Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.081451547709962
Filename:	file.exe
Filesize:	311296
MD5:	4e0235942a9cde99ee2ee0ee1a736e4f
SHA1:	d084d94df2502e68ee0443b335dd621cd45e2790
SHA256:	a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
SHA512:	cfc4b7d58f662ee0789349b38c1dec0c4e6dc1d2e660f5d92f8566d49c4850b2bf1d70e43edf84db7b21cb8e316e8bcc3e20b797e32d9668c69a029b15804e3f
SSDEEP:	3072:aq6EgY6igrUjsgMmwPPoDqeRFSCotTAbtAYKtJcZqf7D341eqiOLibBOU:ZqY6iXwPwuaFjGTARANJcZqf7DIfL
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G.................0.................. ... ....@.. ....................... ............@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Security Software Discovery Data from Local System
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Security Software Discovery
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings	Security Software Discovery
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp Security Software Discovery
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Security Software Discovery Archive Collected Data Encrypted Channel
Drops certificate files (DER)	E-Banking Fraud
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Security Software Discovery System Information Discovery
Sample file is different than original file name gathered from version info	System Summary	Security Software Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary	Security Software Discovery
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking	Security Software Discovery
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
Category:	dropped
Dump:	file.exe.log.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3318368586986695
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
Size:	3274
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:54 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:54 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Entropy:	3.450269862340454
Encrypted:	false
Ssdeep:	48:8Sdl2dfTXdARYrnvPdAKRkdAGdAKRFdAKRE:8SdlO7
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\Tmp583D.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp583D.tmp
Category:	dropped
Dump:	Tmp583D.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\Tmp584E.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp584E.tmp
Category:	dropped
Dump:	Tmp584E.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	2251
Whitelisted:	true
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6048
Target ID:	0
Parent PID:	1028
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	311296
MD5:	4E0235942A9CDE99EE2EE0EE1A736E4F
Time:	11:52:55
Date:	26/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7c0000
Modulesize:	335872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

https://duckduckgo.com/chrome_newtab

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

https://duckduckgo.com/ac/?q=

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9~

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

There are 90 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

185.215.113.9

unknown

Portugal

Details

IP:	185.215.113.9
TargetID:	0
Current Path:	C:\Users\user\Desktop\file.exe
Country:	Portugal
Countrycode:	PRT
ASN number:	206894
ASN name:	WHOLESALECONNECTIONSNL
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

