Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
c0evVb15Q1.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\server.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\c0evVb15Q1.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\c0evVb15Q1.exe
|
"C:\Users\user\Desktop\c0evVb15Q1.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\server.exe
|
"C:\Users\user\AppData\Roaming\server.exe"
|
|
|
|
C:\Windows\SysWOW64\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
x555hd.ddns.net
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
x555hd.ddns.net
|
197.202.219.104
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
197.202.219.104
|
x555hd.ddns.net
|
Algeria
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
|
|
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\8357fcac226b59edf02cf5db0a407b2c
|
[kl]
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F01000
|
trusted library allocation
|
page read and write
|
|
|
|
4F90000
|
trusted library section
|
page read and write
|
|
|
|
2E31000
|
trusted library allocation
|
page read and write
|
|
|
|
5731000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
5A1E000
|
stack
|
page read and write
|
||
|
5721000
|
heap
|
page read and write
|
||
|
125E000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
125F000
|
heap
|
page read and write
|
||
|
52C9000
|
stack
|
page read and write
|
||
|
130C000
|
heap
|
page read and write
|
||
|
12A2000
|
heap
|
page read and write
|
||
|
109A000
|
trusted library allocation
|
page execute and read and write
|
||
|
56FF000
|
stack
|
page read and write
|
||
|
CEB000
|
stack
|
page read and write
|
||
|
130D000
|
heap
|
page read and write
|
||
|
CF9000
|
stack
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
E40000
|
heap
|
page read and write
|
||
|
125A000
|
heap
|
page read and write
|
||
|
1309000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
5720000
|
trusted library allocation
|
page execute and read and write
|
||
|
12B6000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
12BE000
|
heap
|
page read and write
|
||
|
BC8000
|
heap
|
page read and write
|
||
|
577E000
|
stack
|
page read and write
|
||
|
1227000
|
heap
|
page read and write
|
||
|
ED0000
|
heap
|
page execute and read and write
|
||
|
12C2000
|
heap
|
page read and write
|
||
|
12B8000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
F52000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FA00000
|
trusted library allocation
|
page execute and read and write
|
||
|
F77000
|
trusted library allocation
|
page execute and read and write
|
||
|
124C000
|
heap
|
page read and write
|
||
|
12B3000
|
heap
|
page read and write
|
||
|
12AE000
|
heap
|
page read and write
|
||
|
7FB000
|
stack
|
page read and write
|
||
|
591E000
|
stack
|
page read and write
|
||
|
5721000
|
heap
|
page read and write
|
||
|
E30000
|
heap
|
page read and write
|
||
|
5190000
|
trusted library allocation
|
page read and write
|
||
|
58A0000
|
heap
|
page read and write
|
||
|
12E1000
|
heap
|
page read and write
|
||
|
CF6000
|
stack
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
12A3000
|
heap
|
page read and write
|
||
|
11D0000
|
trusted library allocation
|
page read and write
|
||
|
F9B000
|
trusted library allocation
|
page execute and read and write
|
||
|
11C0000
|
heap
|
page read and write
|
||
|
1233000
|
heap
|
page read and write
|
||
|
DE4000
|
stack
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
125A000
|
heap
|
page read and write
|
||
|
4F2E000
|
stack
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
125D000
|
heap
|
page read and write
|
||
|
DDE000
|
stack
|
page read and write
|
||
|
BCE000
|
heap
|
page read and write
|
||
|
F7A000
|
trusted library allocation
|
page execute and read and write
|
||
|
750000
|
unkown
|
page readonly
|
||
|
2BA0000
|
heap
|
page read and write
|
||
|
12B7000
|
heap
|
page read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
3E31000
|
trusted library allocation
|
page read and write
|
||
|
752000
|
unkown
|
page readonly
|
||
|
1306000
|
heap
|
page read and write
|
||
|
5732000
|
heap
|
page read and write
|
||
|
12BB000
|
heap
|
page read and write
|
||
|
573A000
|
heap
|
page read and write
|
||
|
12BC000
|
heap
|
page read and write
|
||
|
12AA000
|
heap
|
page read and write
|
||
|
12AA000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
5731000
|
heap
|
page read and write
|
||
|
50B0000
|
heap
|
page read and write
|
||
|
11C6000
|
heap
|
page read and write
|
||
|
4FDC000
|
stack
|
page read and write
|
||
|
1302000
|
heap
|
page read and write
|
||
|
12AF000
|
heap
|
page read and write
|
||
|
12AA000
|
heap
|
page read and write
|
||
|
127F000
|
heap
|
page read and write
|
||
|
1223000
|
heap
|
page read and write
|
||
|
1280000
|
heap
|
page read and write
|
||
|
