IOC Report
zkB0qfWSJk.exe

loading gif

Files

File Path
Type
Category
Malicious
zkB0qfWSJk.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zkB0qfWSJk.exe_4e21ab8a6c52a8fdeb5761423d21df82a93865_bf7f78a4_6293aa2d-2707-4d52-988e-67550924207e\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F66.tmp.dmp
Mini DuMP crash report, 16 streams, Mon Jul 1 12:48:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA12C.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA18B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\regsvcs.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\zkB0qfWSJk.exe
"C:\Users\user\Desktop\zkB0qfWSJk.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7220 -s 980
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.130.0
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.130.0

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.130.0
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
FileDirectory
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
ProgramId
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
FileId
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
LowerCaseLongPath
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
LongPathHash
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
Name
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
OriginalFileName
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
Publisher
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
Version
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
BinFileVersion
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
BinaryType
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
ProductName
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
ProductVersion
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
LinkDate
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
BinProductVersion
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
AppxPackageFullName
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
AppxPackageRelativeId
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
Size
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
Language
\REGISTRY\A\{a0dc2c05-2eb6-6103-3a43-d0f66c2ef3d5}\Root\InventoryApplicationFile\zkb0qfwsjk.exe|7424ffec55d7c58
Usn
There are 23 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2ED1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
1AE1014B000
trusted library allocation
page read and write
 malicious
1AE0003B000
trusted library allocation
page read and write
 malicious
3094000
trusted library allocation
page read and write
 malicious
11E0000
heap
page read and write
32AC000
stack
page read and write
2DCE000
stack
page read and write
1356000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
2D10000
trusted library allocation
page read and write
3310000
heap
page read and write
2D1B000
trusted library allocation
page execute and read and write
1360000
heap
page read and write
643E000
stack
page read and write
4E0DF33000
stack
page read and write
2FDB000
trusted library allocation
page read and write
5414000
trusted library allocation
page read and write
7FFAAC77E000
trusted library allocation
page read and write
3ED1000
trusted library allocation
page read and write
1AE67B00000
trusted library allocation
page read and write
5426000
trusted library allocation
page read and write
1AE67B20000
trusted library allocation
page read and write
1AE69530000
trusted library section
page read and write
5470000
trusted library allocation
page read and write
7FFAAC759000
trusted library allocation
page read and write
156E000
stack
page read and write
4E0E6FD000
stack
page read and write
7FFAAC7A0000
trusted library allocation
page read and write
7FFAAC5FC000
trusted library allocation
page execute and read and write
555D000
stack
page read and write
3368000
heap
page read and write
2CA0000
heap
page read and write
146F000
stack
page read and write
3360000
heap
page read and write
1AE10001000
trusted library allocation
page read and write
2D80000
heap
page read and write
5404000
trusted library allocation
page read and write
11E5000
heap
page read and write
2FB4000
trusted library allocation
page read and write
1AE6799D000
heap
page read and write
683E000
stack
page read and write
3065000
trusted library allocation
page read and write
65BB000
heap
page read and write
687E000
stack
page read and write
7FFAAC5A2000
trusted library allocation
page read and write
7FFB16790000
unkown
page readonly
7FFAAC686000
trusted library allocation
page execute and read and write
1AE678A0000
heap
page read and write
69BE000
stack
page read and write
1333000
trusted library allocation
page execute and read and write
57DE000
stack
page read and write
1AE67970000
heap
page read and write
6586000
heap
page read and write
66BE000
stack
page read and write
3085000
trusted library allocation
page read and write
326C000
stack
page read and write
575E000
stack
page read and write
1AE69600000
heap
page execute and read and write
7FFAAC5AD000
trusted library allocation
page execute and read and write
361E000
stack
page read and write
3058000
trusted library allocation
page read and write
1AE69E10000
heap
page read and write
1AE678C0000
heap
page read and write
1AE67890000
heap
page read and write
298E000
stack
page read and write
1068000
heap
page read and write
2F82000
trusted library allocation
page read and write
2F7C000
trusted library allocation
page read and write
304A000
trusted library allocation
page read and write
1AE67C50000
heap
page read and write
2F89000
trusted library allocation
page read and write
2D17000
trusted library allocation
page execute and read and write
294E000
unkown
page read and write
2F9C000
trusted library allocation
page read and write
1340000
trusted library allocation
page read and write
1AE00001000
trusted library allocation
page read and write
1334000
trusted library allocation
page read and write
4FAC000
stack
page read and write
2B9F000
unkown
page read and write
623F000
stack
page read and write
29A0000
heap
page read and write
7FFAAC750000
trusted library allocation
page read and write
349F000
stack
page read and write
7FFAAC5CD000
trusted library allocation
page execute and read and write
1AE67E30000
heap
page read and write
6D8E000
stack
page read and write
3EF9000
trusted library allocation
page read and write
7FFAAC660000
trusted library allocation
page execute and read and write
1AE6795B000
heap
page read and write
