IOC Report
4munRyMrBm.exe

loading gif

Files

File Path
Type
Category
Malicious
4munRyMrBm.exe
PE32+ executable (console) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0v5czuty.3sr.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3v3szqea.fmp.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lswi5yq0.wwv.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uo1kv32u.wya.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\4munRyMrBm.exe
"C:\Users\user\Desktop\4munRyMrBm.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
https://aka.ms/GlobalizationInvariantMode
unknown
http://smtp.ionos.com
unknown
https://account.dyn.com/
unknown
https://aka.ms/nativeaot-c
unknown
https://aka.ms/nativeaot-compatibility
unknown
https://aka.ms/nativeaot-compatibilityY
unknown
https://aka.ms/nativeaot-compatibilityy
unknown

Domains

Name
IP
Malicious
smtp.ionos.com
74.208.5.2
 malicious

IPs

IP
Domain
Country
Malicious
74.208.5.2
smtp.ionos.com
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
30A1000
trusted library allocation
page read and write
 malicious
1CFBD400000
direct allocation
page read and write
 malicious
30EE000
trusted library allocation
page read and write
 malicious
FE5000
trusted library allocation
page execute and read and write
10CB000
heap
page read and write
7FF7C5D09000
unkown
page readonly
FD6000
trusted library allocation
page execute and read and write
3114000
trusted library allocation
page read and write
FDA000
trusted library allocation
page execute and read and write
1030000
heap
page read and write
127E000
stack
page read and write
1080000
heap
page read and write
6330000
trusted library allocation
page read and write
576E000
stack
page read and write
FE2000
trusted library allocation
page read and write
51CE000
trusted library allocation
page read and write
1220000
trusted library allocation
page execute and read and write
1CFB90E0000
heap
page read and write
10C7000
heap
page read and write
1CFB91E0000
heap
page read and write
FB3000
trusted library allocation
page execute and read and write
6920000
trusted library allocation
page read and write
30EC000
trusted library allocation
page read and write
5398000
trusted library allocation
page read and write
7FF7C5BB0000
unkown
page readonly
51ED000
trusted library allocation
page read and write
6980000
heap
page read and write
7FF7C5D09000
unkown
page readonly
400000
remote allocation
page execute and read and write
FD2000
trusted library allocation
page read and write
FB4000
trusted library allocation
page read and write
535C000
stack
page read and write
5F64000
heap
page read and write
1CFB9130000
direct allocation
page read and write
6240000
trusted library allocation
page read and write
1CFBAC00000
direct allocation
page read and write
100E000
heap
page read and write
1CFB91E6000
heap
page read and write
572F000
stack
page read and write
2104F5D0000
heap
page read and write
62DE000
stack
page read and write
5200000
trusted library allocation
page read and write
5220000
heap
page read and write
6930000
trusted library allocation
page read and write
2C68000
trusted library allocation
page read and write
51DA000
trusted library allocation
page read and write
E70000
heap
page read and write
5210000
trusted library allocation
page read and write
7F3A0000
trusted library allocation
page execute and read and write
1CFB9100000
heap
page read and write
FD0000
trusted library allocation
page read and write
51F2000
trusted library allocation
page read and write
2104F6C1000
heap
page read and write
1CFB9000000
heap
page read and write
7FF7C5BB0000
unkown
page readonly
631E000
stack
page read and write
681E000
stack
page read and write
FF8000
heap
page read and write
1CFBF800000
direct allocation
page read and write
1CFC0C00000
direct allocation
page read and write
7FF7C5D79000
unkown
page write copy
FEB000
trusted library allocation
page execute and read and write
64DE000
stack
page read and write
7FF7C5D84000
unkown
page read and write
3108000
trusted library allocation
page read and write
2C5F000
stack
page read and write
102D000
heap
page read and write
C79000
stack
page read and write
E75000
heap
page read and write
30F6000
trusted library allocation
page read and write
61E6000
trusted library allocation
page read and write
51A0000
trusted library allocation
page read and write
1280000
heap
page read and write
4106000
trusted library allocation
page read and write
1CFB91EC000
heap
page read and write
40C9000
trusted library allocation
page read and write
519E000
stack
page read and write
623D000
stack
page read and write
FCD000
trusted library allocation
page execute and read and write
5F80000
heap
page read and write
3118000
trusted library allocation
page read and write
FE7000
trusted library allocation
page execute and read and write
51D2000
trusted library allocation
page read and write
FF0000
heap
page read and write
51C6000
trusted library allocation
page read and write
70DC77F000
stack
page read and write
5390000
trusted library allocation
page read and write
70DCA7F000
stack
page read and write
6960000
heap
page read and write
1CFBD000000
direct allocation
page read and write
61C0000
trusted library allocation
page read and write
1CFB9140000
direct allocation
page read and write
7FF7C5D79000
unkown
page read and write
FB0000
trusted library allocation
page read and write
7FF7C5D87000
unkown
page readonly
E40000
heap
page read and write
51DE000
trusted library allocation
page read and write
61E0000
trusted library allocation
page read and write
7FF7C5BB1000
unkown
page execute read
1CFB9241000
heap
page read and write
FBD000
trusted library allocation
page execute and read and write
54EE000
stack
page read and write
10BE000
heap
page read and write
2D40000
trusted library allocation
page read and write
1CFC0200000
direct allocation
page read and write
61F0000
trusted library allocation
page execute and read and write
20FC2AAA000
direct allocation
page read and write
DF0000
heap
page read and write
1230000
heap
page read and write
562E000
stack
page read and write
70DC8FF000
stack
page read and write
51E1000
trusted library allocation
page read and write
6970000
trusted library allocation
page execute and read and write
691F000
stack
page read and write
7FF7C5D87000
unkown
page readonly
20FCEACF000
direct allocation
page read and write
12B0000
heap
page read and write
6320000
trusted library allocation
page execute and read and write
DE0000
heap
page read and write
51B3000
heap
page read and write
70DC389000
stack
page read and write
2D3C000
stack
page read and write
51B0000
heap
page read and write
1CFBD003000
direct allocation
page read and write
7FF7C5D7F000
unkown
page read and write
6337000
trusted library allocation
page read and write
7FF7C5CC9000
unkown
page read and write
54AC000
stack
page read and write
55EF000
stack
page read and write
51E6000
trusted library allocation
page read and write
5F60000
heap
page read and write
7FF7C5BB1000
unkown
page execute read
40A1000
trusted library allocation
page read and write
D79000
stack
page read and write
2D50000
heap
page execute and read and write
51CB000
trusted library allocation
page read and write
FA0000
trusted library allocation
page read and write
61CC000
trusted library allocation
page read and write
51C0000
trusted library allocation
page read and write
1200000
trusted library allocation
page read and write
53A0000
heap
page execute and read and write
FC0000
trusted library allocation
page read and write
5FC2000
heap
page read and write
1CFB9480000
heap
page read and write
2104F6BE000
heap
page read and write
5E1F000
stack
page read and write
There are 137 hidden memdumps, click here to show them.