IOC Report
SecuriteInfo.com.W64.MSIL_Rozena.H.gen.Eldorado.13862.32197.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.W64.MSIL_Rozena.H.gen.Eldorado.13862.32197.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\bat.bat
Java archive data (JAR)
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.W64.MSIL_Rozena.H.gen.Eldorado.13862.32197.exe.log
CSV text
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\tech.exe
Java archive data (JAR)
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.W64.MSIL_Rozena.H.gen.Eldorado.13862.32197.exe
"C:\Users\user\Desktop\SecuriteInfo.com.W64.MSIL_Rozena.H.gen.Eldorado.13862.32197.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://github.com
unknown
https://raw.githubusercontent.com(
unknown
https://raw.githubusercontent.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/rolc4/jar/raw/main/MinecraftHelper.jar
140.82.121.4
https://raw.githubusercontent.com/rolc4/jar/main/MinecraftHelper.jar
185.199.109.133
https://github.com
unknown
http://raw.githubusercontent.com
unknown

Domains

Name
IP
Malicious
github.com
140.82.121.4
raw.githubusercontent.com
185.199.109.133

IPs

IP
Domain
Country
Malicious
185.199.109.133
raw.githubusercontent.com
Netherlands
140.82.121.4
github.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
193F4BE4000
heap
page read and write
19747FE000
stack
page read and write
193F4DF0000
trusted library allocation
page read and write
193F4ED5000
heap
page read and write
1974FFE000
stack
page read and write
7FF49FEE0000
trusted library allocation
page execute and read and write
7FFD345F0000
trusted library allocation
page execute and read and write
7FFD3458C000
trusted library allocation
page execute and read and write
193F4F40000
heap
page read and write
7FFD345E0000
trusted library allocation
page read and write
193F7070000
heap
page read and write
7FFD3453D000
trusted library allocation
page execute and read and write
19727FE000
stack
page read and write
193F4C90000
heap
page read and write
1972BFE000
stack
page read and write
193800C4000
trusted library allocation
page read and write
193F4DA0000
heap
page read and write
19380138000
trusted library allocation
page read and write
193F4C1F000
heap
page read and write
7FFD345EC000
trusted library allocation
page execute and read and write
193F4AF4000
unkown
page readonly
193800A7000
trusted library allocation
page read and write
7FFD34554000
trusted library allocation
page read and write
1971DDE000
stack
page read and write
193F4BF2000
heap
page read and write
193800BB000
trusted library allocation
page read and write
193F4BDD000
heap
page read and write
193F4BB0000
heap
page read and write
19380140000
trusted library allocation
page read and write
1938009E000
trusted library allocation
page read and write
193F7090000
heap
page read and write
193800B9000
trusted library allocation
page read and write
7FFD34534000
trusted library allocation
page read and write
193F4D80000
heap
page read and write
7FFD3455D000
trusted library allocation
page execute and read and write
7FFD346D0000
trusted library allocation
page read and write
193F4BB6000
heap
page read and write
193F4F45000
heap
page read and write
193F4B90000
heap
page read and write
19380172000
trusted library allocation
page read and write
19723E9000
stack
page read and write
193F4AF0000
unkown
page readonly
19743FC000
stack
page read and write
193F6810000
heap
page read and write
1974BFE000
stack
page read and write
197583E000
stack
page read and write
1975C3C000
stack
page read and write
19757FE000
stack
page read and write
19753FE000
stack
page read and write
19380102000
trusted library allocation
page read and write
19380001000
trusted library allocation
page read and write
7FFD34550000
trusted library allocation
page read and write
193800C8000
trusted library allocation
page read and write
19380104000
trusted library allocation
page read and write
7FFD345E6000
trusted library allocation
page read and write
193F70C4000
heap
page read and write
193F4ED0000
heap
page read and write
193F4E10000
trusted library allocation
page read and write
19733FD000
stack
page read and write
1973BFE000
stack
page read and write
193F4BF0000
heap
page read and write
7FFD34542000
trusted library allocation
page read and write
7FFD34616000
trusted library allocation
page execute and read and write
193F69A0000
heap
page execute and read and write
193F4C23000
heap
page read and write
193800E7000
trusted library allocation
page read and write
1973FFE000
stack
page read and write
19380144000
trusted library allocation
page read and write
7FFD34533000
trusted library allocation
page execute and read and write
1938013C000
trusted library allocation
page read and write
193F4BBC000
heap
page read and write
1938016C000
trusted library allocation
page read and write
7FFD34540000
trusted library allocation
page read and write
7FFD346E0000
trusted library allocation
page execute and read and write
193F4AF2000
unkown
page readonly
193800CC000
trusted library allocation
page read and write
193F7210000
heap
page execute and read and write
19737FE000
stack
page read and write
193F4C1D000
heap
page read and write
19390001000
trusted library allocation
page read and write
7FFD3454D000
trusted library allocation
page execute and read and write
19380170000
trusted library allocation
page read and write
193F4B80000
heap
page read and write
1972FFE000
stack
page read and write
7FFD34650000
trusted library allocation
page execute and read and write
There are 75 hidden memdumps, click here to show them.