IOC Report
2AylrL13DwoqmCT.exe

loading gif

Files

File Path
Type
Category
Malicious
2AylrL13DwoqmCT.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tmpBBC2.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\KrzbVJsCi.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KrzbVJsCi.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04yv3fqf.v3j.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1w5iscqo.xmj.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5l2m33in.lap.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqbg4zb1.vqo.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\KrzbVJsCi.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\2AylrL13DwoqmCT.exe
"C:\Users\user\Desktop\2AylrL13DwoqmCT.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\KrzbVJsCi.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KrzbVJsCi" /XML "C:\Users\user\AppData\Local\Temp\tmpBBC2.tmp"
 malicious
C:\Users\user\AppData\Roaming\KrzbVJsCi.exe
C:\Users\user\AppData\Roaming\KrzbVJsCi.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1

Domains

Name
IP
Malicious
ftp.jeepcommerce.rs
195.252.110.253
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
195.252.110.253
ftp.jeepcommerce.rs
Serbia
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2AylrL13DwoqmCT_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2D01000
trusted library allocation
page read and write
 malicious
5520000
trusted library section
page read and write
 malicious
4042000
trusted library allocation
page read and write
 malicious
2DF1000
trusted library allocation
page read and write
 malicious
8DC0000
trusted library section
page read and write
 malicious
305E000
trusted library allocation
page read and write
 malicious
74BE000
stack
page read and write
3DF9000
trusted library allocation
page read and write
120A000
trusted library allocation
page execute and read and write
77FE000
stack
page read and write
3EDE000
trusted library allocation
page read and write
567E000
stack
page read and write
E53000
heap
page read and write
10DD000
trusted library allocation
page execute and read and write
56D4000
heap
page read and write
1102000
trusted library allocation
page read and write
2DA5000
trusted library allocation
page read and write
2DD0000
heap
page read and write
10F2000
trusted library allocation
page read and write
8CBD000
stack
page read and write
51CE000
trusted library allocation
page read and write
2D5B000
trusted library allocation
page read and write
11E4000
trusted library allocation
page read and write
3420000
heap
page read and write
4EEC000
stack
page read and write
E20000
heap
page read and write
1202000
trusted library allocation
page read and write
1100000
trusted library allocation
page read and write
DD0000
heap
page read and write
5250000
trusted library allocation
page read and write
1206000
trusted library allocation
page execute and read and write
56C0000
heap
page read and write
3E47000
trusted library allocation
page read and write
FA5000
heap
page read and write
2BF0000
trusted library allocation
page read and write
698E000
stack
page read and write
5282000
trusted library allocation
page read and write
2DD0000
heap
page read and write
3DF1000
trusted library allocation
page read and write
5650000
trusted library allocation
page execute and read and write
5230000
trusted library allocation
page read and write
5DC0000
trusted library section
page read and write
753E000
stack
page read and write
2D0E000
stack
page read and write
110B000
trusted library allocation
page execute and read and write
62EE000
stack
page read and write
4003000
trusted library allocation
page read and write
7291000
trusted library allocation
page read and write
2AC2000
trusted library allocation
page read and write
5480000
trusted library allocation
page read and write
5ECD000
stack
page read and write
2CDE000
stack
page read and write
2C00000
heap
page read and write
9520000
heap
page read and write
521F000
trusted library allocation
page read and write
14E0000
trusted library allocation
page execute and read and write
E91000
heap
page read and write
557E000
stack
page read and write
10E3000
trusted library allocation
page read and write
57A0000
trusted library allocation
page read and write
2D71000
trusted library allocation
page read and write
EF0000
heap
page read and write
2D2D000
stack
page read and write
5510000
trusted library allocation
page execute and read and write
5DB0000
trusted library allocation
page read and write
52B0000
trusted library allocation
page execute and read and write
7F130000
trusted library allocation
page execute and read and write
14FA000
heap
page read and write
56D7000
heap
page read and write
2C4E000
stack
page read and write
