Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
AlCsIOd0pd.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
C:\ProgramData\MPGPH131\MPGPH131.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\rage131MP.tmp
|
ASCII text, with no line terminators
|
modified
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\AlCsIOd0pd.exe
|
"C:\Users\user\Desktop\AlCsIOd0pd.exe"
|
||
C:\Windows\SysWOW64\schtasks.exe
|
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
|
||
C:\Windows\SysWOW64\schtasks.exe
|
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
|
||
C:\ProgramData\MPGPH131\MPGPH131.exe
|
C:\ProgramData\MPGPH131\MPGPH131.exe
|
||
C:\ProgramData\MPGPH131\MPGPH131.exe
|
C:\ProgramData\MPGPH131\MPGPH131.exe
|
||
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
|
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
|
||
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
|
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
|
unknown
|
||
https://t.me/RiseProSUPPORTX
|
unknown
|
||
http://www.winimage.com/zLibDll
|
unknown
|
||
https://t.me/RiseProSUPPORT
|
unknown
|
||
https://ipinfo.io/
|
unknown
|
||
https://t.me/RiseProSUPPORTB
|
unknown
|
||
https://t.me/RiseProSUPPORToE
|
unknown
|
||
https://www.maxmind.com/en/locate-my-ip-address
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
77.91.77.66
|
unknown
|
Russian Federation
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
RageMP131
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
55D000
|
unkown
|
page readonly
|
||
D20000
|
direct allocation
|
page read and write
|
||
D36000
|
heap
|
page read and write
|
||
FDF000
|
stack
|
page read and write
|
||
76E000
|
unkown
|
page execute and read and write
|
||
D86000
|
heap
|
page read and write
|
||
774000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
778000
|
unkown
|
page execute and read and write
|
||
73D000
|
unkown
|
page execute and read and write
|
||
739000
|
unkown
|
page execute and read and write
|
||
762000
|
unkown
|
page execute and read and write
|
||
D3A000
|
heap
|
page read and write
|
||
2930000
|
heap
|
page read and write
|
||
596000
|
unkown
|
page read and write
|
||
DA2000
|
heap
|
page read and write
|
||
741000
|
unkown
|
page execute and read and write
|
||
747000
|
unkown
|
page execute and read and write
|
||
D62000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
CD0000
|
direct allocation
|
page read and write
|
||
77A000
|
unkown
|
page execute and read and write
|
||
4C7E000
|
stack
|
page read and write
|
||
772000
|
unkown
|
page execute and read and write
|
||
735000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
980000
|
unkown
|
page execute read
|
||
762000
|
unkown
|
page execute and read and write
|
||
2840000
|
direct allocation
|
page read and write
|
||
2840000
|
direct allocation
|
page read and write
|
||
C97000
|
heap
|
page read and write
|
||
E8F000
|
heap
|
page read and write
|
||
980000
|
unkown
|
page execute read
|
||
757000
|
unkown
|
page execute and read and write
|
||
D20000
|
heap
|
page read and write
|
||
E6F000
|
heap
|
page read and write
|
||
28A0000
|
direct allocation
|
page read and write
|
||
980000
|
unkown
|
page execute read
|
||
598000
|
unkown
|
page execute and read and write
|
||
2A3E000
|
stack
|
page read and write
|
||
774000
|
unkown
|
page execute and read and write
|
||
C65000
|
heap
|
page read and write
|
||
C20000
|
direct allocation
|
page read and write
|
||
C25000
|
heap
|
page read and write
|
||
D49000
|
heap
|
page read and write
|
||
D7C000
|
heap
|
page read and write
|
||
2840000
|
direct allocation
|
page read and write
|
||
585000
|
unkown
|
page read and write
|
||
76A000
|
unkown
|
page execute and read and write
|
||
C56000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
C30000
|
heap
|
page read and write
|
||
73B000
|
unkown
|
page execute and read and write
|
||
73B000
|
unkown
|
page execute and read and write
