IOC Report
SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp496E.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\XClient.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\pNYyTm.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\pNYyTm.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pNYyTm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
modified
C:\Users\user\AppData\Local\Temp\Log.tmp
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bkznsjo.q05.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_akd2gzge.xtu.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ckwrtllv.ppw.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_me1zbdde.d2r.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oba4v0sr.iuv.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0u5ydwp.odu.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1necarw.5ft.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rpsbq43u.e0h.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp6051.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jul 18 05:35:14 2024, mtime=Thu Jul 18 05:35:14 2024, atime=Thu Jul 18 05:35:14 2024, length=479744, window=hide
dropped
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pNYyTm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp496E.tmp"
 malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
 malicious
C:\Users\user\AppData\Roaming\pNYyTm.exe
C:\Users\user\AppData\Roaming\pNYyTm.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp6051.tmp"
 malicious
C:\Users\user\AppData\Roaming\pNYyTm.exe
"C:\Users\user\AppData\Roaming\pNYyTm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
moneymaker-30608.portmap.host
malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
moneymaker-30608.portmap.host
193.161.193.99
 malicious

IPs

IP
Domain
Country
Malicious
193.161.193.99
moneymaker-30608.portmap.host
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
341E000
trusted library allocation
page read and write
 malicious
2731000
trusted library allocation
page read and write
 malicious
33C1000
trusted library allocation
page read and write
 malicious
55F0000
trusted library section
page read and write
 malicious
2E81000
trusted library allocation
page read and write
 malicious
2EDE000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
837E000
stack
page read and write
1720000
trusted library allocation
page read and write
E00000
heap
page read and write
5644000
trusted library allocation
page read and write
4688000
trusted library allocation
page read and write
58F0000
trusted library allocation
page read and write
B17000
heap
page read and write
65AD000
heap
page read and write
E56000
heap
page read and write
11BF000
stack
page read and write
5850000
trusted library allocation
page read and write
A33000
trusted library allocation
page read and write
906E000
stack
page read and write
5840000
trusted library allocation
page read and write
65BD000
heap
page read and write
580C000
trusted library allocation
page read and write
1710000
trusted library allocation
page read and write
61E0000
heap
page read and write
6B9C000
stack
page read and write
78DF000
stack
page read and write
2D40000
trusted library allocation
page read and write
5B80000
trusted library allocation
page read and write
53DE000
trusted library allocation
page read and write
172D000
trusted library allocation
page execute and read and write
8F2E000
stack
page read and write
582E000
trusted library allocation
page read and write
19FE000
stack
page read and write
5B8E000
stack
page read and write
E91000
heap
page read and write
12AD000
stack
page read and write
1474000
heap
page read and write
FE0000
heap
page read and write
8E2E000
stack
page read and write
5672000
trusted library allocation
page read and write
58A0000
heap
page execute and read and write
2D70000
heap
page read and write
1740000
trusted library allocation
page read and write
1723000
trusted library allocation
page read and write
2F19000
trusted library allocation
page read and write
34BF000
stack
page read and write
6440000
trusted library allocation
page execute and read and write
68CE000
stack
page read and write
7F290000
trusted library allocation
page execute and read and write
4CBE000
stack
page read and write
5C8E000
stack
page read and write
6560000
heap
page read and write
15E0000
heap
page read and write
1228000
heap
page read and write
565E000
trusted library allocation
page read and write
37CE000
trusted library allocation
page read and write
2D50000
heap
page execute and read and write
63B0000
trusted library allocation
page read and write
80EE000
stack
page read and write
126E000
stack
page read and write
58CE000
stack
page read and write
DB7000
stack
page read and write
6450000
trusted library allocation
page execute and read and write
11D4000
trusted library allocation
page read and write
5490000
trusted library allocation
page execute and read and write
53A0000
trusted library allocation
page read and write
5F29000
heap
page read and write
32A3000
heap
page read and write
53ED000
trusted library allocation
page read and write
19BE000
stack
page read and write
7FEE000
stack
page read and write
8DF000
unkown
page read and write
5BC0000
trusted library allocation
page read and write
A57000
trusted library allocation
page execute and read and write
AA0000
trusted library allocation
page read and write
8ACE000
stack
page read and write
3811000
trusted library allocation
page read and write
54BC000
stack
page read and write
E43000
heap
page read and write
638F000
trusted library allocation
page read and write
152F000
heap
page read and write
655E000
stack
page read and write
4051000
trusted library allocation
