IOC Report
Build.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Build.exe
"C:\Users\user\Desktop\Build.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 6356 && choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\Build.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 6356
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
http://medical-m.gl.at.ply.gg:6677/IRemotePanel
147.185.221.16
https://icanhazip.com5https://wtfismyip.com/textChttp://bot.whatismyipaddress.com/3http://checkip.dy
unknown
http://tempuri.org/IRemotePanel/SendClientInfoResponse05
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
unknown
http://tempuri.org/IRemotePanel/GetTasksLR
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://tempuri.org/
unknown
http://tempuri.org/IRemotePanel/GetSettingsResponse05
unknown
http://tempuri.org/IRemotePanel/CompleteTaskLR
unknown
https://google.com/
unknown
http://tempuri.org/IRemotePanel/GetSettingsLR
unknown
http://tempuri.org/IRemotePanel/CompleteTaskResponse05
unknown
https://api.ipify.org
unknown
http://medical-m.gl.at.ply.gg
unknown
http://medical-m.gl.at.ply.gg:6677
unknown
http://tempuri.org/IRemotePanel/GetSettingsT
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing
unknown
http://tempuri.org/IRemotePanel/SendClientInfoLR
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
unknown
http://tempuri.org/IRemotePanel/GetTasksResponse05
unknown
http://checkip.amazonaws.com/)https://ipinfo.io/ip
unknown
http://tempuri.org/0
unknown
http://tempuri.org/IRemotePanel/
unknown
http://tempuri.org/IRemotePanel/GetSettings
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://schemas.xmlsoap.org/soap/actor/next
unknown
There are 16 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
15.164.165.52.in-addr.arpa
unknown
 malicious
medical-m.gl.at.ply.gg
147.185.221.16

IPs

IP
Domain
Country
Malicious
147.185.221.16
medical-m.gl.at.ply.gg
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2741000
trusted library allocation
page read and write
 malicious
322000
unkown
page readonly
 malicious
CD0000
trusted library allocation
page read and write
C52000
trusted library allocation
page read and write
5DCE000
stack
page read and write
33C0000
heap
page read and write
26DF000
stack
page read and write
4E70000
heap
page read and write
AAC000
heap
page read and write
C2E000
stack
page read and write
4C00000
trusted library allocation
page execute and read and write
2730000
heap
page execute and read and write
3DC000
stack
page read and write
294F000
stack
page read and write
A38000
heap
page read and write
510E000
stack
page read and write
A30000
heap
page read and write
C46000
trusted library allocation
page execute and read and write
659E000
stack
page read and write
3741000
trusted library allocation
page read and write
86E000
stack
page read and write
4CD0000
trusted library allocation
page read and write
4D2E000
stack
page read and write
2B48000
heap
page read and write
D30000
trusted library allocation
page read and write
646B000
heap
page read and write
33F6000
heap
page read and write
E30000
heap
page read and write
4C90000
trusted library allocation
page read and write
35C0000
heap
page read and write
A20000
trusted library allocation
page read and write
671E000
stack
page read and write
2DF0000
heap
page read and write
4BF0000
trusted library allocation
page read and write
282A000
trusted library allocation
page read and write
C30000
trusted library allocation
page read and write
820000
heap
page read and write
27EF000
trusted library allocation
page read and write
A72000
heap
page read and write
604E000
stack
page read and write
5ECE000
stack
page read and write
26EB000
trusted library allocation
page read and write
AEB000
heap
page read and write
4C60000
trusted library allocation
page execute and read and write
CE7000
heap
page read and write
33F7000
heap
page read and write
4C70000
trusted library allocation
page read and write
290E000
stack
page read and write
4CC0000
heap
page execute and read and write
27D0000
trusted library allocation
page read and write
4FCE000
stack
page read and write
A23000
trusted library allocation
page execute and read and write
4B80000
trusted library allocation
page read and write
CBE000
stack
page read and write
4CA0000
trusted library allocation
page read and write
5C8E000
stack
page read and write
320000
unkown
page readonly
645A000
stack
page read and write
26F6000
trusted library allocation
page read and write
