IOC Report
DHL_734825514200.exe

loading gif

Files

File Path
Type
Category
Malicious
DHL_734825514200.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_734825514200.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14d1iv1g.4xt.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20mui45p.w2d.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wzepedb.r4c.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcxw0qdb.yvy.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DHL_734825514200.exe
"C:\Users\user\Desktop\DHL_734825514200.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL_734825514200.exe"
 malicious
C:\Users\user\Desktop\DHL_734825514200.exe
"C:\Users\user\Desktop\DHL_734825514200.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://mail.saludsanjuan.cl
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://saludsanjuan.cl
unknown

Domains

Name
IP
Malicious
saludsanjuan.cl
138.186.9.97
 malicious
mail.saludsanjuan.cl
unknown
 malicious

IPs

IP
Domain
Country
Malicious
138.186.9.97
saludsanjuan.cl
Chile
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2E46000
trusted library allocation
page read and write
 malicious
2E3E000
trusted library allocation
page read and write
 malicious
2DF1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
24D1000
trusted library allocation
page read and write
 malicious
273E000
trusted library allocation
page read and write
 malicious
4BF0000
trusted library section
page read and write
 malicious
3811000
trusted library allocation
page read and write
 malicious
4131000
trusted library allocation
page read and write
 malicious
4DC0000
trusted library allocation
page read and write
4E1C000
heap
page read and write
10DA000
heap
page read and write
4E00000
heap
page read and write
54AE000
stack
page read and write
2B80000
trusted library allocation
page read and write
53B2000
trusted library allocation
page read and write
1170000
heap
page read and write
6E3000
heap
page read and write
10AD000
trusted library allocation
page execute and read and write
6B00000
trusted library allocation
page read and write
6941000
trusted library allocation
page read and write
86DE000
stack
page read and write
138D000
trusted library allocation
page execute and read and write
34D1000
trusted library allocation
page read and write
2B52000
trusted library allocation
page read and write
6DD0000
heap
page read and write
4AD0000
trusted library allocation
page read and write
7E5D000
stack
page read and write
5C0000
trusted library allocation
page read and write
3E59000
trusted library allocation
page read and write
66FE000
stack
page read and write
99B000
trusted library allocation
page read and write
538E000
trusted library allocation
page read and write
600000
heap
page read and write
2B50000
trusted library allocation
page read and write
98C000
stack
page read and write
5B0000
heap
page read and write
4C30000
trusted library allocation
page execute and read and write
FF0000
heap
page read and write
5370000
trusted library allocation
page read and write
10B0000
heap
page read and write
994000
trusted library allocation
page read and write
3E19000
trusted library allocation
page read and write
4C40000
heap
page execute and read and write
63EC000
trusted library allocation
page read and write
1380000
trusted library allocation
page read and write
C90000
trusted library allocation
page read and write
2CE0000
heap
page read and write
2E5A000
trusted library allocation
page read and write
58FF000
stack
page read and write
6B40000
trusted library allocation
page execute and read and write
12000
unkown
page readonly
68C0000
heap
page read and write
63F0000
trusted library allocation
page read and write
6540000
trusted library allocation
page read and write
5A0000
trusted library allocation
page read and write
653E000
stack
page read and write
53C4000
trusted library allocation
page read and write
686000
heap
page read and write
2E3C000
trusted library allocation
page read and write
36AE000
trusted library allocation
page read and write
2BCE000
stack
page read and write
6902000
heap
page read and write
23C0000
heap
page execute and read and write
64E000
heap
page read and write
675000
heap
page read and write
CD0000
heap
page read and write
3527000
trusted library allocation
page read and write
C85000
trusted library allocation
page read and write
10A4000
trusted library allocation
page read and write
11AE000
heap
page read and write
237E000
stack
page read and write
4FBE000
stack
page read and write
580000
trusted library allocation
page read and write
4BE0000
trusted library allocation
page execute and read and write
4DF0000
heap
page read and write
2568000
trusted library allocation
page read and write
610000
trusted library allocation
page execute and read and write
2B62000
trusted library allocation
page read and write
684000
heap
page read and write
5D2000
trusted library allocation
page read and write
821F000
stack
page read and write
4BB0000
trusted library section
page read and write
5A3000
trusted library allocation
page read and write
2B65000
trusted library allocation
page execute and read and write
3575000
trusted library allocation
page read and write
4AC0000
trusted library allocation
page execute and read and write
9B6000
trusted library allocation
page read and write
87DE000
stack
page read and write
640000
heap
page read and write
63E0000
trusted library allocation
page read and write
10E6000
heap
page read and write
54C0000
heap
page read and write
5386000
trusted library allocation
page read and write
7FDF0000
trusted library allocation
page execute and read and write
6547000
trusted library allocation
page read and write
5A40000
trusted library allocation
page read and write
57FC000
stack
page read and write
1530000
heap
page read and write
45CC000
stack
page read and write
845E000
stack
page read and write
5680000
heap
page read and write
5392000
trusted library allocation
page read and write
90E000
stack
page read and write
5DB000