|
||
4D7F000
|
stack
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
D20000
|
direct allocation
|
page read and write
|
||
596000
|
unkown
|
page read and write
|
||
9B000
|
stack
|
page read and write
|
||
2820000
|
heap
|
page read and write
|
||
E38000
|
heap
|
page read and write
|
||
58A000
|
unkown
|
page readonly
|
||
2850000
|
direct allocation
|
page read and write
|
||
CB0000
|
direct allocation
|
page read and write
|
||
58A000
|
unkown
|
page readonly
|
||
585000
|
unkown
|
page read and write
|
||
7B0000
|
unkown
|
page execute and read and write
|
||
19C000
|
stack
|
page read and write
|
||
4C5E000
|
stack
|
page read and write
|
||
776000
|
unkown
|
page execute and read and write
|
||
4DBE000
|
stack
|
page read and write
|
||
76E000
|
unkown
|
page execute and read and write
|
||
58A000
|
unkown
|
page readonly
|
||
400000
|
unkown
|
page readonly
|
||
58A000
|
unkown
|
page readonly
|
||
C97000
|
heap
|
page read and write
|
||
778000
|
unkown
|
page execute and read and write
|
||
735000
|
unkown
|
page execute and read and write
|
||
D10000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
CB0000
|
heap
|
page read and write
|
||
2AF0000
|
heap
|
page read and write
|
||
77A000
|
unkown
|
page execute and read and write
|
||
E7C000
|
heap
|
page read and write
|
||
4CFE000
|
stack
|
page read and write
|
||
C45000
|
heap
|
page read and write
|
||
747000
|
unkown
|
page execute and read and write
|
||
E75000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
D21000
|
heap
|
page read and write
|
||
E97000
|
heap
|
page read and write
|
||
585000
|
unkown
|
page write copy
|
||
73D000
|
unkown
|
page execute and read and write
|
||
762000
|
unkown
|
page execute and read and write
|
||
747000
|
unkown
|
page execute and read and write
|
||
D51000
|
heap
|
page read and write
|
||
778000
|
unkown
|
page execute and read and write
|
||
401000
|
unkown
|
page execute read
|
||
73B000
|
unkown
|
page execute and read and write
|
||
401000
|
unkown
|
page execute read
|
||
D81000
|
heap
|
page read and write
|
||
75E000
|
unkown
|
page execute and read and write
|
||
9B000
|
stack
|
page read and write
|
||
585000
|
unkown
|
page write copy
|
||
776000
|
unkown
|
page execute and read and write
|
||
74B000
|
unkown
|
page execute and read and write
|
||
74B000
|
unkown
|
page execute and read and write
|
||
C8F000
|
heap
|
page read and write
|
||
739000
|
unkown
|
page execute and read and write
|
||
C55000
|
heap
|
page read and write
|
||
D30000
|
heap
|
page read and write
|
||
980000
|
unkown
|
page execute read
|
||
1F0000
|
heap
|
page read and write
|
||
757000
|
unkown
|
page execute and read and write
|
||
739000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
401000
|
unkown
|
page execute read
|
||
CD0000
|
direct allocation
|
page read and write
|
||
29F0000
|
heap
|
page read and write
|
||
772000
|
unkown
|
page execute and read and write
|
||
4DDE000
|
stack
|
page read and write
|
||
73B000
|
unkown
|
page execute and read and write
|
||
772000
|
unkown
|
page execute and read and write
|
||
786000
|
unkown
|
page execute and read and write
|
||
75E000
|
unkown
|
page execute and read and write
|
||
2944000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
C78000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
D00000
|
direct allocation
|
page read and write
|
||
7B0000
|
unkown
|
page execute and read and write
|
||
735000
|
unkown
|
page execute and read and write
|
||
C61000
|
heap
|
page read and write
|
||
293E000
|
stack
|
page read and write
|
||
D88000
|
heap
|
page read and write
|
||
73D000
|
unkown
|
page execute and read and write
|
||
401000
|
unkown
|
page execute read
|
||
D3F000
|
heap
|
page read and write
|
||
CD0000
|
direct allocation
|
page read and write
|
||
76A000
|
unkown
|
page execute and read and write
|
||
733000
|
unkown
|
page execute and read and write
|