33CC000
heap
page read and write
8AE000
stack
page read and write
C5B000
trusted library allocation
page execute and read and write
529D000
stack
page read and write
6F8000
stack
page read and write
A10000
trusted library allocation
page read and write
608F000
stack
page read and write
9E0000
heap
page read and write
5F0E000
stack
page read and write
61CE000
stack
page read and write
600D000
stack
page read and write
4BE0000
trusted library allocation
page read and write
60CE000
stack
page read and write
CE0000
heap
page read and write
2D6D000
stack
page read and write
35BF000
stack
page read and write
2702000
trusted library allocation
page read and write
A58000
heap
page read and write
C40000
trusted library allocation
page read and write
27C3000
trusted library allocation
page read and write
635C000
stack
page read and write
E0A000
trusted library allocation
page read and write
335E000
stack
page read and write
C57000
trusted library allocation
page execute and read and write
33E5000
heap
page read and write
270E000
trusted library allocation
page read and write
2DE0000
heap
page read and write
A2D000
trusted library allocation
page execute and read and write
5C4F000
stack
page read and write
740000
heap
page read and write
26E0000
trusted library allocation
page read and write
52DE000
stack
page read and write
282C000
trusted library allocation
page read and write
C55000
trusted library allocation
page execute and read and write
65DE000
stack
page read and write
A3E000
heap
page read and write
33E1000
heap
page read and write
6460000
heap
page read and write
68C000
stack
page read and write
730000
heap
page read and write
D50000
heap
page read and write
27D4000
trusted library allocation
page read and write
661E000
stack
page read and write
C4A000
trusted library allocation
page execute and read and write
50CE000
stack
page read and write
520F000
stack
page read and write
ABF000
heap
page read and write
27E4000
trusted library allocation
page read and write
27D7000
trusted library allocation
page read and write
D2D000
stack
page read and write
2A10000
heap
page read and write
27FC000
trusted library allocation
page read and write
E10000
trusted library allocation
page read and write
E08000
trusted library allocation
page read and write
C42000
trusted library allocation
page read and write
4C10000
trusted library allocation
page read and write
33E3000
heap
page read and write
C3D000
trusted library allocation
page execute and read and write
2721000
trusted library allocation
page read and write
30FD000
stack
page read and write
27FA000
trusted library allocation
page read and write
A24000
trusted library allocation
page read and write
4D30000
trusted library allocation
page read and write
27C9000
trusted library allocation
page read and write
31D0000
heap
page read and write
2B40000
heap
page read and write
E39000
heap
page read and write
28CF000
stack
page read and write
E04000
trusted library allocation
page read and write
8D0000
heap
page read and write
321E000
unkown
page read and write
52E0000
heap
page read and write
61D0000
trusted library allocation
page read and write
4C8A000
trusted library allocation
page read and write
7F020000
trusted library allocation
page execute and read and write
4C8D000
trusted library allocation
page read and write
9DF000
stack
page read and write
26F1000
trusted library allocation
page read and write
27CB000
trusted library allocation
page read and write
4E6E000
stack
page read and write
346000
unkown
page readonly
4D40000
trusted library allocation
page execute and read and write
27E8000
trusted library allocation
page read and write
4BB0000
trusted library allocation
page read and write
CC0000
trusted library allocation
page execute and read and write
ADD000
heap
page read and write
6CC000
stack
page read and write
2DD0000
heap
page read and write
E00000
trusted library allocation
page read and write
4D50000
trusted library allocation
page read and write
A65000
heap
page read and write
288E000
stack
page read and write
810000
heap
page read and write
483E000
stack
page read and write
E20000
trusted library allocation
page read and write
5B4E000
stack
page read and write
4D60000
trusted library allocation
page execute and read and write
2D70000
heap
page read and write
8D5000
heap
page read and write
E37000
heap
page read and write
5D8F000
stack
page read and write
331F000
unkown
page read and write
There are 151 hidden memdumps, click here to show them.