IOC Report
1hibLFnCm1.exe

loading gif

Files

File Path
Type
Category
Malicious
1hibLFnCm1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\ms_updater.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\gOvRVAND.log
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\mHYqxgSr.log
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ms_updater.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Temp\LLzNk9wqw6
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\ms_tool.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
\Device\Null
ASCII text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\1hibLFnCm1.exe
"C:\Users\user\Desktop\1hibLFnCm1.exe"
 malicious
C:\Users\user\AppData\Roaming\ms_updater.exe
"C:\Users\user\AppData\Roaming\ms_updater.exe"
malicious
C:\Users\user\AppData\Roaming\ms_tool.exe
"C:\Users\user\AppData\Roaming\ms_tool.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jClCs9nEU3.bat"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\chcp.com
chcp 65001
C:\Windows\System32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

URLs

Name
IP
Malicious
http://118621cm.n9shteam2.top/
unknown
 malicious
http://118621cm.n9shteam2.top/protecttrackDatalifePrivateCentral.php
104.21.90.190
 malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://118621cm.n9shteX
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://118621cm.n9shteam2.top
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
118621cm.n9shteam2.top
104.21.90.190
 malicious

IPs

IP
Domain
Country
Malicious
104.21.90.190
118621cm.n9shteam2.top
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\a7826988ae199588b0a428293d027e79d80232cd
171823069b6502484221899169503f7fbaed6ee1
HKEY_CURRENT_USER\SOFTWARE\AjqVFPjRdUMLGTTtnlMEjUReAbQurGJk
AjqVFPjRdUMLGTTtnlMEjUReAbQurGJk
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ms_updater_RASMANCS
FileDirectory
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
LangID
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\System32\cmd.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\System32\cmd.exe.ApplicationCompany
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
F8D000
unkown
page read and write
 malicious
314B000
trusted library allocation
page read and write
 malicious
D92000
unkown
page readonly
 malicious
2FD1000
trusted library allocation
page read and write
 malicious
7FFD9BBD2000
trusted library allocation
page read and write
F30000
heap
page read and write
1BA5E000
heap
page read and write
33A6000
trusted library allocation
page read and write
1BAC5000
heap
page read and write
131F000
heap
page read and write
7FFD9BB55000
trusted library allocation
page read and write
12E0000
heap
page read and write
7FF68C5E0000
unkown
page readonly
B3A000
heap
page read and write
C60000
heap
page read and write
1B940000
trusted library section
page readonly
7FF68C5E1000
unkown
page execute read
1ED96000
heap
page read and write
B30000
heap
page read and write
7FFD9B9A4000
trusted library allocation
page read and write
1BA75000
heap
page read and write
B721A7C000
stack
page read and write
1B910000
trusted library allocation
page read and write
102F000
unkown
page readonly
1ECBE000
heap
page read and write
F50000
unkown
page readonly
25487580000
heap
page read and write
1550000
trusted library allocation
page read and write
1B920000
heap
page execute and read and write
1F61B760000
heap
page read and write
1B35F000
heap
page read and write
1590000
unkown
page readonly
1592000
unkown
page readonly
12F754B0000
heap
page read and write
7FFD9BC80000
trusted library allocation
page read and write
C50000
heap
page read and write
1F61BA80000
heap
page read and write
132ED000
trusted library allocation
page read and write
33CE000
stack
page read and write
12F753B7000
heap
page read and write
7FFD9B9A0000
trusted library allocation
page read and write
331D000
trusted library allocation
page read and write
1BDFE000
stack
page read and write
330E000
trusted library allocation
page read and write
7FF68C5E0000
unkown
page readonly
15C0000
heap
page read and write
2FCE000
stack
page read and write
1DB8E000
stack
page read and write
1B8F0000
heap
page read and write
F7A000
unkown
page readonly
1BA79000
heap
page read and write
304E000
stack
page read and write
C71ACFF000
stack
page read and write
7FFD9BB29000
trusted library allocation
page read and write
1BAA7000
heap
page read and write
1CFC4FE000
stack
page read and write
1BA27000
heap
page read and write
F89000
unkown
page read and write
2E70000
unkown
page readonly
ECE000
stack
page read and write
1309000
heap
page read and write
331B000
trusted library allocation
page read and write
2E72000
unkown
page readonly
F8A000
unkown
page write copy
314E000
stack
page read and write
113E000
stack
page read and write
B721AFF000
stack
page read and write
1BA95000
heap
page read and write
130B7000
trusted library allocation
page read and write
7FFD9B99D000
trusted library allocation
page execute and read and write
328E000
stack
page read and write
1DD8B000
stack
page read and write
1CFC1AB000
stack
page read and write
1ECAC000
heap
page read and write
12F753B7000
heap
page read and write
7FFD9BBC0000
trusted library allocation
page execute and read and write
1ED9C000
heap
page read and write
F8D000
unkown
page write copy
1E076000
stack
page read and write
13115000
trusted library allocation
page read and write
3143000
trusted library allocation
page read and write
1C28F000
stack
page read and write
1E17A000
stack
page read and write
1B9F3000
heap
page read and write
1F61B768000
heap
page read and write
254875FA000
heap
page read and write
1E61C000
stack
page read and write
1E180000
heap
page read and write
1DA8E000
stack
page read and write
3160000
heap
page read and write
7FFD9B980000
trusted library allocation
page read and write
1F61B720000
heap
page read and write
1B000000
trusted library allocation
page read and write
7FFD9B983000
trusted library allocation
page execute and read and write
131E0000
trusted library allocation
page read and write
7FFD9BC70000
trusted library allocation
page read and write
F8B000
