heap
page read and write
3B1C2FE000
stack
page read and write
2990000
direct allocation
page execute and read and write
1CFFC690000
heap
page read and write
1CFFC643000
heap
page read and write
5C0000
heap
page read and write
22F1BA52000
heap
page read and write
14740A50000
heap
page read and write
3B1C77F000
stack
page read and write
2B40000
direct allocation
page execute and read and write
14740C40000
heap
page read and write
1CFFD122000
heap
page read and write
1F7837D0000
remote allocation
page read and write
3B1C57E000
stack
page read and write
22F1B820000
heap
page read and write
14740C3D000
heap
page read and write
22F1B810000
heap
page read and write
22F1BA3D000
heap
page read and write
22F1BA29000
heap
page read and write
14740C00000
heap
page read and write
14740C84000
heap
page read and write
24D0000
direct allocation
page execute and read and write
1CFFC65E000
heap
page read and write
22F1BA4A000
heap
page read and write
14740C45000
heap
page read and write
14740C77000
heap
page read and write
49F000
unkown
page execute and read and write
14740C7A000
heap
page read and write
5EC000
heap
page read and write
489000
unkown
page write copy
14740C56000
heap
page read and write
22F1B870000
heap
page read and write
486000
unkown
page write copy
23B3000
heap
page read and write
23E0000
heap
page read and write
3B1C67E000
stack
page read and write
400000
unkown
page readonly
19B000
stack
page read and write
14740C42000
heap
page read and write
22F1BA02000
heap
page read and write
22F1BA4E000
heap
page read and write
485000
unkown
page execute and read and write
14740AB0000
heap
page read and write
A0E000
stack
page read and write
14740C39000
heap
page read and write
638832B000
stack
page read and write
14740C6B000
heap
page read and write
22F1BA43000
heap
page read and write
550000
trusted library allocation
page read and write
14740C48000
heap
page read and write
14740C47000
heap
page read and write
23B0000
heap
page read and write
2830000
direct allocation
page execute and read and write
638877F000
stack
page read and write
14740C29000
heap
page read and write
23F0000
heap
page read and write
22F1BA13000
heap
page read and write
22B0000
direct allocation
page read and write
6388B7E000
stack
page read and write
2CAD000
stack
page read and write
59E000
stack
page read and write
1CFFD102000
heap
page read and write
14740D02000
heap
page read and write
22F1BA00000
heap
page read and write
22F1BA46000
heap
page read and write
14740C41000
heap
page read and write
14740C61000
heap
page read and write
9CF000
stack
page read and write
22F1B970000
trusted library allocation
page read and write
98000
stack
page read and write
14740C60000
heap
page read and write
14740C30000
heap
page read and write
14740C7E000
heap
page read and write
30000
heap
page read and write
22F1C202000
trusted library allocation
page read and write
638887A000
stack
page read and write
14740C6A000
heap
page read and write
22F1BB02000
heap
page read and write
2A30000
direct allocation
page read and write
14740C3A000
heap
page read and write
There are 112 hidden memdumps, click here to show them.