IOC Report
bUPt.exe

loading gif

Files

File Path
Type
Category
Malicious
bUPt.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bUPt.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\bUPt.exe
"C:\Users\user\Desktop\bUPt.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\user\Desktop\bUPt.exe"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1988,i,13026046254637796549,1595632273730165584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
patria.duckdns.org
malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown

Domains

Name
IP
Malicious
patria.duckdns.org
46.246.80.19
 malicious
google.com
142.251.40.206
www.google.com
142.250.80.36

IPs

IP
Domain
Country
Malicious
46.246.80.19
patria.duckdns.org
Sweden
malicious
192.168.2.4
unknown
unknown
malicious
142.250.80.36
www.google.com
United States
239.255.255.250
unknown
Reserved
192.168.2.5
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
HKEY_CURRENT_USER\SOFTWARE\f179c84c13a
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
A22000
unkown
page readonly
 malicious
531B000
stack
page read and write
A28000
unkown
page readonly
5293000
heap
page read and write
7FAB0000
trusted library allocation
page execute and read and write
5D5D000
stack
page read and write
310E000
trusted library allocation
page read and write
141C000
stack
page read and write
4071000
trusted library allocation
page read and write
FF2000
trusted library allocation
page execute and read and write
3075000
trusted library allocation
page read and write
520F000
stack
page read and write
F4E000
stack
page read and write
1600000
trusted library allocation
page read and write
F8E000
stack
page read and write
2FBD000
stack
page read and write
520C000
stack
page read and write
1610000
heap
page execute and read and write
6AF0000
heap
page read and write
5C50000
heap
page read and write
5C5B000
heap
page read and write
1420000
trusted library allocation
page read and write
535C000
stack
page read and write
5940000
heap
page read and write
1020000
trusted library allocation
page read and write
5950000
heap
page read and write
10E0000
heap
page read and write
E10000
heap
page read and write
FF0000
trusted library allocation
page read and write
310A000
trusted library allocation
page read and write
69E8000
heap
page read and write
1037000
trusted library allocation
page execute and read and write
2D2F000
stack
page read and write
557E000
stack
page read and write
FE2000
trusted library allocation
page execute and read and write
10E8000
heap
page read and write
52DC000
stack
page read and write
3420000
heap
page read and write
543E000
stack
page read and write
ABA000
stack
page read and write
FFA000
trusted library allocation
page execute and read and write
103B000
trusted library allocation
page execute and read and write
3106000
trusted library allocation
page read and write
1022000
trusted library allocation
page execute and read and write
56BE000
stack
page read and write
1032000
trusted library allocation
page read and write
3540000
heap
page read and write
10D0000
heap
page read and write
13DE000
stack
page read and write
12DE000
stack
page read and write
553E000
stack
page read and write
32FD000
stack
page read and write
BB9000
stack
page read and write
354C000
heap
page read and write
15F0000
trusted library allocation
page read and write
5A4C000
stack
page read and write
1436000
heap
page read and write
A20000
unkown
page readonly
3400000
heap
page read and write
5290000
heap
page read and write
3071000
trusted library allocation
page read and write
5960000
heap
page read and write
373F000
unkown
page read and write
10EE000
heap
page read and write
101A000
trusted library allocation
page execute and read and write
1164000
heap
page read and write
102A000
trusted library allocation
page execute and read and write
57BE000
stack
page read and write
383F000
stack
page read and write
3102000
trusted library allocation
page read and write
5C1B000
stack
page read and write
5A8D000
stack
page read and write
EF5000
heap
page read and write
3320000
heap
page read and write
3510000
heap
page read and write
34AE000
stack
page read and write
30FE000
trusted library allocation
page read and write
69E0000
heap
page read and write
15D0000
trusted library allocation
page execute and read and write
1080000
heap
page read and write
5260000
trusted library allocation
page execute and read and write
107E000
stack
page read and write
346E000
unkown
page read and write
1017000
trusted library allocation
page execute and read and write
1430000
heap
page read and write
111D000
heap
page read and write
EF0000
heap
page read and write
6AE0000
heap
page read and write
FD0000
trusted library allocation
page read and write
F00000
heap
page read and write
567F000
stack
page read and write
1195000
heap
page read and write
BB6000
stack
page read and write
1030000
trusted library allocation
page read and write
5399000
stack
page read and write
57D0000
trusted library allocation
page execute and read and write
FEA000
trusted library allocation
page execute and read and write
1000000
heap
page read and write
There are 88 hidden memdumps, click here to show them.