IOC Report
G1lnGpOLK4.exe

loading gif

Files

File Path
Type
Category
Malicious
G1lnGpOLK4.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ojnmq5j.r54.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ed1lrobr.tzh.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mf1svetu.2wj.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqnjg344.x0n.ps1
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 51
ASCII text, with very long lines (3295)
downloaded

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\G1lnGpOLK4.exe
"C:\Users\user\Desktop\G1lnGpOLK4.exe"
 malicious
C:\Windows\System32\cmd.exe
cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
 malicious
C:\Windows\System32\cmd.exe
cmd /c sc query windefend
 malicious
C:\Windows\System32\cmd.exe
cmd /c sc stop windefend
 malicious
C:\Windows\System32\cmd.exe
cmd /c sc delete windefend
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2036,i,13697505174205213952,6185066048164698462,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\sc.exe
sc query windefend
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\sc.exe
sc stop windefend
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\sc.exe
sc delete windefend
There are 6 hidden processes, click here to show them.

URLs

Name
IP
Malicious
0.tcp.eu.ngrok.io
malicious
https://www.google.com/async/newtab_promos
142.251.40.228
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
142.251.40.228
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
142.251.40.228
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGPufzLEGIjDTt_akc_527nJ4zoGCbAZn0AkDcVIV2VLuAM78mz4Tuc4onQdlIzVDE6yNOrZBZH0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
142.251.40.228
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGPufzLEGIjDqkokB_Yx903z9S8-TdyWhW8iPlrZBrgRiiMPzrxlLxgoQH634QKXADTY9t1vdNmMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
142.251.40.228
https://pastebin.com/raw/s4TipmJt
104.20.3.235
https://pastebin.com
unknown

Domains

Name
IP
Malicious
0.tcp.eu.ngrok.io
18.192.31.165
 malicious
www.google.com
142.251.40.228
pastebin.com
104.20.3.235