1330000
trusted library allocation
page read and write
7FFAAC5BD000
trusted library allocation
page execute and read and write
2D40000
heap
page read and write
1AE67973000
heap
page read and write
1300000
heap
page read and write
1320000
trusted library allocation
page read and write
11B0000
heap
page read and write
7FF48B890000
trusted library allocation
page execute and read and write
335E000
stack
page read and write
7FFB167B5000
unkown
page readonly
7FFAAC5A4000
trusted library allocation
page read and write
302B000
trusted library allocation
page read and write
4E0E7FE000
stack
page read and write
7FFAAC5C0000
trusted library allocation
page read and write
DF7000
stack
page read and write
50AC000
stack
page read and write
2990000
heap
page read and write
1AE678E0000
heap
page read and write
1AE67802000
unkown
page readonly
5440000
trusted library allocation
page read and write
3081000
trusted library allocation
page read and write
108A000
heap
page read and write
6540000
heap
page read and write
CFB000
stack
page read and write
3017000
trusted library allocation
page read and write
301F000
trusted library allocation
page read and write
301B000
trusted library allocation
page read and write
1AE69640000
trusted library allocation
page read and write
2D30000
trusted library allocation
page read and write
1AE00352000
trusted library allocation
page read and write
2830000
heap
page read and write
7FFAAC650000
trusted library allocation
page read and write
1AE67C65000
heap
page read and write
4E0E2FF000
stack
page read and write
1307000
heap
page read and write
11AE000
stack
page read and write
540E000
trusted library allocation
page read and write
667E000
stack
page read and write
4E0E8FE000
stack
page read and write
5A3E000
stack
page read and write
7FFAAC656000
trusted library allocation
page read and write
66FE000
stack
page read and write
4E0E4FF000
stack
page read and write
7FFAAC780000
trusted library allocation
page read and write
29C4000
heap
page read and write
2FD3000
trusted library allocation
page read and write
2D12000
trusted library allocation
page read and write
7FFAAC770000
trusted library allocation
page read and write
7FFAAC790000
trusted library allocation
page execute and read and write
35DE000
stack
page read and write
2F9A000
trusted library allocation
page read and write
5620000
heap
page read and write
3023000
trusted library allocation
page read and write
3013000
trusted library allocation
page read and write
1AE67930000
heap
page read and write
2F90000
trusted library allocation
page read and write
579E000
stack
page read and write
7FFAAC5A3000
trusted library allocation
page execute and read and write
4E0E3FF000
stack
page read and write
1AE000E3000
trusted library allocation
page read and write
1AE67C60000
heap
page read and write
7FFAAC5B0000
trusted library allocation
page read and write
2F8D000
trusted library allocation
page read and write
1AE6793C000
heap
page read and write
24CD000
stack
page read and write
657F000
heap
page read and write
7FFAAC5CB000
trusted library allocation
page execute and read and write
57F0000
heap
page execute and read and write
135A000
trusted library allocation
page execute and read and write
67FF000
stack
page read and write
4E0E5FF000
stack
page read and write
6577000
heap
page read and write
7FFAAC5B2000
trusted library allocation
page read and write
1AE67C40000
trusted library allocation
page read and write
5A7E000
stack
page read and write
7FFAAC754000
trusted library allocation
page read and write
4E0EAFE000
stack
page read and write
7FFAAC6C0000
trusted library allocation
page execute and read and write
6C40000
heap
page read and write
6C3C000
stack
page read and write
5435000
trusted library allocation
page read and write
7FFAAC65C000
trusted library allocation
page execute and read and write
7FFB16791000
unkown
page execute read
29C5000
heap
page read and write
3690000
heap
page read and write
613E000
stack
page read and write
1AE10007000
trusted library allocation
page read and write
5450000
trusted library allocation
page read and write
30A8000
trusted library allocation
page read and write
1AE67800000
unkown
page readonly
5429000
trusted library allocation
page read and write
653E000
stack
page read and write
302F000
trusted library allocation
page read and write
54D0000
heap
page read and write
7FFB167B2000
unkown
page readonly
2820000
heap
page read and write
29AC000
heap
page read and write
551E000
stack
page read and write
7FFAAC5C4000
trusted library allocation
page read and write
1AE00020000
trusted library allocation
page read and write
7FFB167A6000
unkown
page readonly
2DA0000
heap
page read and write
1AE67E35000
heap
page read and write
1AE679A4000
heap
page read and write
7FFB167B0000
unkown
page read and write
7FFAAC740000
trusted library allocation
page read and write
12FE000
stack
page read and write
1AE695F0000
heap
page execute and read and write
1060000
heap
page read and write
2FDF000
trusted library allocation
page read and write
2D70000
trusted library allocation
page execute and read and write
7FFAAC5A0000
trusted library allocation
page read and write
2ECE000
stack
page read and write
6C8E000
stack
page read and write
7FFAAC760000
trusted library allocation
page read and write
1097000
heap
page read and write
1350000
trusted library allocation
page read and write
114E000
heap
page read and write
2FC9000
trusted library allocation
page read and write
25CD000
stack
page read and write
2FD7000
trusted library allocation
page read and write
2F84000
trusted library allocation
page read and write
54C0000
trusted library allocation
page read and write
3ED7000
trusted library allocation
page read and write
34A0000
heap
page read and write
6B3C000
stack
page read and write
4E0E9FE000
stack
page read and write
133D000
trusted library allocation
page execute and read and write
1110000
heap
page read and write
5446000
trusted library allocation
page read and write
53F0000
trusted library allocation
page read and write
1AE67C43000
trusted library allocation
page read and write
3027000
trusted library allocation
page read and write
633F000
stack
page read and write
68BE000
stack
page read and write
1352000
trusted library allocation
page read and write
2D60000
heap
page execute and read and write
2C9F000
stack
page read and write
34C0000
heap
page read and write
1160000
heap
page read and write
There are 220 hidden memdumps, click here to show them.