127F000
|
heap
|
page read and write
|
||
|
50E0000
|
heap
|
page read and write
|
||
|
1261000
|
heap
|
page read and write
|
||
|
10B0000
|
trusted library allocation
|
page read and write
|
||
|
12B3000
|
heap
|
page read and write
|
||
|
BE6000
|
heap
|
page read and write
|
||
|
108C000
|
trusted library allocation
|
page execute and read and write
|
||
|
12AB000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
12BE000
|
heap
|
page read and write
|
||
|
54FF000
|
stack
|
page read and write
|
||
|
BBE000
|
stack
|
page read and write
|
||
|
1058000
|
heap
|
page read and write
|
||
|
BE8000
|
heap
|
page read and write
|
||
|
567E000
|
stack
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
5731000
|
heap
|
page read and write
|
||
|
553E000
|
stack
|
page read and write
|
||
|
5330000
|
unclassified section
|
page read and write
|
||
|
12BE000
|
heap
|
page read and write
|
||
|
525C000
|
stack
|
page read and write
|
||
|
120E000
|
stack
|
page read and write
|
||
|
1050000
|
trusted library allocation
|
page read and write
|
||
|
12BB000
|
heap
|
page read and write
|
||
|
5700000
|
heap
|
page read and write
|
||
|
563E000
|
stack
|
page read and write
|
||
|
9EA000
|
stack
|
page read and write
|
||
|
2FA2000
|
trusted library allocation
|
page read and write
|
||
|
2E98000
|
trusted library allocation
|
page read and write
|
||
|
126C000
|
heap
|
page read and write
|
||
|
F62000
|
trusted library allocation
|
page execute and read and write
|
||
|
D50000
|
heap
|
page read and write
|
||
|
12AE000
|
heap
|
page read and write
|
||
|
12B9000
|
heap
|
page read and write
|
||
|
51C0000
|
heap
|
page read and write
|
||
|
12A3000
|
heap
|
page read and write
|
||
|
1060000
|
heap
|
page read and write
|
||
|
1280000
|
heap
|
page read and write
|
||
|
2F7E000
|
trusted library allocation
|
page read and write
|
||
|
1233000
|
heap
|
page read and write
|
||
|
4EBE000
|
stack
|
page read and write
|
||
|
F5A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1256000
|
heap
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
57BC000
|
stack
|
page read and write
|
||
|
126D000
|
heap
|
page read and write
|
||
|
3051000
|
trusted library allocation
|
page read and write
|
||
|
121A000
|
heap
|
page read and write
|
||
|
1305000
|
heap
|
page read and write
|
||
|
EE0000
|
heap
|
page read and write
|
||
|
12AE000
|
heap
|
page read and write
|
||
|
1282000
|
heap
|
page read and write
|
||
|
527E000
|
stack
|
page read and write
|
||
|
C36000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
12A4000
|
heap
|
page read and write
|
||
|
12B5000
|
heap
|
page read and write
|
||
|
4F08000
|
trusted library allocation
|
page read and write
|
||
|
11AF000
|
stack
|
page read and write
|
||
|
1233000
|
heap
|
page read and write
|
||
|
12A8000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
12B7000
|
heap
|
page read and write
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
2B9F000
|
stack
|
page read and write
|
||
|
FB0000
|
heap
|
page read and write
|
||
|
11E0000
|
heap
|
page execute and read and write
|
||
|
DEB000
|
stack
|
page read and write
|
||
|
58BC000
|
stack
|
page read and write
|
||
|
127F000
|
heap
|
page read and write
|
||
|
5727000
|
heap
|
page read and write
|
||
|
C6B000
|
heap
|
page read and write
|
||
|
1261000
|
heap
|
page read and write
|
||
|
5283000
|
heap
|
page read and write
|
||
|
13BE000
|
stack
|
page read and write
|
||
|
100E000
|
stack
|
page read and write
|
||
|
1072000
|
trusted library allocation
|
page execute and read and write
|
||
|
F66000
|
trusted library allocation
|
page execute and read and write
|
||
|
12A3000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
1267000
|
heap
|
page read and write
|
||
|
126C000
|
heap
|
page read and write
|
||
|
12BB000
|
heap
|
page read and write
|
||
|
F97000
|
trusted library allocation
|
page execute and read and write
|
||
|
5280000
|
heap
|
page read and write
|
||
|
5731000
|
heap
|
page read and write
|
||
|
125A000
|
heap
|
page read and write
|
||
|
1082000
|
trusted library allocation
|
page execute and read and write
|
||
|
5739000
|
heap
|
page read and write
|
||
|
107A000
|
trusted library allocation
|
page execute and read and write
|
||
|
12BF000
|
heap
|
page read and write
|
||
|
E8F000
|
stack
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
2A9E000
|
stack
|
page read and write
|
||
|
53FE000
|
stack
|
page read and write
|
||
|
12BC000
|
heap
|
page read and write
|
||
|
EAF000
|
stack
|
page read and write
|
||
|
C02000
|
heap
|
page read and write
|
||
|
521B000
|
stack
|
page read and write
|
||
|
12A5000
|
heap
|
page read and write
|
||
|
1022000
|
heap
|
page read and write
|
||
|
4ED0000
|
heap
|
page read and write
|
||
|
10FE000
|
stack
|
page read and write
|
||
|
F82000
|