trusted library allocation
page execute and read and write
811E000
stack
page read and write
1040000
heap
page read and write
590000
trusted library allocation
page read and write
605E000
stack
page read and write
ADF000
stack
page read and write
2C70000
trusted library allocation
page execute and read and write
4A03000
heap
page read and write
2DEF000
stack
page read and write
C7F000
trusted library allocation
page read and write
539E000
trusted library allocation
page read and write
CDA000
heap
page read and write
2E53000
trusted library allocation
page read and write
5460000
heap
page execute and read and write
4BD0000
trusted library allocation
page read and write
10A3000
trusted library allocation
page execute and read and write
4EED000
stack
page read and write
620000
trusted library allocation
page read and write
6460000
trusted library allocation
page execute and read and write
8AA2000
trusted library allocation
page read and write
14A000
stack
page read and write
1390000
heap
page read and write
24CE000
stack
page read and write
2CD0000
trusted library allocation
page read and write
53AD000
trusted library allocation
page read and write
2CCC000
stack
page read and write
3DF9000
trusted library allocation
page read and write
869E000
stack
page read and write
37D1000
trusted library allocation
page read and write
593000
trusted library allocation
page execute and read and write
34D9000
trusted library allocation
page read and write
1050000
heap
page read and write
35C3000
trusted library allocation
page read and write
2B5A000
trusted library allocation
page execute and read and write
57E000
stack
page read and write
4E44000
heap
page read and write
4C20000
trusted library allocation
page read and write
4BC0000
trusted library allocation
page execute and read and write
F89000
stack
page read and write
C70000
trusted library allocation
page read and write
6406000
trusted library allocation
page read and write
53E000
stack
page read and write
6550000
trusted library allocation
page read and write
54B0000
heap
page read and write
4D4F000
stack
page read and write
5C6000
trusted library allocation
page execute and read and write
5380000
trusted library allocation
page read and write
4C00000
trusted library allocation
page read and write
2B60000
trusted library allocation
page read and write
7E60000
heap
page read and write
615E000
stack
page read and write
1045000
heap
page read and write
4AB2000
trusted library allocation
page read and write
593E000
stack
page read and write
4F7000
stack
page read and write
9C2000
trusted library allocation
page read and write
538B000
trusted library allocation
page read and write
630000
trusted library allocation
page read and write
542C000
stack
page read and write
10B8000
heap
page read and write
2330000
trusted library allocation
page read and write
1C0000
heap
page read and write
831D000
stack
page read and write
566D000
stack
page read and write
8AED000
stack
page read and write
54B3000
heap
page read and write
1090000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
4BAE000
stack
page read and write
6B30000
heap
page read and write
C80000
trusted library allocation
page read and write
68C4000
heap
page read and write
9BD000
trusted library allocation
page read and write
594000
trusted library allocation
page read and write
801E000
stack
page read and write
4A00000
heap
page read and write
4AB0000
trusted library allocation
page read and write
53C0000
trusted library allocation
page read and write
6410000
trusted library allocation
page execute and read and write
10000
unkown
page readonly
539A000
trusted library allocation
page read and write
5A48000
trusted library allocation
page read and write
645D000
stack
page read and write
6F9000
heap
page read and write
990000
trusted library allocation
page read and write
23B0000
heap
page read and write
2B56000
trusted library allocation
page execute and read and write
10E3000
heap
page read and write
2B6B000
trusted library allocation
page execute and read and write
5CA000
trusted library allocation
page execute and read and write
2C80000
heap
page execute and read and write
137E000
stack
page read and write
58B0000
trusted library section
page read and write
9B1000
trusted library allocation
page read and write
232E000
stack
page read and write
8AA0000
trusted library allocation
page read and write
8330000
heap
page read and write
9AE000
trusted library allocation
page read and write
E89000
stack
page read and write
8320000
heap
page read and write
103E000
stack
page read and write
94E000
stack
page read and write
53A6000
trusted library allocation
page read and write
64FE000
stack
page read and write
5F0000
trusted library allocation
page read and write
64A000
heap
page read and write
5D7000
trusted library allocation
page execute and read and write
5A3F000
stack
page read and write
10A0000
trusted library allocation
page read and write
5AD000
trusted library allocation
page execute and read and write
1B0000
heap
page read and write
859E000
stack
page read and write
895C000
stack
page read and write
855F000
stack
page read and write
CB0000
trusted library allocation
page read and write
2B67000
trusted library allocation
page execute and read and write
4D8C000
stack
page read and write
2BD8000
trusted library allocation
page read and write
59D000
trusted library allocation
page execute and read and write
7E1E000
stack
page read and write
9C0000
trusted library allocation
page read and write
8A5C000
stack
page read and write
53D0000
trusted library allocation
page read and write
8BEE000
stack
page read and write
9D0000
heap
page read and write
5C2000
trusted library allocation
page read and write
6400000
trusted library allocation
page read and write
8A60000
heap
page read and write
6B6F000
stack
page read and write
53A1000
trusted library allocation
page read and write
3DF1000
trusted library allocation
page read and write
1144000
heap
page read and write
There are 226 hidden memdumps, click here to show them.