IOC Report
Client.exe

loading gif

Files

File Path
Type
Category
Malicious
Client.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Client.exe
"C:\Users\user\Desktop\Client.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
torenta2.vpndns.net
malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
torenta2.vpndns.net
168.119.211.236
 malicious
bg.microsoft.map.fastly.net
199.232.214.172

IPs

IP
Domain
Country
Malicious
168.119.211.236
torenta2.vpndns.net
Germany
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3081000
trusted library allocation
page read and write
 malicious
CC2000
unkown
page readonly
 malicious
6460000
trusted library allocation
page read and write
2D82000
trusted library allocation
page read and write
5595000
heap
page read and write
2D70000
trusted library allocation
page read and write
2D7A000
trusted library allocation
page execute and read and write
2D54000
trusted library allocation
page read and write
311C000
trusted library allocation
page read and write
2D76000
trusted library allocation
page execute and read and write
5628000
heap
page read and write
666C000
stack
page read and write
598E000
stack
page read and write
158E000
stack
page read and write
2D53000
trusted library allocation
page execute and read and write
1207000
heap
page read and write
2D80000
trusted library allocation
page read and write
148E000
stack
page read and write
11E0000
heap
page read and write
1250000
heap
page read and write
2FF0000
heap
page read and write
67AE000
stack
page read and write
6226000
trusted library allocation
page read and write
2E90000
trusted library allocation
page execute and read and write
DC5000
heap
page read and write
652C000
stack
page read and write
12EF000
heap
page read and write
6F9E000
stack
page read and write
134E000
stack
page read and write
6229000
trusted library allocation
page read and write
5C4E000
stack
page read and write
FF670000
trusted library allocation
page execute and read and write
588E000
stack
page read and write
1283000
heap
page read and write
2D50000
trusted library allocation
page read and write
144E000
stack
page read and write
643E000
stack
page read and write
574D000
stack
page read and write
3010000
trusted library allocation
page read and write
64EF000
stack
page read and write
5590000
heap
page read and write
1210000
heap
page read and write
5FB1000
heap
page read and write
54FE000
stack
page read and write
73CFF000
unkown
page readonly
5646000
heap
page read and write
59CE000
stack
page read and write
2D40000
trusted library allocation
page read and write
CC0000
unkown
page readonly
12D2000
heap
page read and write
5550000
heap
page read and write
517D000
stack
page read and write
2DEE000
stack
page read and write
10F9000
stack
page read and write
682C000
stack
page read and write
629E000
stack
page read and write
2EA0000
heap
page read and write
3038000
trusted library allocation
page read and write
2D72000
trusted library allocation
page read and write
5ACE000
stack
page read and write
2FAE000
stack
page read and write
1253000
heap
page read and write
2D60000
trusted library allocation
page read and write
73CF6000
unkown
page readonly
68C0000
heap
page read and write
5E98000
heap
page read and write
DC0000
heap
page read and write
624B000
trusted library allocation
page read and write
6249000
trusted library allocation
page read and write
6235000
trusted library allocation
page read and write
5540000
heap
page execute and read and write
3070000
heap
page execute and read and write
2D5D000
trusted library allocation
page execute and read and write
5F2C000
heap
page read and write
73CE0000
unkown
page readonly
DF0000
heap
page read and write
67EE000
stack
page read and write
71DC000
stack
page read and write
5E90000
heap
page read and write
D6C000
stack
page read and write
11E7000
heap
page read and write
2FEC000
stack
page read and write
73CFD000
unkown
page read and write
5642000
heap
page read and write
4089000
trusted library allocation
page read and write
5634000
heap
page read and write
1200000
heap
page read and write
3030000
trusted library allocation
page read and write
68B0000
heap
page read and write
324E000
trusted library allocation
page read and write
4081000
trusted library allocation
page read and write
5D4F000
stack
page read and write
6204000
trusted library allocation
page read and write
2DA0000
trusted library allocation
page read and write
1245000
heap
page read and write
72DE000
stack
page read and write
6240000
trusted library allocation
page read and write
563E000
heap
page read and write
2D87000
trusted library allocation
page execute and read and write
6214000
trusted library allocation
page read and write
662D000
stack
page read and write
7350000
trusted library allocation
page execute and read and write
DE0000
heap
page read and write
553E000
stack
page read and write
676E000
stack
page read and write
121E000
heap
page read and write
64AD000
stack
page read and write
1218000
heap
page read and write
5EB0000
heap
page read and write
5F98000
heap
page read and write
2DF8000
trusted library allocation
page read and write
4087000
trusted library allocation
page read and write
73CE1000
unkown
page execute read
584E000
stack
page read and write
12E0000
heap
page read and write
2D8B000
trusted library allocation
page execute and read and write
6250000
trusted library allocation
page read and write
There are 107 hidden memdumps, click here to show them.