IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Baldi\Baldi.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Baldi\DisableUAC.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Baldi\kill.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Baldi\lol.png
PNG image data, 700 x 394, 8-bit/color RGBA, non-interlaced
dropped
 malicious
C:\Baldi\mbr.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Baldi\7note.mp3
Audio file with ID3 version 2.4.0, contains:\012- MPEG ADTS, layer III, v2, 160 kbps, 22.05 kHz, Monaural
dropped
C:\Baldi\CleanZUpdater.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\FC2B.tmp\FC2C.bat
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
C:\Users\user\Desktop\file.exe
 malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c CleanZUpdater.bat
 malicious
C:\Baldi\Baldi.exe
C:\Baldi\Baldi.exe
malicious
C:\Baldi\DisableUAC.exe
C:\Baldi\DisableUAC.exe
malicious
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd" /c "C:\Users\user\AppData\Local\Temp\FC2B.tmp\FC2C.bat C:\Baldi\DisableUAC.exe
 malicious
C:\Windows\System32\reg.exe
reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
 malicious
C:\Windows\System32\shutdown.exe
shutdown -r -t 1 -c "BALDI EVIL..."
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im explorer.exe
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://nsis.sf.net/NSIS_Error
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://www.youtube.com/channel/UCsKC-cU51wQN_jz-jUrzu-Ang
unknown
https://www.youtube.com/channel/UCsKC-cU51wQN_jz-jUrzu-A
unknown
https://vk.com/endnet
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
 malicious
HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
HKEY_CURRENT_USER\softwaremicrosoftwindowscurrentversionpoliciesexplorer
noclose
HKEY_CURRENT_USER\softwaremicrosoftwindowscurrentversionpoliciesexplorer
nologoff
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
GG.exe

Memdumps

Base Address
Regiontype
Protect
Malicious
1FFF3F00000
heap
page read and write
 malicious
470000
heap
page read and write
 malicious
16157B60000
heap
page read and write
 malicious
1FFF3EF0000
heap
page read and write
 malicious
16157B70000
heap
page read and write
 malicious
2370000
heap
page read and write
 malicious
16157B6F000
heap
page read and write
 malicious
1E5CE7B0000
heap
page read and write
 malicious
16157B70000
heap
page read and write
 malicious
1C4000
heap
page read and write
 malicious
1E5CE4F0000
heap
page read and write
 malicious
1E5CE4F9000
heap
page read and write
 malicious
1FFF3EF4000
heap
page read and write
 malicious
1E5CE7B4000
heap
page read and write
 malicious
448000
heap
page read and write
 malicious
16157DD0000
heap
page read and write
 malicious
16157B6B000
heap
page read and write
 malicious
16157B84000
heap
page read and write
2EAA000
direct allocation
page read and write
401000
unkown
page execute read
14001B000
unkown
page read and write
140001000
unkown
page execute read
16157B84000
heap
page read and write
2EB8000
direct allocation
page read and write
4DCE000
stack
page read and write
271F000
stack
page read and write
637000
unkown
page read and write
2E0A000
direct allocation
page read and write
180000
heap
page read and write
1E5CE4A0000
heap
page read and write
1EFE000
stack
page read and write
5FD2FC000
stack
page read and write
1040000
unkown
page readonly
16157B74000
heap
page read and write
16157B74000
heap
page read and write
7FE8A000
direct allocation
page read and write
14001E000
unkown
page readonly
16157B74000
heap
page read and write
407000
unkown
page readonly
439000
unkown
page readonly
4D8F000
stack
page read and write
1E5CE4C0000
heap
page read and write
140000000
unkown
page readonly
16157B70000
heap
page read and write
400000
unkown
page readonly
21A0000
heap
page read and write
160E000
stack
page read and write
2DE7000
direct allocation
page read and write
1F0000
heap
page read and write
2EE4000
direct allocation
page read and write
16157B30000
heap
page read and write
2190000
heap
page read and write
1240000
heap
page read and write
2E94000
direct allocation
page read and write
16157B74000
heap
page read and write
628000
unkown
page write copy
16157B74000
heap
page read and write
16157DD9000
heap
page read and write
A3648ED000
stack
page read and write
30000
heap
page read and write
30000
heap
page read and write
628000
unkown
page read and write
B925C7E000
stack
page read and write
16157B70000
heap
page read and write
1E5CE50F000
heap
page read and write
2E1A000
direct allocation
page read and write
63E000
unkown
page readonly
1625000
heap
page read and write
2EEC000
direct allocation
page read and write
10000
heap
page read and write
206F000
stack
page read and write
B925CFF000
stack
page read and write
9C5000
heap
page read and write
16157DD4000
heap
page read and write
480000
heap
page read and write
7FE60000
direct allocation
page read and write
1E5CE502000
heap
page read and write
16157B84000
heap
page read and write
2F01000
direct allocation
page read and write
2ECF000
direct allocation
page read and write
2EF3000
direct allocation
page read and write
4A0000
heap
