IOC Report
#U8f6e#U6905-#U89c4#U683c.docx.pif.exe

loading gif

Files

File Path
Type
Category
Malicious
#U8f6e#U6905-#U89c4#U683c.docx.pif.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\gaban\logs.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpBE91.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TkdxROLUOVpK.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mssylnt.hbg.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqvqa4yx.pzb.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hrevebsh.2ac.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npb0topg.j2r.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcvhbsta.zuj.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qpdrikhh.rot.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vhtd5wmh.zch.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yygnsrze.4xq.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpCDF3.tmp
XML 1.0 document, ASCII text
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe
"C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U8f6e#U6905-#U89c4#U683c.docx.pif.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpBE91.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe
C:\Users\user\AppData\Roaming\TkdxROLUOVpK.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkdxROLUOVpK" /XML "C:\Users\user\AppData\Local\Temp\tmpCDF3.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
www.vipguyclassproject2024.space
malicious
http://geoplugin.net/json.gp
unknown
http://geoplugin.net/json.gp/C
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
www.vipguyclassproject2024.space
unknown
 malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-5MRRQ3
exepath
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-5MRRQ3
licence
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-5MRRQ3
time
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3AC6000
trusted library allocation
page read and write
 malicious
504B000
heap
page read and write
 malicious
54E7000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
37A6000
trusted library allocation
page read and write
 malicious
4F66000
trusted library allocation
page read and write
56DF000
stack
page read and write
5340000
heap
page read and write
4CE0000
trusted library allocation
page read and write
B85000
heap
page read and write
2720000
trusted library allocation
page read and write
5080000
trusted library allocation
page execute and read and write
2570000
trusted library allocation
page read and write
4CB0000
trusted library allocation
page read and write
A65000
heap
page read and write
29D0000
heap
page read and write
290E000
unkown
page read and write
6E00000
trusted library allocation
page read and write
D1E000
stack
page read and write
5090000
trusted library allocation
page read and write
6D95000
heap
page read and write
52F0000
heap
page readonly
C90000
heap
page read and write
4A80000
trusted library allocation
page read and write
5510000
trusted library allocation
page execute and read and write
D67000
heap
page read and write
2A50000
heap
page read and write
F80000
trusted library allocation
page read and write
5210000
heap
page read and write
474000
remote allocation
page execute and read and write
26FE000
stack
page read and write
A5F000
heap
page read and write
25C0000
heap
page read and write
D82000
heap
page read and write
6C60000
heap
page read and write
D4E000
heap
page read and write
ABC0000
heap
page read and write
FB0000
heap
page read and write
B34D000
stack
page read and write
2810000
heap
page read and write
5C0000
heap
page read and write
4F5E000
trusted library allocation
page read and write
B1CC000
stack
page read and write
9B4C000
stack
page read and write
721E000
stack
page read and write
A20000
heap
page read and write
25AA000
stack
page read and write
C20000
heap
page read and write
4CC0000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
1250000
trusted library allocation
page read and write
29CF000
stack
page read and write
256D000
stack
page read and write
54E0000
heap
page read and write
75A0000
heap
page read and write
4FA0000
trusted library allocation
page read and write
B37000
stack
page read and write
2580000
trusted library allocation
page read and write
5300000
heap
page read and write
2930000
heap
page read and write
AA2000
heap
page read and write
2A60000
heap
page read and write
76DE000
stack
page read and write
52A0000
trusted library section
page readonly
12B0000
heap
page read and write
4F45000
heap
page read and write
4FC0000
heap
page read and write
258B000
trusted library allocation
page execute and read and write
71DE000
stack
page read and write
5020000
trusted library allocation
page read and write
2A2F000
stack
page read and write
A54000
heap
page read and write
7570000
trusted library section
page read and write
28D1000
trusted library allocation
page read and write
4C81000
trusted library allocation
page read and write
5200000
heap
page read and write
2582000
trusted library allocation
page read and write
5F5000
heap
page read and write
F64000
trusted library allocation
page read and write
4FAC000
stack
page read and write
5575000
heap
page read and write
D48000
heap
page read and write
2B5B000
trusted library allocation
page read and write
4FF0000
trusted library allocation
page execute and read and write
6DAE000
stack
page read and write
6E02000
heap
page read and write
AABE000
stack
page read and write
A2E000
heap
page read and write
6D6E000
stack
page read and write
6E4F000
stack
page read and write
DD7000
heap
page read and write
4C8D000
trusted library allocation
page read and write
F8A000
