IOC Report
ocuALPV2c7.exe

loading gif

Files

File Path
Type
Category
Malicious
ocuALPV2c7.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ocuALPV2c7.exe
"C:\Users\user\Desktop\ocuALPV2c7.exe"
 malicious

URLs

Name
IP
Malicious
strategy-mls.gl.at.ply.gg:24195
malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://gg.ylp.ta.lg.slm-ygetarts
unknown

Domains

Name
IP
Malicious
strategy-mls.gl.at.ply.gg
147.185.221.19
 malicious

IPs

IP
Domain
Country
Malicious
147.185.221.19
strategy-mls.gl.at.ply.gg
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3221000
trusted library allocation
page read and write
 malicious
3462000
trusted library allocation
page read and write
 malicious
13D0000
heap
page read and write
5EF2000
trusted library allocation
page read and write
124E000
stack
page read and write
5FB0000
trusted library allocation
page read and write
1377000
heap
page read and write
5EC0000
trusted library allocation
page read and write
1580000
trusted library allocation
page read and write
1324000
trusted library allocation
page read and write
5EDE000
trusted library allocation
page read and write
1323000
trusted library allocation
page execute and read and write
134D000
trusted library allocation
page execute and read and write
1120000
heap
page read and write
5ECB000
trusted library allocation
page read and write
13D4000
heap
page read and write
1358000
heap
page read and write
1567000
trusted library allocation
page execute and read and write
5833000
heap
page read and write
1340000
trusted library allocation
page read and write
D2A000
unkown
page readonly
DBA000
stack
page read and write
5F4C000
stack
page read and write
1396000
heap
page read and write
1560000
trusted library allocation
page read and write
531E000
stack
page read and write
15CE000
stack
page read and write
1393000
heap
page read and write
139C000
heap
page read and write
5FA0000
trusted library allocation
page read and write
5EE6000
trusted library allocation
page read and write
1265000
heap
page read and write
139A000
heap
page read and write
30A0000
trusted library allocation
page read and write
6050000
heap
page read and write
569E000
stack
page read and write
D22000
unkown
page readonly
3209000
trusted library allocation
page read and write
155A000
trusted library allocation
page execute and read and write
6010000
trusted library allocation
page execute and read and write
1350000
heap
page read and write
1630000
trusted library allocation
page execute and read and write
1610000
heap
page read and write
1320000
trusted library allocation
page read and write
1550000
trusted library allocation
page read and write
6020000
heap
page read and write
6030000
heap
page execute and read and write
135E000
heap
page read and write
1330000
heap
page read and write
3090000
trusted library allocation
page read and write
31EF000
stack
page read and write
D20000
unkown
page readonly
10F7000
stack
page read and write
1200000
heap
page read and write
1562000
trusted library allocation
page read and write
174E000
stack
page read and write
5EC6000
trusted library allocation
page read and write
1343000
trusted library allocation
page read and write
6000000
heap
page read and write
13ED000
heap
page read and write
35EA000
trusted library allocation
page read and write
4221000
trusted library allocation
page read and write
1260000
heap
page read and write
5EED000
trusted library allocation
page read and write
1310000
trusted library allocation
page read and write
160C000
stack
page read and write
1433000
heap
page read and write
5ECE000
trusted library allocation
page read and write
5EC4000
trusted library allocation
page read and write
7FDB0000
trusted library allocation
page execute and read and write
5FC0000
trusted library allocation
page read and write
5FA7000
trusted library allocation
page read and write
1419000
heap
page read and write
132D000
trusted library allocation
page execute and read and write
13D8000
heap
page read and write
13F1000
heap
page read and write
5F00000
trusted library allocation
page read and write
30E0000
heap
page read and write
1556000
trusted library allocation
page execute and read and write
5FD0000
trusted library allocation
page execute and read and write
1640000
heap
page read and write
3200000
trusted library allocation
page read and write
5ED2000
trusted library allocation
page read and write
143E000
heap
page read and write
156B000
trusted library allocation
page execute and read and write
5F90000
trusted library allocation
page read and write
5A7E000
stack
page read and write
1313000
trusted library allocation
page read and write
5EE1000
trusted library allocation
page read and write
5F89000
stack
page read and write
2FF8000
trusted library allocation
page read and write
5830000
heap
page read and write
1336000
heap
page read and write
1450000
heap
page read and write
3210000
heap
page execute and read and write
There are 85 hidden memdumps, click here to show them.