page read and write
1245000
heap
page read and write
640000
unkown
page readonly
13BA000
heap
page read and write
407000
unkown
page readonly
162B000
heap
page read and write
16157B6C000
heap
page read and write
14001B000
unkown
page write copy
25DF000
stack
page read and write
1F3E000
stack
page read and write
1FFF3F09000
heap
page read and write
4C8E000
stack
page read and write
19A000
stack
page read and write
639000
unkown
page write copy
5FD4FF000
stack
page read and write
7FEA1000
direct allocation
page read and write
1173000
heap
page read and write
41B000
unkown
page execute read
1F60000
heap
page read and write
2E21000
direct allocation
page read and write
2E9B000
direct allocation
page read and write
42C000
unkown
page read and write
16157E10000
heap
page read and write
1E5CE50D000
heap
page read and write
2E29000
direct allocation
page read and write
16157B74000
heap
page read and write
16157B84000
heap
page read and write
1360000
heap
page read and write
2EA2000
direct allocation
page read and write
140016000
unkown
page readonly
459000
heap
page read and write
568000
heap
page read and write
5FD3FF000
unkown
page read and write
2E25000
direct allocation
page read and write
439000
unkown
page readonly
216F000
stack
page read and write
16157AA0000
heap
page read and write
9C000
stack
page read and write
21A7000
heap
page read and write
4F0000
heap
page read and write
1C7000
heap
page read and write
401000
unkown
page execute read
16157B84000
heap
page read and write
2E76000
direct allocation
page read and write
140016000
unkown
page readonly
4ECF000
stack
page read and write
1C0000
heap
page read and write
16157B70000
heap
page read and write
B92599C000
stack
page read and write
16157B84000
heap
page read and write
16157B74000
heap
page read and write
2E36000
direct allocation
page read and write
56B000
heap
page read and write
4C4F000
stack
page read and write
1FFF3E50000
heap
page read and write
1150000
heap
page read and write
2EB1000
direct allocation
page read and write
2E68000
direct allocation
page read and write
140000000
unkown
page readonly
19A000
stack
page read and write
13E7000
heap
page read and write
2040000
heap
page read and write
2E59000
direct allocation
page read and write
2DF3000
direct allocation
page read and write
16157B74000
heap
page read and write
4EE000
stack
page read and write
16157B84000
heap
page read and write
2DF8000
direct allocation
page read and write
2ED6000
direct allocation
page read and write
1E5CE360000
heap
page read and write
80F000
stack
page read and write
98000
stack
page read and write
63D000
unkown
page read and write
16157B84000
heap
page read and write
70F000
stack
page read and write
16157B84000
heap
page read and write
400000
unkown
page readonly
261E000
stack
page read and write
2E12000
direct allocation
page read and write
140001000
unkown
page execute read
2EFA000
direct allocation
page read and write
16157B70000
heap
page read and write
62F000
unkown
page read and write
140D000
heap
page read and write
632000
unkown
page read and write
16157B74000
heap
page read and write
1620000
heap
page read and write
16157B84000
heap
page read and write
400000
unkown
page readonly
400000
heap
page read and write
2F08000
direct allocation
page read and write
16157B74000
heap
page read and write
440000
heap
page read and write
13EB000
heap
page read and write
520000
heap
page read and write
2E60000
direct allocation
page read and write
1A0000
heap
page read and write
640000
heap
page read and write
409000
unkown
page write copy
562000
heap
page read and write
528000
heap
page read and write
16157B84000
heap
page read and write
A36496F000
stack
page read and write
21A2000
heap
page read and write
14001E000
unkown
page readonly
16157DD9000
heap
page read and write
16157B74000
heap
page read and write
1170000
heap
page read and write
13E3000
heap
page read and write
40B000
unkown
page read and write
7FE9A000
direct allocation
page read and write
13B0000
heap
page read and write
9C0000
heap
page read and write
58C0000
trusted library allocation
page read and write
1390000
direct allocation
page execute and read and write
2E03000
direct allocation
page read and write
16157E10000
heap
page read and write
16157B6D000
heap
page read and write
16157B70000
heap
page read and write
409000
unkown
page read and write
16157DD5000
heap
page read and write
2E8C000
direct allocation
page read and write
A3649EF000
stack
page read and write
401000
unkown
page execute read
1200000
heap
page read and write
14C000
stack
page read and write
1380000
heap
page read and write
16157B10000
heap
page read and write
16157B84000
heap
page read and write
16157DD9000
heap
page read and write
1FFF3DE0000
heap
page read and write
2E84000
direct allocation
page read and write
13FB000
heap
page read and write
16157DD9000
heap
page read and write
1FFF3E70000
heap
page read and write
2EC8000
direct allocation
page read and write
2EDD000
direct allocation
page read and write
13F8000
heap
page read and write
434000
unkown
page read and write
645000
heap
page read and write
There are 211 hidden memdumps, click here to show them.