page read and write
5690000
trusted library allocation
page read and write
12A0000
trusted library allocation
page read and write
17EE000
stack
page read and write
A60000
heap
page read and write
63C0000
heap
page read and write
3E81000
trusted library allocation
page read and write
7C1F000
stack
page read and write
7FAE000
stack
page read and write
5670000
trusted library allocation
page execute and read and write
3731000
trusted library allocation
page read and write
4EC5000
trusted library allocation
page read and write
60D0000
heap
page read and write
590B000
stack
page read and write
F30000
trusted library allocation
page read and write
53CB000
trusted library allocation
page read and write
1220000
trusted library allocation
page read and write
5540000
heap
page read and write
329F000
trusted library allocation
page read and write
680D000
stack
page read and write
9D0000
heap
page read and write
1770000
heap
page read and write
6360000
trusted library allocation
page execute and read and write
791D000
stack
page read and write
2CFE000
stack
page read and write
5982000
trusted library allocation
page read and write
690C000
stack
page read and write
1100000
heap
page read and write
2FB0000
heap
page read and write
C19000
heap
page read and write
72F1000
trusted library allocation
page read and write
A5B000
trusted library allocation
page execute and read and write
515F000
stack
page read and write
6387000
trusted library allocation
page read and write
114E000
heap
page read and write
564B000
trusted library allocation
page read and write
5832000
trusted library allocation
page read and write
46DB000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
63D0000
trusted library allocation
page read and write
A30000
trusted library allocation
page read and write
115F000
heap
page read and write
2668000
trusted library allocation
page read and write
A3D000
trusted library allocation
page execute and read and write
1167000
heap
page read and write
91D0000
trusted library allocation
page read and write
66CE000
stack
page read and write
53C4000
trusted library allocation
page read and write
11F2000
heap
page read and write
C85000
heap
page read and write
A10000
trusted library allocation
page read and write
61DD000
stack
page read and write
5B7C000
stack
page read and write
1440000
trusted library allocation
page execute and read and write
147F000
heap
page read and write
11E0000
trusted library allocation
page read and write
4CC9000
trusted library allocation
page read and write
AC0000
heap
page execute and read and write
5980000
trusted library allocation
page read and write
B9E000
stack
page read and write
11FB000
trusted library allocation
page execute and read and write
1539000
heap
page read and write
8C6E000
stack
page read and write
144E000
heap
page read and write
BFD000
heap
page read and write
684E000
stack
page read and write
2720000
heap
page read and write
5960000
trusted library allocation
page execute and read and write
11D7000
stack
page read and write
3290000
trusted library allocation
page read and write
1467000
heap
page read and write
5CCE000
heap
page read and write
197F000
stack
page read and write
548F000
stack
page read and write
53E1000
trusted library allocation
page read and write
55B000
stack
page read and write
2D5A000
heap
page read and write
BA7000
stack
page read and write
BD5000
heap
page read and write
1736000
trusted library allocation
page execute and read and write
5666000
trusted library allocation
page read and write
3F73000
trusted library allocation
page read and write
91B0000
heap
page read and write
C6E000
heap
page read and write
4D1E000
stack
page read and write
31C0000
trusted library allocation
page read and write
5480000
trusted library allocation
page read and write
820000
heap
page read and write
5AA0000
trusted library allocation
page read and write
468F000
trusted library allocation
page read and write
56D0000
heap
page execute and read and write
91AC000
stack
page read and write
5800000
trusted library allocation
page read and write
FE5000
heap
page read and write
57DF000
trusted library allocation
page read and write
4CC0000
trusted library allocation
page read and write
12B0000
heap
page read and write
127E000
stack
page read and write
574E000
stack
page read and write
3459000
trusted library allocation
page read and write
1760000
trusted library allocation
page read and write
57DD000
trusted library allocation
page read and write
53C0000
trusted library allocation
page read and write
BA8000
heap
page read and write
5B2D000
stack
page read and write
DE0000
heap
page read and write
1412000
trusted library allocation
page read and write
6380000
trusted library allocation
page read and write
1700000
trusted library allocation
page read and write
13FE000
stack
page read and write
33BE000
stack
page read and write
65C0000
heap
page read and write
640B000
stack
page read and write
57E0000
heap
page read and write
17A4000
trusted library allocation
page read and write
5482000
trusted library allocation
page read and write
A52000
trusted library allocation
page read and write
1400000
trusted library allocation
page read and write
6CDE000
stack
page read and write
3280000
trusted library allocation
page read and write
A80000
trusted library allocation
page read and write
2D60000
trusted library allocation
page read and write
BD2000
heap
page read and write
5CCC000
heap
page read and write
505B000
stack
page read and write
459E000
trusted library allocation
page read and write
53BF000
stack
page read and write
11D0000
trusted library allocation
page read and write
5680000
trusted library section
page read and write
5810000