7C2000

unkown

page readonly

2C18000

trusted library allocation

page read and write

31C3000

trusted library allocation

page read and write

3BEE000

trusted library allocation

page read and write

6782000

trusted library allocation

page read and write

F67000

heap

page read and write

50A0000

heap

page read and write

C51000

heap

page read and write

10E3000

trusted library allocation

page execute and read and write

5011000

trusted library allocation

page read and write

2FBE000

trusted library allocation

page read and write

6CE0000

trusted library allocation

page read and write

2D2E000

trusted library allocation

page read and write

CEF000

heap

page read and write

6392000

heap

page read and write

54BF000

stack

page read and write

7EA0000

heap

page read and write

2B6E000

stack

page read and write

50C0000

trusted library allocation

page execute and read and write

6760000

trusted library allocation

page read and write

3012000

trusted library allocation

page read and write

68B0000

trusted library allocation

page execute and read and write

63A4000

heap

page read and write

3B9A000

trusted library allocation

page read and write

6BDE000

stack

page read and write

7E9B000

stack

page read and write

76B0000

trusted library allocation

page read and write

2D1F000

trusted library allocation

page read and write

318C000

trusted library allocation

page read and write

3183000

trusted library allocation

page read and write

6376000

heap

page read and write

77B0000

trusted library allocation

page execute and read and write

67B5000

trusted library allocation

page read and write

637C000

heap

page read and write

62D0000

heap

page read and write

30DF000

trusted library allocation

page read and write

7B3E000

stack

page read and write

6840000

trusted library allocation

page read and write

538E000

stack

page read and write

50A3000

heap

page read and write

84A0000

heap

page read and write

7F00000

trusted library allocation

page read and write

3096000

trusted library allocation

page read and write

6830000

trusted library allocation

page read and write

D6E000

stack

page read and write

74CF000

heap

page read and write

5130000

trusted library allocation

page read and write

62C0000

trusted library allocation

page execute and read and write

6739000

trusted library allocation

page read and write

76D0000

trusted library allocation

page execute and read and write

31AE000

trusted library allocation

page read and write

63A9000

heap

page read and write

7522000

heap

page read and write

54EA000

heap

page read and write

6CEC000

trusted library allocation

page read and write

8AA000

stack

page read and write

30C9000

trusted library allocation

page read and write

75BB000

heap

page read and write

62A0000

heap

page read and write

672A000

trusted library allocation

page read and write

4FF4000

trusted library allocation

page read and write

31CE000

trusted library allocation

page read and write

3BB3000

trusted library allocation

page read and write

5D4E000

stack

page read and write

75CC000

heap

page read and write

899E000

stack

page read and write

64AE000

stack

page read and write

6B9C000

stack

page read and write

2FDF000

trusted library allocation

page read and write

3EEF000

trusted library allocation

page read and write

7EB0000

trusted library allocation

page read and write

54D1000

heap

page read and write

54D4000

heap

page read and write

2FF6000

trusted library allocation

page read and write

FAE000

stack

page read and write

63CE000

heap

page read and write

314C000

trusted library allocation

page read and write

5016000

trusted library allocation

page read and write

7E3E000

stack

page read and write

30D3000

trusted library allocation

page read and write

1106000

trusted library allocation

page execute and read and write

30B7000

trusted library allocation

page read and write

5390000

trusted library allocation

page read and write

10D0000

trusted library allocation

page read and write

53B0000

heap

page execute and read and write

2FFB000

trusted library allocation

page read and write

10FD000

trusted library allocation

page execute and read and write

2FCB000

trusted library allocation

page read and write

7EFD000

stack

page read and write

63C0000

heap

page read and write

74E2000

heap

page read and write

3E2E000

trusted library allocation

page read and write

6728000

trusted library allocation

page read and write

F60000

heap

page read and write

110A000

trusted library allocation

page execute and read and write

30C2000

trusted library allocation

page read and write

6771000

trusted library allocation

page read and write

6720000

trusted library allocation

page read and write

2990000

heap

page execute and read and write

2D6B000

trusted library allocation

page read and write

6737000

trusted library allocation

page read and write

614F000

stack

page read and write

6D6F000

trusted library allocation

page read and write

7F2000

unkown

page readonly

6730000

trusted library allocation

page read and write

785C000

trusted library allocation

page read and write

2A55000

trusted library allocation

page read and write

77FE000

stack

page read and write

1100000

trusted library allocation

page read and write

2D27000

trusted library allocation

page read and write

6CE9000

trusted library allocation

page read and write

7579000

heap

page read and write

62EA000

heap

page read and write

2960000

trusted library allocation

page read and write

74C0000

heap

page read and write

661E000

stack

page read and write

111B000

trusted library allocation

page execute and read and write

D20000

heap

page read and write

C37000

heap

page read and write

7F7000

unkown

page readonly

2A60000

heap

page read and write

6D30000

trusted library allocation

page read and write

10F0000

trusted library allocation

page read and write

76C0000

trusted library allocation

page read and write

7CFF000

stack

page read and write

