IOC Report
6bdudXAsQW.exe

loading gif

Files

File Path
Type
Category
Malicious
6bdudXAsQW.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZUHFqcY.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\Marquand
data
dropped
C:\Users\user\AppData\Local\Temp\autD26F.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autD2BE.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\incalculable
ASCII text, with very long lines (28674), with no line terminators
dropped
C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\6bdudXAsQW.exe
"C:\Users\user\Desktop\6bdudXAsQW.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\6bdudXAsQW.exe"
 malicious
C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
"C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe"
malicious
C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
"C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
unknown
http://ocsp.sectigo.com0A
unknown
https://sectigo.com/CPS0
unknown
https://account.dyn.com/
unknown
http://us2.smtp.mailhostbox.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
us2.smtp.mailhostbox.com
208.91.199.225
 malicious
ip-api.com
208.95.112.1
 malicious

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
208.91.199.225
us2.smtp.mailhostbox.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ZUHFqcY
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2477000
trusted library allocation
page read and write
 malicious
249C000
trusted library allocation
page read and write
 malicious
2451000
trusted library allocation
page read and write
 malicious
142000
system
page execute and read and write
 malicious
3500000
direct allocation
page read and write
 malicious
81F000
unkown
page read and write
EAC000
heap
page read and write
DF0000
heap
page read and write
6AD000
trusted library allocation
page execute and read and write
3590000
direct allocation
page read and write
340000
heap
page read and write
10D0000
trusted library allocation
page read and write
62A0000
heap
page read and write
D9F000
heap
page read and write
D68000
heap
page read and write
E6A000
heap
page read and write
5E10000
trusted library allocation
page read and write
C4F000
stack
page read and write
3663000
direct allocation
page read and write
4BBE000
stack
page read and write
840000
heap
page read and write
4F9000
stack
page read and write
3210000
heap
page execute and read and write
E53000
heap
page read and write
E62000
unkown
page readonly
614E000
stack
page read and write
EAB000
heap
page read and write
4F20000
trusted library allocation
page read and write
570B000
heap
page read and write
D5A000
heap
page read and write
3590000
direct allocation
page read and write
2A70000
heap
page execute and read and write
5CDD000
stack
page read and write
15A0000
trusted library allocation
page execute and read and write
E6A000
unkown
page readonly
5C64000
trusted library allocation
page read and write
F2E000
stack
page read and write
108B000
heap
page read and write
505E000
stack
page read and write
2930000
heap
page read and write
1554000
trusted library allocation
page read and write
E20000
heap
page read and write
7C0000
trusted library allocation
page read and write
1577000
trusted library allocation
page execute and read and write
C5B000
stack
page read and write
4973000
heap
page read and write
CC0000
heap
page read and write
150E000
stack
page read and write
13C8000
heap
page read and write
EFE000
heap
page read and write
F16000
heap
page read and write
F8D000
trusted library allocation
page execute and read and write
7C2000
trusted library allocation
page read and write
3A81000
trusted library allocation
page read and write
3809000
direct allocation
page read and write
761000
unkown
page execute read
D30000
heap
page read and write
4E3D000
stack
page read and write
4DFE000
stack
page read and write
1165000
heap
page read and write
10A000
stack
page read and write
4980000
heap
page read and write
5745000
heap
page read and write
52DE000
stack
page read and write
1570000
trusted library allocation
page read and write
7D7000
trusted library allocation
page execute and read and write
385D000
direct allocation
page read and write
36E0000
direct allocation
page read and write
BA0000
heap
page read and write
62B0000
trusted library allocation
page read and write
1543000
trusted library allocation
page execute and read and write
5C80000
trusted library allocation
page read and write
387E000
direct allocation
page read and write
1530000
trusted library allocation
page read and write
2A60000
trusted library allocation
page execute and read and write
4C5D000
stack
page read and write
3730000
direct allocation
page read and write
786000
heap
page read and write
10F0000
trusted library allocation
page read and write
489D000
trusted library allocation
page read and write
E5B000
heap
page read and write
D0E000
stack
page read and write
1C0000
heap
page read and write
EFF000
heap
page read and write
83E000
stack
page read and write
5CE0000
trusted library allocation
page execute and read and write