trusted library allocation
page execute and read and write
2A00000
heap
page execute and read and write
F92000
trusted library allocation
page read and write
4F6D000
trusted library allocation
page read and write
2AAE000
trusted library allocation
page read and write
5037000
heap
page read and write
1066F000
stack
page read and write
4C86000
trusted library allocation
page read and write
4760000
trusted library allocation
page execute and read and write
538E000
stack
page read and write
54AE000
stack
page read and write
2B90000
heap
page read and write
4D50000
heap
page read and write
A61000
heap
page read and write
5B60000
heap
page read and write
6CE0000
heap
page read and write
4FA5000
trusted library allocation
page read and write
7F660000
trusted library allocation
page execute and read and write
506D000
heap
page read and write
F82000
trusted library allocation
page read and write
6FDE000
stack
page read and write
2572000
trusted library allocation
page read and write
C8E000
stack
page read and write
5073000
heap
page read and write
3A61000
trusted library allocation
page read and write
4FBE000
stack
page read and write
28DD000
trusted library allocation
page read and write
5030000
trusted library allocation
page read and write
6F9F000
stack
page read and write
491C000
stack
page read and write
4FF3000
heap
page read and write
481C000
stack
page read and write
5400000
heap
page read and write
725E000
stack
page read and write
6DF0000
trusted library section
page read and write
4CA0000
trusted library allocation
page read and write
474000
remote allocation
page execute and read and write
75FA000
heap
page read and write
BB0000
heap
page read and write
54E0000
heap
page read and write
B460000
trusted library allocation
page read and write
70F2000
trusted library allocation
page read and write
5310000
heap
page read and write
2A61000
trusted library allocation
page read and write
2563000
trusted library allocation
page read and write
6DC3000
heap
page read and write
471000
remote allocation
page execute and read and write
5F0000
heap
page read and write
3DD000
stack
page read and write
3A69000
trusted library allocation
page read and write
2554000
trusted library allocation
page read and write
52FE000
stack
page read and write
A97E000
stack
page read and write
6DA9000
heap
page read and write
4D20000
heap
page execute and read and write
D40000
heap
page read and write
77DE000
stack
page read and write
47AE000
stack
page read and write
5020000
heap
page read and write
5B70000
heap
page read and write
6C2F000
stack
page read and write
F7D000
trusted library allocation
page execute and read and write
4033000
trusted library allocation
page read and write
5030000
trusted library allocation
page execute and read and write
4D60000
heap
page read and write
B20E000
stack
page read and write
5290000
heap
page execute and read and write
2553000
trusted library allocation
page execute and read and write
4C92000
trusted library allocation
page read and write
4F40000
trusted library allocation
page read and write
EE00000
trusted library allocation
page read and write
25FE000
stack
page read and write
E24000
heap
page read and write
29CE000
stack
page read and write
2730000
heap
page read and write
54A000
stack
page read and write
5580000
trusted library allocation
page read and write
F3E000
stack
page read and write
6E8C000
stack
page read and write
4F72000
trusted library allocation
page read and write
8F7000
stack
page read and write
509B000
stack
page read and write
5032000
trusted library allocation
page read and write
6E30000
trusted library section
page read and write
70CF000
stack
page read and write
CDE000
stack
page read and write
50A0000
trusted library section
page readonly
53FF000
stack
page read and write
F37000
heap
page read and write
255D000
trusted library allocation
page execute and read and write
6AE0000
trusted library allocation
page execute and read and write
98DE000
stack
page read and write
F86000
trusted library allocation
page execute and read and write
A0E000
stack
page read and write
4353000
trusted library allocation
page read and write
12A0000
trusted library allocation
page execute and read and write
5331000
heap
page read and write
24C0000
heap
page read and write
4AD4000
trusted library allocation
page read and write
CC4F000
stack
page read and write
B44F000
stack
page read and write
7590000
trusted library allocation
page read and write
5540000
trusted library allocation
page execute and read and write
A29000
heap
page read and write
29F0000
trusted library allocation
page read and write
F30000
heap
page read and write
4F84000
trusted library allocation
page read and write
2A4C000
stack
page read and write
75D7000
heap
page read and write
299F000
unkown
page read and write
7560000
trusted library allocation
page execute and read and write
4AD0000
trusted library allocation
page read and write
4AE0000
trusted library allocation
page execute and read and write
AA7E000
stack
page read and write
6DED000
heap
page read and write
4F86000
trusted library allocation
page read and write
B0E000
heap
page read and write
F63000
trusted library allocation
page execute and read and write
6F2E000
stack
page read and write
9A0E000
stack
page read and write
4FF0000
heap
page read and write
4A6E000
trusted library allocation
page read and write
6D4C000
stack
page read and write
108AE000
stack
page read and write
5230000
heap
page read and write
4C7E000
trusted library allocation
page read and write
5570000
heap
page read and write
B0CC000
stack
page read and write
25B0000
heap
page execute and read and write