trusted library allocation
page read and write
A20000
trusted library allocation
page read and write
C73000
heap
page read and write
58C0000
heap
page read and write
12B0000
heap
page read and write
1540000
heap
page read and write
32A0000
heap
page read and write
5640000
trusted library allocation
page read and write
E48000
heap
page read and write
325C000
stack
page read and write
19D9000
heap
page read and write
32B0000
heap
page read and write
5410000
trusted library allocation
page read and write
10DA000
stack
page read and write
5610000
heap
page read and write
5870000
trusted library allocation
page read and write
E10000
heap
page read and write
15E5000
heap
page read and write
1742000
trusted library allocation
page read and write
89E000
unkown
page read and write
830000
heap
page read and write
2F90000
heap
page read and write
323F000
unkown
page read and write
11C4000
trusted library allocation
page read and write
F40000
heap
page read and write
123C000
heap
page read and write
795E000
stack
page read and write
659A000
heap
page read and write
141B000
trusted library allocation
page execute and read and write
C26000
unkown
page readonly
56B0000
trusted library allocation
page read and write
3286000
trusted library allocation
page read and write
2D3E000
stack
page read and write
4D70000
heap
page execute and read and write
1A3E000
stack
page read and write
60AD000
stack
page read and write
1747000
trusted library allocation
page execute and read and write
F47000
heap
page read and write
1140000
heap
page read and write
482E000
stack
page read and write
1440000
heap
page read and write
A23000
trusted library allocation
page execute and read and write
53B3000
heap
page read and write
6DDE000
stack
page read and write
BB2000
unkown
page readonly
1430000
heap
page read and write
525E000
stack
page read and write
4CD0000
heap
page read and write
1714000
trusted library allocation
page read and write
1406000
trusted library allocation
page execute and read and write
6C9E000
stack
page read and write
265E000
stack
page read and write
4EC0000
trusted library allocation
page read and write
5960000
trusted library allocation
page execute and read and write
566D000
trusted library allocation
page read and write
327E000
stack
page read and write
11F7000
trusted library allocation
page execute and read and write
7E6E000
stack
page read and write
5B0000
heap
page read and write
5430000
trusted library allocation
page read and write
57D0000
trusted library allocation
page read and write
11F0000
trusted library allocation
page read and write
32B0000
heap
page read and write
1732000
trusted library allocation
page read and write
1459000
heap
page read and write
5F20000
heap
page read and write
A24000
trusted library allocation
page read and write
850000
heap
page read and write
565E000
stack
page read and write
5940000
trusted library allocation
page read and write
5660000
trusted library allocation
page read and write
16C0000
heap
page read and write
5970000
heap
page read and write
76C0000
trusted library allocation
page read and write
14AB000
heap
page read and write
57B8000
stack
page read and write
688E000
stack
page read and write
1730000
trusted library allocation
page read and write
4F5C000
stack
page read and write
593E000
stack
page read and write
656D000
stack
page read and write
1290000
trusted library allocation
page read and write
5804000
trusted library allocation
page read and write
3284000
trusted library allocation
page read and write
1410000
trusted library allocation
page read and write
19AD000
stack
page read and write
8DEF000
stack
page read and write
5817000
trusted library allocation
page read and write
1020000
heap
page read and write
5639000
stack
page read and write
11C3000
trusted library allocation
page execute and read and write
58E0000
trusted library allocation
page read and write
4D5E000
stack
page read and write
3059000
trusted library allocation
page read and write
6A0D000
stack
page read and write
A40000
trusted library allocation
page read and write
4CD3000
heap
page read and write
1790000
heap
page execute and read and write
812C000
stack
page read and write
12A3000
trusted library allocation
page read and write
3F25000
trusted library allocation
page read and write
8CEE000
stack
page read and write
E20000
heap
page read and write
65B5000
heap
page read and write
43C1000
trusted library allocation
page read and write
140A000
trusted library allocation
page execute and read and write
A4A000
trusted library allocation
page execute and read and write
3270000
heap
page execute and read and write
53F2000
trusted library allocation
page read and write
5BD0000
trusted library allocation
page execute and read and write
171D000
trusted library allocation
page execute and read and write
5814000
trusted library allocation
page read and write
3051000
trusted library allocation
page read and write
5827000
trusted library allocation
page read and write
E27000
heap
page read and write
53F0000
trusted library allocation
page read and write
8F6E000
stack
page read and write
53B0000
heap
page read and write
4ECF000
trusted library allocation
page read and write
31CE000
trusted library allocation
page read and write
5FC000
stack
page read and write
BB0000
unkown
page readonly
A90000
trusted library allocation
page execute and read and write
7F580000
trusted library allocation
page execute and read and write
117F000
heap
page read and write
2E7E000
stack
page read and write
881E000
stack
page read and write
63CB000
stack
page read and write
11E6000
trusted library allocation
page execute and read and write
BA0000
heap
page read and write
1534000
heap
page read and write
2FDE000
unkown
