IOC Report
C1ZsNxSer8.exe

loading gif

Files

File Path
Type
Category
Malicious
C1ZsNxSer8.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json
JSON data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\C1ZsNxSer8.exe
"C:\Users\user\Desktop\C1ZsNxSer8.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
unifrieghtmovers.com
malicious
http://geoplugin.net/json.gp
178.237.33.50
https://aka.ms/GlobalizationInvariantMode
unknown
http://geoplugin.net/json.gp/C
unknown
http://geoplugin.net/json.gpl
unknown
https://aka.ms/nativeaot-c
unknown
http://geoplugin.net/json.gpSystem32
unknown
https://aka.ms/nativeaot-compatibility
unknown
https://aka.ms/nativeaot-compatibilityY
unknown
https://aka.ms/nativeaot-compatibilityy
unknown
https://aka.ms/nativeaot-compatibilityX
unknown
http://geoplugin.net/json.gp-
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
unifrieghtmovers.com
23.95.60.82
 malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
23.95.60.82
unifrieghtmovers.com
United States
malicious
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\chrome-E2SMAR
exepath
HKEY_CURRENT_USER\SOFTWARE\chrome-E2SMAR
licence
HKEY_CURRENT_USER\SOFTWARE\chrome-E2SMAR
time

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
145BF964000
direct allocation
page read and write
 malicious
F77000
heap
page read and write
 malicious
CFB000
stack
page read and write
145BF600000
direct allocation
page read and write
145C2400000
direct allocation
page read and write
145BA422000
heap
page read and write
145BA5D0000
heap
page read and write
2BCF000
stack
page read and write
186509C0000
direct allocation
page read and write
7FF774A01000
unkown
page execute read
294D000
stack
page read and write
358F000
stack
page read and write
FE5000
heap
page read and write
7FF774A01000
unkown
page execute read
7FF774B9B000
unkown
page readonly
29C0000
heap
page read and write
145BA3C0000
heap
page read and write
FFE000
heap
page read and write
7FF774C6C000
unkown
page read and write
478000
remote allocation
page execute and read and write
7FF774B3B000
unkown
page read and write
25884F9000
stack
page read and write
2950000
heap
page read and write
25888FE000
stack
page read and write
7FF774C6F000
unkown
page readonly
145BA590000
heap
page read and write
348E000
stack
page read and write
FB4000
heap
page read and write
185CFDAF000
direct allocation
page read and write
116F000
stack
page read and write
7FF774A00000
unkown
page readonly
E0E000
stack
page read and write
18650978000
heap
page read and write
145BEC00000
direct allocation
page read and write
29AE000
stack
page read and write
E55000
heap
page read and write
145BE000000
direct allocation
page read and write
25887FE000
stack
page read and write
E50000
heap
page read and write
E60000
heap
page read and write
145C1000000
direct allocation
page read and write
F70000
heap
page read and write
7FF774B9B000
unkown
page readonly
145BA3C6000
heap
page read and write
96C000
stack
page read and write
145BA5B0000
heap
page read and write
FF8000
heap
page read and write
474000
remote allocation
page execute and read and write
25886FE000
stack
page read and write
9D0000
heap
page read and write
145C1A00000
direct allocation
page read and write
145BA5D5000
heap
page read and write
9E0000
heap
page read and write
1865099E000
heap
page read and write
FC8000
heap
page read and write
7FF774C67000
unkown
page read and write
145BA3CC000
heap
page read and write
7FF774A00000
unkown
page readonly
7FF774C60000
unkown
page read and write
186508B0000
heap
page read and write
186509B0000
direct allocation
page read and write
2ACF000
stack
page read and write
186509A1000
heap
page read and write
7FF774C60000
unkown
page write copy
7FF774C6F000
unkown
page readonly
145BA3A0000
heap
page read and write
E70000
heap
page read and write
145BC000000
direct allocation
page read and write
25885FE000
stack
page read and write
There are 60 hidden memdumps, click here to show them.