||
E7F000
|
heap
|
page read and write
|
||
786000
|
unkown
|
page execute and read and write
|
||
2970000
|
direct allocation
|
page read and write
|
||
D3A000
|
heap
|
page read and write
|
||
D4C000
|
heap
|
page read and write
|
||
7B0000
|
unkown
|
page execute and read and write
|
||
737000
|
unkown
|
page execute and read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
739000
|
unkown
|
page execute and read and write
|
||
D75000
|
heap
|
page read and write
|
||
19C000
|
stack
|
page read and write
|
||
BF0000
|
heap
|
page read and write
|
||
757000
|
unkown
|
page execute and read and write
|
||
FAF000
|
stack
|
page read and write
|
||
1F5000
|
heap
|
page read and write
|
||
75C000
|
unkown
|
page execute and read and write
|
||
980000
|
unkown
|
page execute read
|
||
CED000
|
heap
|
page read and write
|
||
55D000
|
unkown
|
page readonly
|
||
D5B000
|
heap
|
page read and write
|
||
75E000
|
unkown
|
page execute and read and write
|
||
759000
|
unkown
|
page execute and read and write
|
||
747000
|
unkown
|
page execute and read and write
|
||
76E000
|
unkown
|
page execute and read and write
|
||
737000
|
unkown
|
page execute and read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
9B000
|
stack
|
page read and write
|
||
E2F000
|
stack
|
page read and write
|
||
BF0000
|
heap
|
page read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
9B000
|
stack
|
page read and write
|
||
4A52000
|
heap
|
page read and write
|
||
733000
|
unkown
|
page execute and read and write
|
||
D25000
|
heap
|
page read and write
|
||
585000
|
unkown
|
page write copy
|
||
75C000
|
unkown
|
page execute and read and write
|
||
77A000
|
unkown
|
page execute and read and write
|
||
733000
|
unkown
|
page execute and read and write
|
||
596000
|
unkown
|
page read and write
|
||
C00000
|
heap
|
page read and write
|
||
CE0000
|
heap
|
page read and write
|
||
75E000
|
unkown
|
page execute and read and write
|
||
D79000
|
heap
|
page read and write
|
||
58A000
|
unkown
|
page readonly
|
||
596000
|
unkown
|
page write copy
|
||
73D000
|
unkown
|
page execute and read and write
|
||
76C000
|
unkown
|
page execute and read and write
|
||
757000
|
unkown
|
page execute and read and write
|
||
19C000
|
stack
|
page read and write
|
||
585000
|
unkown
|
page read and write
|
||
731000
|
unkown
|
page execute and read and write
|
||
741000
|
unkown
|
page execute and read and write
|
||
737000
|
unkown
|
page execute and read and write
|
||
596000
|
unkown
|
page read and write
|
||
D10000
|
heap
|
page read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
778000
|
unkown
|
page execute and read and write
|
||
770000
|
unkown
|
page execute and read and write
|
||
4EBF000
|
stack
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
585000
|
unkown
|
page write copy
|
||
786000
|
unkown
|
page execute and read and write
|
||
DA2000
|
heap
|
page read and write
|
||
774000
|
unkown
|
page execute and read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
58A000
|
unkown
|
page readonly
|
||
19C000
|
stack
|
page read and write
|
||
D64000
|
heap
|
page read and write
|
||
C00000
|
heap
|
page read and write
|
||
75E000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
400000
|
unkown
|
page readonly
|
||
757000
|
unkown
|
page execute and read and write
|
||
E30000
|
heap
|
page read and write
|
||
735000
|
unkown
|
page execute and read and write
|
||
768000
|
unkown
|
page execute and read and write
|
||
9B000
|
stack
|
page read and write
|
||
D6D000
|
heap
|
page read and write
|
||
E3E000
|
stack
|
page read and write
|
||
786000
|
unkown
|
page execute and read and write
|
||
2890000
|
heap
|
page read and write
|
||
759000
|
unkown
|
page execute and read and write
|
||
58A000
|
unkown
|
page readonly
|
||
759000
|
unkown
|
page execute and read and write
|
||
2820000
|
direct allocation
|
page read and write
|
||
C76000
|
heap
|
