IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\vvtsewb
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\vvtsewb:Zone.Identifier
ASCII text, with CRLF line terminators
modified
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
C:\Users\user\Desktop\file.exe
 malicious
C:\Windows\explorer.exe
C:\Windows\Explorer.EXE
 malicious
C:\Users\user\AppData\Roaming\vvtsewb
C:\Users\user\AppData\Roaming\vvtsewb
 malicious

URLs

Name
IP
Malicious
http://host-file-host6.com/
84.21.172.159
 malicious
http://host-host-file8.com/
malicious
http://www.autoitscript.com/autoit3/J
unknown

Domains

Name
IP
Malicious
host-file-host6.com
84.21.172.159
 malicious
host-host-file8.com
unknown
 malicious

IPs

IP
Domain
Country
Malicious
84.21.172.159
host-file-host6.com
Germany
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
7E1000
unclassified section
page read and write
 malicious
22A1000
unclassified section
page read and write
 malicious
7C0000
trusted library allocation
page read and write
 malicious
800000
direct allocation
page read and write
 malicious
2901000
system
page execute read
 malicious
7C0000
direct allocation
page read and write
 malicious
800000
trusted library allocation
page read and write
 malicious
7FFA131B5000
unkown
page read and write
7FF585E3E000
unkown
page readonly
7FF585AB9000
unkown
page readonly
4350000
unkown
page read and write
ED22000
unkown
page read and write
4320000
unkown
page read and write
85D8000
unkown
page read and write
7FF585D05000
unkown
page readonly
7FF577B76000
unkown
page readonly
2950000
unkown
page read and write
85C4000
unkown
page read and write
EDBD000
unkown
page read and write
7FF58596F000
unkown
page readonly
6624000
unkown
page read and write
B008000
stack
page read and write
B008000
stack
page read and write
B80B000
stack
page read and write
7FF585940000
unkown
page readonly
85E1000
unkown
page read and write
4BC0000
unkown
page read and write
103B2000
unkown
page read and write
6A90000
unkown
page readonly
726E000
unkown
page readonly
F131000
unkown
page read and write
7FF585D01000
unkown
page readonly
7FF585DEA000
unkown
page readonly
7FF585937000
unkown
page readonly
87C8000
unkown
page read and write
26D0000
unkown
page read and write
F045000
unkown
page read and write
7FF5856C7000
unkown
page readonly
2660000
unkown
page readonly
7FF585ED3000
unkown
page readonly
103A1000
unkown
page read and write
770E000
stack
page read and write
DD7F000
unkown
page read and write
22E3000
heap
page read and write
7FF585D5F000
unkown
page readonly
6210000
unkown
page readonly
2A8B000
unkown
page read and write
5810000
unkown
page read and write
647000
unkown
page read and write
CCB2000
unkown
page read and write
2960000
unkown
page read and write
7FF585D7C000
unkown
page readonly
7FF585773000
unkown
page readonly
2950000
unkown
page read and write
C8B2000
unkown
page read and write
7FF585A91000
unkown
page readonly
7FF5859A5000
unkown
page readonly
7FFA13109000
unkown
page readonly
72B9000
unkown
page readonly
7FF585DD9000
unkown
page readonly
7FF585853000
unkown
page readonly
85D0000
unkown
page read and write
2A40000
unkown
page read and write
7FF585CF6000
unkown
page readonly
470A000
stack
page read and write
419000
unkown
page execute read
4C66000
unkown
page read and write
B18A000
stack
page read and write
29EE000
unkown
page read and write
56E0000
unkown
page readonly