IOC Report
LisectAVT_2403002A_96.exe

loading gif

Files

File Path
Type
Category
Malicious
LisectAVT_2403002A_96.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_96.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LisectAVT_2403002A_96.exe
"C:\Users\user\Desktop\LisectAVT_2403002A_96.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
edurestunningcrackyow.fun
malicious
pooreveningfuseor.pw
malicious
associationokeo.shop
malicious
colorfulequalugliess.shop
malicious
turkeyunlikelyofw.shop
malicious
detectordiscusser.shop
malicious
relevantvoicelesskw.shop
malicious
wisemassiveharmonious.shop
malicious
sailsystemeyeusjw.shop
malicious
https://sailsystemeyeusjw.shop/
unknown
https://associationokeo.shop/api
unknown
https://sailsystemeyeusjw.shop/.
unknown
https://turkeyunlikelyofw.shop/api
unknown
https://associationokeo.shop//i
unknown
https://detectordiscusser.shop/
unknown
https://turkeyunlikelyofw.shop/
unknown
https://associationokeo.shop//
unknown
https://associationokeo.shop/
unknown
https://pooreveningfuseor.pw/
unknown
https://pooreveningfuseor.pw//
unknown
There are 10 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
edurestunningcrackyow.fun
unknown
 malicious
turkeyunlikelyofw.shop
unknown
 malicious
detectordiscusser.shop
unknown
 malicious
relevantvoicelesskw.shop
unknown
 malicious
pooreveningfuseor.pw
unknown
 malicious
wisemassiveharmonious.shop
unknown
 malicious
associationokeo.shop
unknown
 malicious
sailsystemeyeusjw.shop
unknown
 malicious
colorfulequalugliess.shop
unknown
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
14D0000
heap
page read and write
C83000
heap
page read and write
750000
unkown
page readonly
CB0000
heap
page read and write
C4E000
heap
page read and write
4F10000
trusted library allocation
page read and write
2AD1000
trusted library allocation
page read and write
F4C000
stack
page read and write
14F8000
heap
page read and write
445000
remote allocation
page execute and read and write
1070000
heap
page read and write
14CD000
stack
page read and write
7A2000
unkown
page readonly
368E000
stack
page read and write
C6B000
heap
page read and write
2ACF000
stack
page read and write
140E000
stack
page read and write
1522000
heap
page read and write
FB0000
heap
page read and write
CB6000
heap
page read and write
152C000
heap
page read and write
104E000
stack
page read and write
12FC000
stack
page read and write
752000
unkown
page readonly
B3B000
stack
page read and write
100E000
stack
page read and write
FC0000
heap
page read and write
2D9A000
trusted library allocation
page read and write
1050000
heap
page execute and read and write
C0E000
stack
page read and write
148D000
stack
page read and write
1660000
heap
page read and write
CAC000
heap
page read and write
117E000
stack
page read and write
BA0000
heap
page read and write
C6D000
heap
page read and write
E64000
trusted library allocation
page read and write
E97000
trusted library allocation
page execute and read and write
1509000
heap
page read and write
E50000
trusted library allocation
page read and write
E70000
trusted library allocation
page read and write
E63000
trusted library allocation
page execute and read and write
1445000
heap
page read and write
3AD5000
trusted library allocation
page read and write
BC0000
heap
page read and write
C76000
heap
page read and write
CAA000
heap
page read and write
2F0F000
stack
page read and write
160E000
stack
page read and write
151F000
heap
page read and write
C48000
heap
page read and write
A3C000
stack
page read and write
2AD6000
trusted library allocation
page read and write
C40000
heap
page read and write
1504000
heap
page read and write
358E000
stack
page read and write
310D000
stack
page read and write
4BCE000
stack
page read and write
EB0000
heap
page read and write
320F000
stack
page read and write
1510000
heap
page read and write
BB0000
heap
page read and write
300E000
stack
page read and write
E74000
trusted library allocation
page read and write
FBF000
stack
page read and write
C81000
heap
page read and write
29C0000
heap
page read and write
4F30000
trusted library allocation
page read and write
E9B000
trusted library allocation
page execute and read and write
E4E000
stack
page read and write
3AD1000
trusted library allocation
page read and write
1535000
heap
page read and write
14DA000
heap
page read and write
1440000
heap
page read and write
1060000
trusted library allocation
page execute and read and write
1410000
heap
page read and write
2AD5000
trusted library allocation
page execute and read and write
There are 68 hidden memdumps, click here to show them.