IPs

IP
Domain
Country
Malicious
18.192.31.165
0.tcp.eu.ngrok.io
United States
malicious
104.20.3.235
pastebin.com
United States
239.255.255.250
unknown
Reserved
3.124.142.205
unknown
United States
142.251.40.228
www.google.com
United States
192.168.2.4
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\G1lnGpOLK4_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\f2d4732908d59805d830a49d36974ac0
[kl]
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
130AD000
trusted library allocation
page read and write
 malicious
1390000
trusted library section
page read and write
 malicious
758F4FC000
stack
page read and write
2D5E000
stack
page read and write
1130000
heap
page read and write
21DF9448000
heap
page read and write
18ADDB84000
heap
page read and write
962000
unkown
page readonly
964000
unkown
page readonly
2E86D960000
heap
page read and write
EE0000
heap
page read and write
2E86DC25000
heap
page read and write
1443000
heap
page read and write
1F1A7270000
heap
page read and write
1F1A73F5000
heap
page read and write
CF4000
stack
page read and write
1D044550000
heap
page read and write
FD1000
heap
page read and write
21DF9520000
heap
page read and write
21DF9370000
heap
page read and write
F71000
heap
page read and write
EE6000
heap
page read and write
DF0000
heap
page read and write
7FFD9B7B0000
trusted library allocation
page read and write
1B100000
trusted library allocation
page read and write
28000
trusted library allocation
page read and write
18ADDB6A000
heap
page read and write
7FFD9B7B6000
trusted library allocation
page read and write
7FFD9B920000
trusted library allocation
page execute and read and write
1F1A7409000
heap
page read and write
7FF466BC0000
trusted library allocation
page execute and read and write
B23D58F000
stack
page read and write
18ADDB86000
heap
page read and write
1B77C000
heap
page read and write
7FFD9B7A0000
trusted library allocation
page read and write
F76F77E000
unkown
page readonly
960000
unkown
page readonly
F63000
heap
page read and write
7FFD9B8E0000
trusted library allocation
page execute and read and write
F76F7FE000
stack
page read and write
B23D8FF000
stack
page read and write
758F5FF000
unkown
page read and write
1B9B5000
stack
page read and write
F0A000
heap
page read and write
F0E000
heap
page read and write
1AAA8ED0000
heap
page read and write
21DF942B000
heap
page read and write
1C277000
heap
page read and write
1D044630000
heap
page read and write
21F99280000
heap
page read and write
1489000
stack
page read and write
EF4207D000
stack
page read and write
78DD32C000
stack
page read and write
7FF466BD0000
trusted library allocation
page execute and read and write
21F992F0000
heap
page read and write
1155000
heap
page read and write
18ADDDC0000
heap
page read and write
EF4217F000
stack
page read and write
130A1000
trusted library allocation
page read and write
21F99270000
heap
page read and write
1D044690000
heap
page read and write
1F1A7350000
heap
page read and write
18ADDB20000
heap
page read and write
21F99340000
heap
page read and write
1C299000
heap
page read and write
1F1A7370000
heap
page read and write
21DF9350000
heap
page read and write
1D044660000
heap
page read and write
2CE60FF000
unkown
page read and write
1446000
heap
page read and write
21DF9446000
heap
page read and write
7FFD9B85A000
trusted library allocation
page execute and read and write
1C260000
heap
page read and write
21DF9270000
heap
page read and write
F75000
heap
page read and write
1365000
heap
page read and write
10E0000
trusted library allocation
page read and write
7FFD9B86D000
trusted library allocation
page execute and read and write
EF4227E000
stack
page read and write
7FFD9B930000
trusted library allocation
page execute and read and write
E40000
heap
page read and write
96E000
unkown
page readonly
E10000
heap
page read and write
1C25E000
stack
page read and write
21DF9420000
heap
page read and write
1160000
heap
page read and write
21F992A0000
heap
page read and write
1AAA8DF6000
heap
page read and write
1AAA8EF0000
heap
page read and write
960000
unkown
page readonly
1150000
heap
page read and write
7FFD9B860000
trusted library allocation
page read and write
7FFD9B865000
trusted library allocation
page read and write
37AACFF000
unkown
page read and write
2E86DC20000
heap
page read and write
3163000
trusted library allocation
page read and write
18ADDDB0000
heap
page read and write
7FFD9B852000
trusted library allocation
page execute and read and write
2E86DAA8000
heap
page read and write
2A000
trusted library allocation
page read and write
7FFD9B79A000
trusted library allocation
page execute and read and write
18ADDAF0000
heap
page read and write
F76F6FE000
stack
page read and write
1360000
heap
page read and write
37AA90B000
stack
page read and write
DD0000
heap
page read and write
30A1000
trusted library allocation
page read and write
1D044698000
heap
page read and write
7FFD9B7A2000
trusted library allocation
page execute and read and write
318B000
trusted library allocation
page read and write
1B97E000
stack
page read and write
18ADDB60000
heap
page read and write
2CE61FF000
stack
page read and write
7FFD9B86A000
trusted library allocation
page execute and read and write
1440000
heap
page read and write
14B0000
heap
page execute and read and write
1AAA8CA0000
heap
page read and write
EEC000
heap
page read and write
21F9934A000
heap
page read and write
2E86DAA0000
heap
page read and write
20000
trusted library allocation
page read and write
F10000
heap
page read and write
1AAA8DB0000
heap
page read and write
1BF5E000
stack
page read and write
18ADDB87000
heap
page read and write
7FFD9B7F4000
trusted library allocation
page execute and read and write
7FFD9B892000
trusted library allocation
page execute and read and write
1490000
trusted library section
page read and write
7FFD9B8D2000
trusted library allocation
page read and write
2CE5D2C000
stack
page read and write
1F1A7400000
heap
page read and write
758F6FF000
stack
page read and write
13A6000
trusted library section
page read and write
78DD6FF000
unkown
page read and write
7FFD9B792000
trusted library allocation
page execute and read and write
21F99364000
heap
page read and write
78DD7FF000
stack
page read and write
F44000
heap
page read and write
1C272000
heap
page read and write
B23D87E000
unkown
page readonly
1D044670000
heap
page read and write
18ADDB00000
heap
page read and write
2E86DA40000
heap
page read and write
1AAA8DF8000
heap
page read and write
1D044665000
heap
page read and write
F1B000
heap
page read and write
313B000
trusted library allocation
page read and write
21F99510000
heap
page read and write
18ADDDB5000
heap
page read and write
7FFD9B7C3000
trusted library allocation
page execute and read and write
1AAA8D80000
heap
page read and write
9F0000
heap
page read and write
21DF9650000
heap
page read and write
7FFD9B7BF000
trusted library allocation
page execute and read and write
1AAA8DD0000
heap
page read and write
B23D48C000
stack
page read and write
F76F3ED000
stack
page read and write
130A5000
trusted library allocation
page read and write
1BC5E000
stack
page read and write
1AAA8DDB000
heap
page read and write
37AADFF000
stack
page read and write
130A7000
trusted library allocation
page read and write
1F1A73F0000
heap
page read and write
130C4000
trusted library allocation
page read and write
7FFD9B8D7000
trusted library allocation
page read and write
2E86DA60000
heap
page read and write
There are 156 hidden memdumps, click here to show them.