3D0000
heap
page read and write
D9B000
heap
page read and write
B65000
heap
page read and write
EAC000
heap
page read and write
3730000
direct allocation
page read and write
19B0000
trusted library allocation
page execute and read and write
730000
heap
page read and write
D38000
heap
page read and write
3421000
trusted library allocation
page read and write
5D30000
trusted library allocation
page execute and read and write
5B0E000
stack
page read and write
C3F000
stack
page read and write
A76000
heap
page read and write
1135000
heap
page read and write
488A000
trusted library allocation
page read and write
F74000
trusted library allocation
page read and write
2300000
heap
page execute and read and write
19A0000
trusted library allocation
page read and write
380D000
direct allocation
page read and write
62D0000
heap
page read and write
380D000
direct allocation
page read and write
7C6000
trusted library allocation
page execute and read and write
4882000
trusted library allocation
page read and write
ECC000
heap
page read and write
248A000
trusted library allocation
page read and write
F7D000
trusted library allocation
page execute and read and write
48A2000
trusted library allocation
page read and write
E52000
heap
page read and write
36B3000
direct allocation
page read and write
720000
heap
page read and write
12A5000
heap
page read and write
487E000
trusted library allocation
page read and write
38CE000
direct allocation
page read and write
515E000
stack
page read and write
36E0000
direct allocation
page read and write
19C0000
heap
page read and write
FDF000
heap
page read and write
5B1E000
stack
page read and write
3859000
direct allocation
page read and write
FC0000
heap
page read and write
F80000
trusted library allocation
page read and write
CBE000
stack
page read and write
FC3000
heap
page read and write
529E000
stack
page read and write
3540000
direct allocation
page read and write
113F000
heap
page read and write
750000
direct allocation
page execute and read and write
48C0000
trusted library allocation
page read and write
4F1D000
stack
page read and write
56E0000
heap
page read and write
761000
unkown
page execute read
EDC000
heap
page read and write
EFC000
stack
page read and write
14CE000
stack
page read and write
575000
heap
page read and write
140000
system
page execute and read and write
38E000
stack
page read and write
7EF000
unkown
page readonly
2310000
heap
page read and write
4860000
trusted library allocation
page read and write
487B000
trusted library allocation
page read and write
4970000
heap
page read and write
3859000
direct allocation
page read and write
540000
heap
page read and write
1550000
trusted library allocation
page read and write
7F0000
trusted library allocation
page read and write
3540000
direct allocation
page read and write
A50000
trusted library allocation
page execute and read and write
3221000
trusted library allocation
page read and write
6DE000
heap
page read and write
10CF000
stack
page read and write
1270000
heap
page read and write
2498000
trusted library allocation
page read and write
3540000
direct allocation
page read and write
7D5000
trusted library allocation
page execute and read and write
EAD000
heap
page read and write
48B0000
heap
page execute and read and write
A3C000
stack
page read and write
1159000
heap
page read and write
78E000
heap
page read and write
38CE000
direct allocation
page read and write
3730000
direct allocation
page read and write
1005000
heap
page read and write
748000
heap
page read and write
247D000
trusted library allocation
page read and write
110D000
heap
page read and write
1042000
heap
page read and write
1117000
heap
page read and write
1110000
heap
page read and write
24AB000
trusted library allocation
page read and write
6A4000
trusted library allocation
page read and write
4960000
heap
page read and write
1121000
heap
page read and write
38CE000
direct allocation
page read and write
4CFE000
stack
page read and write
7CA000
trusted library allocation
page execute and read and write
2D9000
stack
page read and write
10F7000
heap
page read and write
FA7000
trusted library allocation
page execute and read and write
2A3E000
stack
page read and write
3080000
heap
page read and write
380D000
direct allocation
page read and write
828000
unkown
page readonly
570D000
heap
page read and write
A60000
trusted library allocation
page read and write
13B5000
heap
page read and write
5C9B000
trusted library allocation
page read and write
15C0000
heap
page read and write
3663000
direct allocation
page read and write
3663000
direct allocation
page read and write
F84000
trusted library allocation
page read and write
36B3000
direct allocation
page read and write
815000
unkown
page readonly
1100000
trusted library allocation
page read and write
380D000
direct allocation
page read and write
F94000
heap
page read and write
6A0000
trusted library allocation
page read and write
1D0000
heap
page read and write
3809000
direct allocation
page read and write
690000
trusted library allocation