unkown
page read and write
1BCFE000
stack
page read and write
1BFF6000
stack
page read and write
7FF68C5E7000
unkown
page readonly
12F754C0000
heap
page read and write
364B000
stack
page read and write
FC0000
heap
page read and write
F51000
unkown
page execute read
1BA00000
heap
page read and write
F70000
stack
page read and write
7FFD9BBE0000
trusted library allocation
page execute and read and write
12FDE000
trusted library allocation
page read and write
2E90000
heap
page execute and read and write
34CF000
stack
page read and write
2EC0000
heap
page execute and read and write
7FFD9BA3C000
trusted library allocation
page execute and read and write
1DF76000
heap
page read and write
7FFD9BA66000
trusted library allocation
page execute and read and write
7FFD9BB90000
trusted library allocation
page read and write
7FFD9BA36000
trusted library allocation
page read and write
3396000
trusted library allocation
page read and write
7FFD9BA30000
trusted library allocation
page read and write
13125000
trusted library allocation
page read and write
1ECEF000
heap
page read and write
D40000
heap
page read and write
254875A0000
heap
page read and write
12FD000
heap
page read and write
7FFD9B9DC000
trusted library allocation
page execute and read and write
12FD1000
trusted library allocation
page read and write
1CFC47E000
stack
page read and write
C65000
heap
page read and write
1B9F0000
heap
page read and write
1ED80000
heap
page read and write
FE0000
heap
page read and write
1BA9E000
heap
page read and write
7FFD9BC90000
trusted library allocation
page read and write
1EDD5000
heap
page read and write
1F61B730000
heap
page read and write
374C000
stack
page read and write
F89000
unkown
page write copy
B721B7F000
stack
page read and write
1F61B930000
heap
page read and write
350E000
stack
page read and write
7FFD9BC60000
trusted library allocation
page execute and read and write
1C236000
stack
page read and write
1322000
heap
page read and write
7FFD9B984000
trusted library allocation
page read and write
7FFD9BB20000
trusted library allocation
page read and write
254875F0000
heap
page read and write
1B950000
heap
page read and write
2E84000
unkown
page readonly
25487925000
heap
page read and write
1305B000
trusted library allocation
page read and write
15A0000
heap
page read and write
1DF70000
heap
page read and write
1EDBD000
heap
page read and write
1C03E000
stack
page read and write
1530000
trusted library allocation
page read and write
AFD000
stack
page read and write
30D6000
trusted library allocation
page read and write
1ED90000
heap
page read and write
7FFD9BB60000
trusted library allocation
page read and write
1EC90000
heap
page read and write
7FF68C5E1000
unkown
page execute read
1FF80000
trusted library allocation
page read and write
7FFD9B9AB000
trusted library allocation
page execute and read and write
C71AC7B000
stack
page read and write
7FFD9BB30000
trusted library allocation
page read and write
12F753A9000
heap
page read and write
14DE000
stack
page read and write
254875F8000
heap
page read and write
102F000
unkown
page readonly
7FFD9BBA0000
trusted library allocation
page read and write
1D89E000
stack
page read and write
25487920000
heap
page read and write
130BF000
trusted library allocation
page read and write
E8D000
stack
page read and write
3140000
trusted library allocation
page read and write
B64000
heap
page read and write
7FFD9B9AD000
trusted library allocation
page execute and read and write
1BAA9000
heap
page read and write
12EC000
heap
page read and write
1B56C000
stack
page read and write
7FFD9B993000
trusted library allocation
page read and write
338F000
stack
page read and write
134D000
heap
page read and write
7FFD9BAA0000
trusted library allocation
page execute and read and write
12D5000
heap
page read and write
379E000
stack
page read and write
1EC80000
heap
page read and write
1BA57000
heap
page read and write
1ECCD000
heap
page read and write
7FFD9BBB0000
trusted library allocation
page execute and read and write
15C5000
heap
page read and write
7FF68C5E4000
unkown
page readonly
134B000
heap
page read and write
7FFD9BB80000
trusted library allocation
page read and write
389F000
stack
page read and write
D90000
unkown
page readonly
25487570000
heap
page read and write
131A4000
trusted library allocation
page read and write
2A1D000
stack
page read and write
360F000
stack
page read and write
7FFD9B98D000
trusted library allocation
page execute and read and write
7FFD9BB50000
trusted library allocation
page read and write
1BA7C000
heap
page read and write
363F000
trusted library allocation
page read and write
D8E000
stack
page read and write
1E378000
stack
page read and write
12F75290000
heap
page read and write
F51000
unkown
page execute read
7FF68C5E4000
unkown
page readonly
2B1E000
stack
page read and write
7FFD9BA40000
trusted library allocation
page execute and read and write
311E000
trusted library allocation
page read and write
7FFD9BB70000
trusted library allocation
page read and write
1C138000
stack
page read and write
14E0000
heap
page read and write
F50000
unkown
page readonly
13BC000
heap
page read and write
7FF456660000
trusted library allocation
page execute and read and write
12F753A0000
heap
page read and write
D90000
unkown
page readonly
3130000
trusted library allocation
page read and write
FB0000
heap
page read and write
12F75370000
heap
page read and write
7FF68C5E7000
unkown
page readonly
7FFD9BBD0000
trusted library allocation
page read and write
1B923000
heap
page execute and read and write
1BBFE000
stack
page read and write
B3E000
heap
page read and write
2BB0000
heap
page read and write
12D0000
heap
page read and write
F7A000
unkown
page readonly
1C38D000
stack
page read and write
1BA21000
heap
page read and write
1EDD7000
heap
page read and write
2B90000
heap
page read and write
3150000
heap
page read and write
7FC000
stack
page read and write
16CE000
stack
page read and write
7FFD9BB42000
trusted library allocation
page read and write
1FFA2000
trusted library allocation
page read and write
There are 229 hidden memdumps, click here to show them.