2B70000
trusted library allocation
page read and write
70426000
unkown
page readonly
3DF3000
trusted library allocation
page read and write
F0A000
heap
page read and write
6280000
trusted library allocation
page read and write
1120000
trusted library allocation
page read and write
51A0000
trusted library allocation
page read and write
4D3C000
stack
page read and write
5780000
trusted library allocation
page read and write
2C90000
trusted library allocation
page read and write
2AC7000
trusted library allocation
page execute and read and write
4E3D000
stack
page read and write
E10000
heap
page read and write
678E000
stack
page read and write
52A0000
trusted library allocation
page read and write
51E2000
trusted library allocation
page read and write
8B7E000
stack
page read and write
62A0000
trusted library allocation
page execute and read and write
1210000
heap
page read and write
F8E000
stack
page read and write
40E9000
trusted library allocation
page read and write
87BE000
stack
page read and write
51D6000
trusted library allocation
page read and write
4167000
trusted library allocation
page read and write
56B0000
heap
page read and write
5680000
heap
page read and write
57D0000
heap
page read and write
A0C000
unkown
page readonly
9AAE000
stack
page read and write
5203000
heap
page read and write
1105000
trusted library allocation
page execute and read and write
10D0000
trusted library allocation
page read and write
DFB000
heap
page read and write
51DD000
trusted library allocation
page read and write
3160000
heap
page read and write
51E0000
trusted library allocation
page read and write
114F000
stack
page read and write
32DE000
stack
page read and write
5530000
heap
page execute and read and write
BA7000
stack
page read and write
1140000
heap
page read and write
E69000
heap
page read and write
3FCE000
trusted library allocation
page read and write
10F0000
trusted library allocation
page read and write
8E80000
trusted library allocation
page execute and read and write
5450000
trusted library allocation
page read and write
EBD000
heap
page read and write
5470000
trusted library allocation
page execute and read and write
2D7D000
trusted library allocation
page read and write
FA0000
heap
page read and write
2DE0000
heap
page execute and read and write
2B4E000
stack
page read and write
DD8000
heap
page read and write
84E2000
trusted library allocation
page read and write
51F4000
trusted library allocation
page read and write
57C0000
trusted library allocation
page read and write
10F6000
trusted library allocation
page execute and read and write
5270000
heap
page read and write
2CE0000
trusted library allocation
page read and write
2BC1000
trusted library allocation
page read and write
51D1000
trusted library allocation
page read and write
2BBE000
stack
page read and write
F4E000
stack
page read and write
6100000
trusted library allocation
page read and write
52A0000
trusted library allocation
page read and write
6290000
trusted library allocation
page read and write
5E00000
trusted library allocation
page read and write
10D3000
trusted library allocation
page execute and read and write
10D4000
trusted library allocation
page read and write
11E0000
trusted library allocation
page read and write
131E000
stack
page read and write
5F3D000
stack
page read and write
5670000
trusted library allocation
page execute and read and write
11F0000
trusted library allocation
page read and write
E14000
heap
page read and write
688E000
stack
page read and write
5660000
trusted library allocation
page read and write
99AD000
stack
page read and write
3F66000
trusted library allocation
page read and write
5280000
trusted library allocation
page read and write
897E000
stack
page read and write
3EE3000
trusted library allocation
page read and write
2D76000
trusted library allocation
page read and write
5225000
trusted library allocation
page read and write
3E95000
trusted library allocation
page read and write
52A2000
trusted library allocation
page read and write
5E30000
heap
page read and write
1190000
heap
page read and write
554E000
stack
page read and write
11ED000
trusted library allocation
page execute and read and write
C8A000
stack
page read and write
10FA000
trusted library allocation
page execute and read and write
2DD3000
heap
page read and write
2D90000
trusted library allocation
page read and write
E5E000
heap
page read and write
312E000
unkown
page read and write
1130000
heap
page execute and read and write
11E3000
trusted library allocation
page execute and read and write
6200000
trusted library section
page read and write
8BBE000
stack
page read and write
5180000
heap
page read and write
D87000
stack
page read and write
11D0000