page read and write
579E000
stack
page read and write
53DE000
stack
page read and write
2421000
trusted library allocation
page read and write
E28000
heap
page read and write
7D2000
trusted library allocation
page read and write
241E000
stack
page read and write
6BD000
trusted library allocation
page execute and read and write
28FE000
stack
page read and write
2A81000
trusted library allocation
page read and write
6B0000
trusted library allocation
page read and write
3540000
direct allocation
page read and write
17E000
system
page execute and read and write
16CF000
stack
page read and write
1398000
heap
page read and write
6A3000
trusted library allocation
page execute and read and write
3CE000
stack
page read and write
B3A000
stack
page read and write
5D2E000
stack
page read and write
604E000
stack
page read and write
6C8000
heap
page read and write
2475000
trusted library allocation
page read and write
E57000
heap
page read and write
4870000
trusted library allocation
page read and write
F35000
heap
page read and write
4B5C000
stack
page read and write
5A0F000
stack
page read and write
451D000
stack
page read and write
5B5E000
stack
page read and write
7A1000
heap
page read and write
A70000
heap
page read and write
1A1F000
stack
page read and write
F60000
trusted library allocation
page read and write
387E000
direct allocation
page read and write
6EA000
heap
page read and write
1390000
heap
page read and write
15B0000
trusted library allocation
page read and write
5C77000
trusted library allocation
page read and write
318F000
stack
page read and write
24A4000
trusted library allocation
page read and write
519E000
stack
page read and write
1510000
heap
page read and write
387E000
direct allocation
page read and write
385D000
direct allocation
page read and write
385D000
direct allocation
page read and write
17CF000
stack
page read and write
F30000
heap
page read and write
81F000
unkown
page write copy
492C000
stack
page read and write
3F4000
heap
page read and write
3859000
direct allocation
page read and write
FFA000
stack
page read and write
828000
unkown
page readonly
B60000
heap
page read and write
4FC0000
heap
page execute and read and write
55DE000
stack
page read and write
5C70000
trusted library allocation
page read and write
823000
unkown
page write copy
5760000
heap
page read and write
7EF000
unkown
page readonly
3F0000
heap
page read and write
6C0000
heap
page read and write
D55000
heap
page read and write
155D000
trusted library allocation
page execute and read and write
6F6000
heap
page read and write
3663000
direct allocation
page read and write
4221000
trusted library allocation
page read and write
36E0000
direct allocation
page read and write
3449000
trusted library allocation
page read and write
E60000
unkown
page readonly
F73000
trusted library allocation
page execute and read and write
1260000
heap
page read and write
575E000
stack
page read and write
4876000
trusted library allocation
page read and write
3590000
direct allocation
page read and write
760000
unkown
page readonly
31CC000
stack
page read and write
22FC000
stack
page read and write
36B3000
direct allocation
page read and write
EAB000
heap
page read and write
815000
unkown
page readonly
7BD000
heap
page read and write
760000
unkown
page readonly
FAB000
trusted library allocation
page execute and read and write
488E000
trusted library allocation
page read and write
570000
heap
page read and write
12A0000
heap
page read and write
EAD000
heap
page read and write
10E0000
trusted library allocation
page execute and read and write
1590000
trusted library allocation
page read and write
590E000
stack
page read and write
E5B000
heap
page read and write
199E000
stack
page read and write
4B7C000
stack
page read and write
387E000
direct allocation
page read and write
36E0000
direct allocation
page read and write
E6A000
heap
page read and write
4896000
trusted library allocation
page read and write
258F000
trusted library allocation
page read and write
154D000
trusted library allocation
page execute and read and write
531E000
stack
page read and write
161E000
stack
page read and write
5C60000
trusted library allocation
page read and write
5C5D000
stack
page read and write
3809000
direct allocation
page read and write
157B000
trusted library allocation
page execute and read and write
348E000
trusted library allocation
page read and write
48D0000
trusted library allocation
page read and write
C7D000
stack
page read and write
3809000
direct allocation
page read and write
6F4000
heap
page read and write
4CBE000
stack
page read and write
571E000
stack
page read and write
7DB000
trusted library allocation
page execute and read and write
2228000
trusted library allocation
page read and write
4891000
trusted library allocation
page read and write
1033000
heap
page read and write
5800000
heap
page execute and read and write
1544000
trusted library allocation
page read and write
5C90000
trusted library allocation
page read and write
There are 315 hidden memdumps, click here to show them.