28DB000
trusted library allocation
page read and write
ACFE000
stack
page read and write
54DD000
stack
page read and write
4FB0000
trusted library allocation
page read and write
4F60000
heap
page read and write
5000000
trusted library allocation
page read and write
2AB2000
trusted library allocation
page read and write
70DE000
stack
page read and write
292E000
unkown
page read and write
5210000
heap
page read and write
6F6E000
stack
page read and write
6DCE000
heap
page read and write
F73000
trusted library allocation
page read and write
5040000
trusted library allocation
page read and write
4EFC000
stack
page read and write
4F4B000
trusted library allocation
page read and write
3A89000
trusted library allocation
page read and write
9B0E000
stack
page read and write
6CDE000
stack
page read and write
4BEC000
stack
page read and write
6BDD000
stack
page read and write
D8E000
stack
page read and write
5B0000
heap
page read and write
762B000
heap
page read and write
54F0000
trusted library allocation
page read and write
CC8D000
stack
page read and write
1056F000
stack
page read and write
4BA000
unkown
page readonly
51F5000
heap
page read and write
4FD0000
trusted library allocation
page read and write
4F70000
heap
page readonly
6C6D000
stack
page read and write
4D42000
trusted library allocation
page read and write
4A60000
trusted library allocation
page read and write
2700000
trusted library allocation
page execute and read and write
4D53000
heap
page read and write
41A000
stack
page read and write
2550000
trusted library allocation
page read and write
CD8C000
stack
page read and write
AF3E000
stack
page read and write
6DCC000
heap
page read and write
948C000
trusted library allocation
page read and write
51F0000
heap
page read and write
12B7000
heap
page read and write
29F0000
heap
page read and write
10BE000
stack
page read and write
4C60000
trusted library allocation
page read and write
3D0000
unkown
page readonly
50C0000
heap
page read and write
4D40000
trusted library allocation
page read and write
3FE5000
trusted library allocation
page read and write
4750000
trusted library allocation
page read and write
3741000
trusted library allocation
page read and write
533E000
stack
page read and write
C1F000
stack
page read and write
69C0000
heap
page read and write
6F8F000
stack
page read and write
411E000
trusted library allocation
page read and write
F97000
trusted library allocation
page execute and read and write
2A46000
trusted library allocation
page read and write
5030000
heap
page read and write
3749000
trusted library allocation
page read and write
478000
remote allocation
page execute and read and write
6B2E000
stack
page read and write
24CB000
heap
page read and write
6E9E000
stack
page read and write
25A0000
trusted library allocation
page read and write
6E20000
trusted library allocation
page read and write
4F40000
heap
page read and write
B80000
heap
page read and write
6E10000
trusted library section
page read and write
6D80000
heap
page read and write
3769000
trusted library allocation
page read and write
ABBD000
stack
page read and write
2950000
heap
page read and write
29E0000
heap
page read and write
294F000
unkown
page read and write
A3A000
stack
page read and write
F70000
trusted library allocation
page read and write
4F90000
trusted library allocation
page read and write
528B000
stack
page read and write
2A6A000
heap
page read and write
5330000
heap
page read and write
2816000
trusted library allocation
page read and write
6D00000
heap
page read and write
4F61000
trusted library allocation
page read and write
1076D000
stack
page read and write
F20000
trusted library allocation
page read and write
5070000
trusted library allocation
page read and write
4CB5000
trusted library allocation
page read and write
50B0000
heap
page read and write
4BFC000
stack
page read and write
6AC0000
trusted library allocation
page read and write
256D000
trusted library allocation
page execute and read and write
D80000
heap
page read and write
129E000
stack
page read and write
2576000
trusted library allocation
page execute and read and write
3F97000
trusted library allocation
page read and write
3D2000
unkown
page readonly
5040000
trusted library allocation
page execute and read and write
4D30000
heap
page read and write
A87E000
stack
page read and write
F6D000
trusted library allocation
page execute and read and write
2560000
trusted library allocation
page read and write
54FA000
trusted library allocation
page read and write
257A000
trusted library allocation
page execute and read and write
53A0000
heap
page read and write
B30F000
stack
page read and write
298E000
stack
page read and write
6FD0000
trusted library allocation
page read and write
AE3E000
stack
page read and write
107AE000
stack
page read and write
2710000
trusted library allocation
page read and write
6F30000
heap
page read and write
F60000
trusted library allocation
page read and write
7F4E0000
trusted library allocation
page execute and read and write
5050000
trusted library allocation
page read and write
25D0000
heap
page read and write
4C6B000
trusted library allocation
page read and write
F50000
trusted library allocation
page read and write
C40000
heap
page read and write
ADFE000
stack
page read and write
29DE000
stack
page read and write
2741000
trusted library allocation
page read and write
F9B000
trusted library allocation
page execute and read and write
4EAC000
stack
page read and write
6FCD000
stack
page read and write
2587000
trusted library allocation
page execute and read and write
There are 339 hidden memdumps, click here to show them.