trusted library allocation
page read and write
5DCB000
stack
page read and write
5230000
trusted library allocation
page read and write
57B0000
trusted library allocation
page execute and read and write
5F3E000
stack
page read and write
7042D000
unkown
page read and write
7042F000
unkown
page readonly
30E0000
heap
page read and write
5500000
heap
page execute and read and write
2D6A000
stack
page read and write
2D50000
trusted library allocation
page read and write
962C000
stack
page read and write
2D9F000
trusted library allocation
page read and write
1200000
trusted library allocation
page read and write
EF0000
heap
page read and write
118E000
stack
page read and write
70410000
unkown
page readonly
3FE3000
trusted library allocation
page read and write
E58000
heap
page read and write
51F0000
trusted library allocation
page read and write
7042D000
unkown
page read and write
329F000
unkown
page read and write
9BEE000
stack
page read and write
5290000
trusted library allocation
page execute and read and write
EC4000
heap
page read and write
2E88000
trusted library allocation
page read and write
8CC0000
heap
page read and write
2B6E000
stack
page read and write
11F3000
trusted library allocation
page read and write
331F000
stack
page read and write
E11000
heap
page read and write
960000
unkown
page readonly
2DB0000
trusted library allocation
page read and write
1147000
heap
page read and write
78FE000
stack
page read and write
10C0000
trusted library allocation
page read and write
2D82000
trusted library allocation
page read and write
5766000
heap
page read and write
5460000
trusted library section
page read and write
628A000
trusted library allocation
page read and write
3D01000
trusted library allocation
page read and write
5220000
trusted library allocation
page read and write
DDE000
heap
page read and write
10ED000
trusted library allocation
page execute and read and write
8ED0000
heap
page read and write
134E000
stack
page read and write
564F000
stack
page read and write
51B0000
trusted library allocation
page read and write
2AC0000
trusted library allocation
page read and write
5FEC000
heap
page read and write
F60000
heap
page read and write
5200000
heap
page read and write
76FE000
stack
page read and write
8E3C000
stack
page read and write
10E0000
trusted library allocation
page read and write
63CE000
unkown
page read and write
2D4B000
stack
page read and write
668F000
stack
page read and write
2CF0000
heap
page read and write
DF7000
heap
page read and write
5665000
trusted library allocation
page read and write
F00000
heap
page read and write
2C9D000
trusted library allocation
page read and write
2ACB000
trusted library allocation
page execute and read and write
2D54000
trusted library allocation
page read and write
316B000
heap
page read and write
57A3000
heap
page read and write
5690000
trusted library allocation
page read and write
DEF000
heap
page read and write
658E000
stack
page read and write
5490000
heap
page read and write
2AE0000
trusted library allocation
page read and write
5290000
heap
page read and write
51BB000
trusted library allocation
page read and write
62F0000
trusted library allocation
page read and write
2DA0000
trusted library allocation
page read and write
2BE0000
trusted library allocation
page read and write
2DE0000
heap
page read and write
2B2E000
stack
page read and write
638E000
unkown
page read and write
5F40000
trusted library allocation
page read and write
962000
unkown
page readonly
51C2000
trusted library allocation
page read and write
AA9000
stack
page read and write
51CA000
trusted library allocation
page read and write
64CE000
stack
page read and write
E50000
heap
page read and write
14F0000
heap
page read and write
11FD000
trusted library allocation
page execute and read and write
F3D000
heap
page read and write
344C000
trusted library allocation
page read and write
E05000
heap
page read and write
5DF0000
trusted library allocation
page execute and read and write
9AEE000
stack
page read and write
74FE000
stack
page read and write
70411000
unkown
page execute read
F75000
heap
page read and write
2BD0000
trusted library allocation
page execute and read and write
79FF000
stack
page read and write
128E000
stack
page read and write
130E000
stack
page read and write
F70000
heap
page read and write
5DAB000
stack
page read and write
118E000
stack
page read and write
5210000
trusted library allocation
page read and write
2D6E000
trusted library allocation
page read and write
12CE000
stack
page read and write
57C9000
trusted library allocation
page read and write
1107000
trusted library allocation
page execute and read and write
10BF000
stack
page read and write
There are 272 hidden memdumps, click here to show them.