page read and write
|
||
75C000
|
unkown
|
page execute and read and write
|
||
D1A000
|
heap
|
page read and write
|
||
D83000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
741000
|
unkown
|
page execute and read and write
|
||
CD0000
|
direct allocation
|
page read and write
|
||
772000
|
unkown
|
page execute and read and write
|
||
C00000
|
heap
|
page read and write
|
||
D1B000
|
heap
|
page read and write
|
||
741000
|
unkown
|
page execute and read and write
|
||
D00000
|
heap
|
page read and write
|
||
E97000
|
heap
|
page read and write
|
||
774000
|
unkown
|
page execute and read and write
|
||
76C000
|
unkown
|
page execute and read and write
|
||
2830000
|
heap
|
page read and write
|
||
19C000
|
stack
|
page read and write
|
||
E77000
|
heap
|
page read and write
|
||
D81000
|
heap
|
page read and write
|
||
D2F000
|
heap
|
page read and write
|
||
E6E000
|
stack
|
page read and write
|
||
596000
|
unkown
|
page write copy
|
||
58A000
|
unkown
|
page readonly
|
||
29E0000
|
heap
|
page read and write
|
||
D72000
|
heap
|
page read and write
|
||
292E000
|
stack
|
page read and write
|
||
D16000
|
heap
|
page read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
76C000
|
unkown
|
page execute and read and write
|
||
D9A000
|
heap
|
page read and write
|
||
737000
|
unkown
|
page execute and read and write
|
||
778000
|
unkown
|
page execute and read and write
|
||
73F000
|
unkown
|
page execute and read and write
|
||
770000
|
unkown
|
page execute and read and write
|
||
C20000
|
heap
|
page read and write
|
||
980000
|
unkown
|
page execute read
|
||
596000
|
unkown
|
page write copy
|
||
770000
|
unkown
|
page execute and read and write
|
||
76A000
|
unkown
|
page execute and read and write
|
||
4EDF000
|
stack
|
page read and write
|
||
4CEE000
|
stack
|
page read and write
|
||
73B000
|
unkown
|
page execute and read and write
|
||
293E000
|
stack
|
page read and write
|
||
76A000
|
unkown
|
page execute and read and write
|
||
CEA000
|
heap
|
page read and write
|
||
D7F000
|
heap
|
page read and write
|
||
C40000
|
heap
|
page read and write
|
||
585000
|
unkown
|
page read and write
|
||
585000
|
unkown
|
page read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
731000
|
unkown
|
page execute and read and write
|
||
2960000
|
heap
|
page read and write
|
||
CD0000
|
direct allocation
|
page read and write
|
||
77A000
|
unkown
|
page execute and read and write
|
||
2850000
|
direct allocation
|
page read and write
|
||
598000
|
unkown
|
page execute and read and write
|
||
731000
|
unkown
|
page execute and read and write
|
||
733000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
4971000
|
heap
|
page read and write
|
||
2830000
|
direct allocation
|
page read and write
|
||
D3E000
|
heap
|
page read and write
|
||
585000
|
unkown
|
page write copy
|
||
786000
|
unkown
|
page execute and read and write
|
||
E8C000
|
heap
|
page read and write
|
||
73F000
|
unkown
|
page execute and read and write
|
||
28F0000
|
heap
|
page read and write
|
||
C6F000
|
heap
|
page read and write
|
||
76E000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
768000
|
unkown
|
page execute and read and write
|
||
768000
|
unkown
|
page execute and read and write
|
||
4B00000
|
heap
|
page read and write
|
||
2820000
|
heap
|
page read and write
|
||
598000
|
unkown
|
page execute and read and write
|
||
770000
|
unkown
|
page execute and read and write
|
||
76C000
|
unkown
|
page execute and read and write
|
||
731000
|
unkown
|
page execute and read and write
|
||
C50000
|
heap
|
page read and write
|
||
29F0000
|
heap
|
page read and write
|
||
73F000
|
unkown
|
page execute and read and write
|
||
C7F000
|
heap
|
page read and write
|
||
4A03000
|
heap
|
page read and write
|
||
980000
|
unkown
|
page execute read
|
||
598000
|
unkown
|
page execute and read and write
|
||
2940000
|
direct allocation
|
page read and write
|
||
768000
|