trusted library allocation
|
page execute and read and write
|
||
|
12B1000
|
heap
|
page read and write
|
||
|
572E000
|
heap
|
page read and write
|
||
|
125A000
|
heap
|
page read and write
|
||
|
12A7000
|
heap
|
page read and write
|
||
|
12A2000
|
heap
|
page read and write
|
||
|
12A5000
|
heap
|
page read and write
|
||
|
51DC000
|
stack
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
FBE000
|
heap
|
page read and write
|
||
|
1307000
|
heap
|
page read and write
|
||
|
C5E000
|
heap
|
page read and write
|
||
|
12A5000
|
heap
|
page read and write
|
||
|
F8A000
|
trusted library allocation
|
page execute and read and write
|
||
|
150E000
|
stack
|
page read and write
|
||
|
13C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
E96000
|
heap
|
page read and write
|
||
|
DEE000
|
stack
|
page read and write
|
||
|
1040000
|
heap
|
page read and write
|
||
|
2AEE000
|
stack
|
page read and write
|
||
|
50DE000
|
stack
|
page read and write
|
||
|
12B9000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
10B7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
1080000
|
trusted library allocation
|
page read and write
|
||
|
5731000
|
heap
|
page read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
5726000
|
heap
|
page read and write
|
||
|
58B0000
|
heap
|
page read and write
|
||
|
130E000
|
heap
|
page read and write
|
||
|
108A000
|
trusted library allocation
|
page execute and read and write
|
||
|
F60000
|
trusted library allocation
|
page read and write
|
||
|
12BF000
|
heap
|
page read and write
|
||
|
117E000
|
unkown
|
page read and write
|
||
|
12BC000
|
heap
|
page read and write
|
||
|
1540000
|
heap
|
page read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
12AE000
|
heap
|
page read and write
|
||
|
126A000
|
heap
|
page read and write
|
||
|
5270000
|
trusted library allocation
|
page execute and read and write
|
||
|
12B3000
|
heap
|
page read and write
|
||
|
52BE000
|
stack
|
page read and write
|
||
|
1267000
|
heap
|
page read and write
|
||
|
1301000
|
heap
|
page read and write
|
||
|
EEE000
|
stack
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
1263000
|
heap
|
page read and write
|
||
|
573C000
|
heap
|
page read and write
|
||
|
5100000
|
trusted library allocation
|
page read and write
|
||
|
766000
|
unkown
|
page readonly
|
||
|
FBA000
|
heap
|
page read and write
|
||
|
AF6000
|
stack
|
page read and write
|
||
|
12BE000
|
heap
|
page read and write
|
||
|
F92000
|
trusted library allocation
|
page read and write
|
||
|
125C000
|
heap
|
page read and write
|
||
|
1045000
|
heap
|
page read and write
|
||
|
12BC000
|
heap
|
page read and write
|
||
|
517E000
|
stack
|
page read and write
|
||
|
FEF000
|
heap
|
page read and write
|
||
|
4FA0000
|
trusted library allocation
|
page read and write
|
||
|
1281000
|
heap
|
page read and write
|
||
|
12A7000
|
heap
|
page read and write
|
||
|
130E000
|
heap
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
12B8000
|
heap
|
page read and write
|
||
|
12B5000
|
heap
|
page read and write
|
||
|
12AE000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
1249000
|
heap
|
page read and write
|
||
|
10A2000
|
trusted library allocation
|
page execute and read and write
|
||
|
140F000
|
unkown
|
page read and write
|
||
|
3F01000
|
trusted library allocation
|
page read and write
|
||
|
12A2000
|
heap
|
page read and write
|
||
|
12A9000
|
heap
|
page read and write
|
||
|
5732000
|
heap
|
page read and write
|
||
|
126E000
|
heap
|
page read and write
|
||
|
125D000
|
heap
|
page read and write
|
||
|
12E8000
|
heap
|
page read and write
|
||
|
130D000
|
heap
|
page read and write
|
||
|
E90000
|
heap
|
page read and write
|
||
|
5880000
|
heap
|
page read and write
|
||
|
F40000
|
trusted library allocation
|
page read and write
|
||
|
EE5000
|
heap
|
page read and write
|
||
|
126E000
|
heap
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
5110000
|
trusted library allocation
|
page execute and read and write
|
||
|
12B7000
|
heap
|
page read and write
|
||
|
10BB000
|
trusted library allocation
|
page execute and read and write
|
||
|
125D000
|
heap
|
page read and write
|
||
|
1210000
|
heap
|
page read and write
|
||
|
F6A000
|
trusted library allocation
|
page execute and read and write
|
||
|
5731000
|
heap
|
page read and write
|
||
|
125A000
|
heap
|
page read and write
|
||
|
1306000
|
heap
|
page read and write
|
||
|
1060000
|
heap
|
page read and write
|
||
|
5722000
|
heap
|
page read and write
|
||
|
CD5000
|
heap
|
page read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
C29000
|
heap
|
page read and write
|
||
|
53BE000
|
stack
|
page read and write
|
||
|
5260000
|
trusted library allocation
|
page read and write
|
||
|
126C000
|
heap
|
page read and write
|
There are 288 hidden memdumps, click here to show them.