page read and write
463C000
trusted library allocation
page read and write
A42000
trusted library allocation
page read and write
553A000
stack
page read and write
90AC000
stack
page read and write
6020000
trusted library section
page read and write
822C000
stack
page read and write
19C0000
trusted library allocation
page execute and read and write
B0E000
stack
page read and write
63A0000
trusted library allocation
page read and write
58D2000
trusted library allocation
page read and write
44B3000
trusted library allocation
page read and write
8F7000
stack
page read and write
1C3F000
stack
page read and write
564F000
stack
page read and write
1481000
heap
page read and write
BC9000
heap
page read and write
A2D000
trusted library allocation
page execute and read and write
13BE000
stack
page read and write
5CB0000
heap
page read and write
1402000
trusted library allocation
page read and write
4F0E000
stack
page read and write
29CF000
stack
page read and write
3ED7000
trusted library allocation
page read and write
91F0000
trusted library allocation
page read and write
32BB000
heap
page read and write
1280000
trusted library allocation
page read and write
1713000
trusted library allocation
page execute and read and write
7B1E000
stack
page read and write
6B50000
heap
page read and write
53AF000
trusted library allocation
page read and write
1780000
trusted library allocation
page read and write
19D0000
heap
page read and write
45F1000
trusted library allocation
page read and write
7FC00000
trusted library allocation
page execute and read and write
6460000
heap
page read and write
1174000
heap
page read and write
54FD000
stack
page read and write
5405000
trusted library allocation
page read and write
6597000
heap
page read and write
C98000
heap
page read and write
6B4D000
stack
page read and write
2FE0000
heap
page read and write
7D6E000
stack
page read and write
56C0000
trusted library allocation
page read and write
659E000
heap
page read and write
53E6000
trusted library allocation
page read and write
174B000
trusted library allocation
page execute and read and write
6450000
trusted library allocation
page execute and read and write
7BA000
stack
page read and write
827D000
stack
page read and write
4EBE000
stack
page read and write
298E000
stack
page read and write
1181000
heap
page read and write
77D000
stack
page read and write
3E89000
trusted library allocation
page read and write
31C5000
trusted library allocation
page read and write
177E000
stack
page read and write
F9E000
stack
page read and write
14DE000
heap
page read and write
144A000
heap
page read and write
151A000
heap
page read and write
5470000
heap
page read and write
11AE000
heap
page read and write
5819000
trusted library allocation
page read and write
1294000
trusted library allocation
page read and write
2F2A000
stack
page read and write
129D000
trusted library allocation
page execute and read and write
32A0000
heap
page read and write
3260000
trusted library allocation
page read and write
6580000
heap
page read and write
1800000
heap
page read and write
6570000
heap
page read and write
53FE000
stack
page read and write
187F000
stack
page read and write
492E000
stack
page read and write
5821000
trusted library allocation
page read and write
5A70000
trusted library allocation
page execute and read and write
11EA000
trusted library allocation
page execute and read and write
5CBD000
heap
page read and write
1293000
trusted library allocation
page execute and read and write
5400000
trusted library allocation
page read and write
56B9000
stack
page read and write
659C000
heap
page read and write
751E000
stack
page read and write
2D50000
heap
page read and write
58D0000
trusted library allocation
page read and write
43C9000
trusted library allocation
page read and write
A46000
trusted library allocation
page execute and read and write
FD0000
trusted library allocation
page read and write
F5E000
stack
page read and write
31BE000
stack
page read and write
173A000
trusted library allocation
page execute and read and write
1210000
heap
page read and write
1450000
heap
page read and write
5F39000
heap
page read and write
3560000
heap
page read and write
19B0000
heap
page execute and read and write
5940000
trusted library allocation
page execute and read and write
5845000
trusted library allocation
page read and write
AAB000
stack
page read and write
B5C000
stack
page read and write
89CE000
stack
page read and write
1430000
trusted library allocation
page read and write
12E0000
heap
page read and write
D9D000
stack
page read and write
12AD000
trusted library allocation
page execute and read and write
5AB0000
heap
page read and write
52BE000
stack
page read and write
8230000
heap
page read and write
67CF000
stack
page read and write
145F000
heap
page read and write
1B3F000
stack
page read and write
1417000
trusted library allocation
page execute and read and write
B10000
heap
page read and write
5661000
trusted library allocation
page read and write
12D0000
trusted library allocation
page execute and read and write
2D6D000
heap
page read and write
15CE000
stack
page read and write
6A4C000
stack
page read and write
405E000
trusted library allocation
page read and write
17A0000
trusted library allocation
page read and write
158E000
stack
page read and write
CB9000
stack
page read and write
6299000
stack
page read and write
581E000
trusted library allocation
page read and write
2EED000
stack
page read and write
5BE0000
trusted library allocation
page read and write
505E000
stack
page read and write
8380000
trusted library allocation
page read and write
7EAE000
stack
page read and write
There are 464 hidden memdumps, click here to show them.