unkown
|
page execute and read and write
|
||
598000
|
unkown
|
page execute and read and write
|
||
401000
|
unkown
|
page execute read
|
||
D6A000
|
heap
|
page read and write
|
||
596000
|
unkown
|
page write copy
|
||
776000
|
unkown
|
page execute and read and write
|
||
2A40000
|
heap
|
page read and write
|
||
737000
|
unkown
|
page execute and read and write
|
||
762000
|
unkown
|
page execute and read and write
|
||
58A000
|
unkown
|
page readonly
|
||
D51000
|
heap
|
page read and write
|
||
D34000
|
heap
|
page read and write
|
||
596000
|
unkown
|
page write copy
|
||
772000
|
unkown
|
page execute and read and write
|
||
76C000
|
unkown
|
page execute and read and write
|
||
73D000
|
unkown
|
page execute and read and write
|
||
401000
|
unkown
|
page execute read
|
||
596000
|
unkown
|
page read and write
|
||
74B000
|
unkown
|
page execute and read and write
|
||
D81000
|
heap
|
page read and write
|
||
739000
|
unkown
|
page execute and read and write
|
||
2840000
|
direct allocation
|
page read and write
|
||
735000
|
unkown
|
page execute and read and write
|
||
D47000
|
heap
|
page read and write
|
||
D0E000
|
stack
|
page read and write
|
||
733000
|
unkown
|
page execute and read and write
|
||
C4E000
|
stack
|
page read and write
|
||
73F000
|
unkown
|
page execute and read and write
|
||
759000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
980000
|
unkown
|
page execute read
|
||
C00000
|
heap
|
page read and write
|
||
C10000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
4D9F000
|
stack
|
page read and write
|
||
731000
|
unkown
|
page execute and read and write
|
||
741000
|
unkown
|
page execute and read and write
|
||
4A09000
|
heap
|
page read and write
|
||
293E000
|
stack
|
page read and write
|
||
76E000
|
unkown
|
page execute and read and write
|
||
980000
|
unkown
|
page execute read
|
||
58A000
|
unkown
|
page readonly
|
||
776000
|
unkown
|
page execute and read and write
|
||
D1E000
|
heap
|
page read and write
|
||
747000
|
unkown
|
page execute and read and write
|
||
D8B000
|
heap
|
page read and write
|
||
7B0000
|
unkown
|
page execute and read and write
|
||
BF0000
|
heap
|
page read and write
|
||
F6F000
|
stack
|
page read and write
|
||
768000
|
unkown
|
page execute and read and write
|
||
F3F000
|
stack
|
page read and write
|
||
C20000
|
heap
|
page read and write
|
||
D43000
|
heap
|
page read and write
|
||
7B0000
|
unkown
|
page execute and read and write
|
||
74B000
|
unkown
|
page execute and read and write
|
||
D8F000
|
heap
|
page read and write
|
||
776000
|
unkown
|
page execute and read and write
|
||
762000
|
unkown
|
page execute and read and write
|
||
400000
|
unkown
|
page readonly
|
||
774000
|
unkown
|
page execute and read and write
|
||
55D000
|
unkown
|
page readonly
|
||
4C9E000
|
stack
|
page read and write
|
||
C8E000
|
stack
|
page read and write
|
||
74B000
|
unkown
|
page execute and read and write
|
||
E61000
|
heap
|
page read and write
|
||
2A3E000
|
stack
|
page read and write
|
||
BF0000
|
heap
|
page read and write
|
||
CD0000
|
direct allocation
|
page read and write
|
||
D64000
|
heap
|
page read and write
|
||
292E000
|
stack
|
page read and write
|
||
E66000
|
heap
|
page read and write
|
||
C37000
|
heap
|
page read and write
|
||
770000
|
unkown
|
page execute and read and write
|
||
55D000
|
unkown
|
page readonly
|
||
D51000
|
heap
|
page read and write
|
||
759000
|
unkown
|
page execute and read and write
|
||
73F000
|
unkown
|
page execute and read and write
|
||
980000
|
unkown
|
page execute read
|
||
77A000
|
unkown
|
page execute and read and write
|
||
D2B000
|
heap
|
page read and write
|
||
75C000
|
unkown
|
page execute and read and write
|
||
75C000
|
unkown
|
page execute and read and write
|
||
294F000
|
heap
|
page read and write
|
||
76A000
|
unkown
|
page execute and read and write
|
There are 387 hidden memdumps, click here to show them.