3B71000

trusted library allocation

page read and write

74A7000

heap

page read and write

6735000

trusted library allocation

page read and write

5050000

trusted library allocation

page read and write

2A40000

trusted library allocation

page read and write

7588000

heap

page read and write

3040000

trusted library allocation

page read and write

74DC000

heap

page read and write

6D75000

trusted library allocation

page read and write

74F1000

heap

page read and write

6725000

trusted library allocation

page read and write

67BB000

trusted library allocation

page read and write

2980000

trusted library allocation

page read and write

76B8000

trusted library allocation

page read and write

5120000

heap

page read and write

31D0000

trusted library allocation

page read and write

1115000

trusted library allocation

page execute and read and write

C44000

heap

page read and write

1110000

trusted library allocation

page read and write

806000

unkown

page readonly

55FE000

stack

page read and write

676B000

trusted library allocation

page read and write

6D55000

trusted library allocation

page read and write

31A4000

trusted library allocation

page read and write

3BAB000

trusted library allocation

page read and write

67F0000

trusted library allocation

page read and write

63B1000

heap

page read and write

67BE000

trusted library allocation

page read and write

3111000

trusted library allocation

page read and write

7B7E000

stack

page read and write

2D24000

trusted library allocation

page read and write

74EE000

heap

page read and write

756B000

heap

page read and write

10AF000

stack

page read and write

6A30000

trusted library allocation

page execute and read and write

3088000

trusted library allocation

page read and write

89E0000

heap

page read and write

7E40000

trusted library allocation

page execute and read and write

D85000

heap

page read and write

1117000

trusted library allocation

page execute and read and write

10E4000

trusted library allocation

page read and write

2D19000

trusted library allocation

page read and write

311D000

trusted library allocation

page read and write

63BC000

heap

page read and write

308A000

trusted library allocation

page read and write

7CBE000

stack

page read and write

10ED000

trusted library allocation

page execute and read and write

7860000

trusted library allocation

page read and write

5022000

trusted library allocation

page read and write

2FD8000

trusted library allocation

page read and write

1170000

heap

page read and write

7F640000

trusted library allocation

page execute and read and write

6D59000

trusted library allocation

page read and write

50B2000

trusted library allocation

page read and write

D80000

heap

page read and write

7504000

heap

page read and write

67D0000

trusted library allocation

page read and write

3B7F000

trusted library allocation

page read and write

31A1000

trusted library allocation

page read and write

69E0000

trusted library allocation

page read and write

74CA000

heap

page read and write

1112000

trusted library allocation

page read and write

3EF6000

trusted library allocation

page read and write

1176000

heap

page read and write

5140000

trusted library allocation

page read and write

9A7000

stack

page read and write

7586000

heap

page read and write

6A50000

trusted library allocation

page execute and read and write

6D68000

trusted library allocation

page read and write

C18000

heap

page read and write

6D6A000

trusted library allocation

page read and write

7582000

heap

page read and write

67C0000

trusted library allocation

page read and write

117B000

heap

page read and write

778F000

stack

page read and write

C10000

heap

page read and write

29A8000

trusted library allocation

page read and write

7D3E000

stack

page read and write

31BC000

trusted library allocation

page read and write

30FC000

trusted library allocation

page read and write

7790000

trusted library allocation

page read and write

6D50000

trusted library allocation

page read and write

3106000

trusted library allocation

page read and write

671F000

stack

page read and write

2B71000

trusted library allocation

page read and write

756D000

heap

page read and write

C1E000

heap

page read and write

2970000

trusted library allocation

page read and write

62B0000

trusted library allocation

page execute and read and write

7C7F000

stack

page read and write

67A0000

trusted library allocation

page read and write

2FF1000

trusted library allocation

page read and write

76E0000

trusted library allocation

page read and write

4BAC000

stack

page read and write

75FB000

heap

page read and write

604F000

stack

page read and write

68C0000

trusted library allocation

page execute and read and write

6860000

trusted library allocation

page execute and read and write

1140000

heap

page read and write

2D22000

trusted library allocation

page read and write

63C7000

heap

page read and write

6791000

trusted library allocation

page read and write

6324000

heap

page read and write

62D8000

heap

page read and write

30B0000

trusted library allocation

page read and write

7794000

trusted library allocation

page read and write

75A2000

heap

page read and write

50B0000

trusted library allocation

page read and write

5138000

trusted library allocation

page read and write

6D7A000

trusted library allocation

page read and write

2D2B000

trusted library allocation

page read and write

74AD000

heap

page read and write

67B0000

trusted library allocation

page read and write

3EE2000

trusted library allocation

page read and write

563E000

stack

page read and write

1130000

trusted library allocation

page read and write

69F0000

trusted library allocation

page read and write

30F5000

trusted library allocation

page read and write

F5E000

stack

page read and write

4CAC000

stack

page read and write

7850000

trusted library allocation

page read and write

6A00000

trusted library allocation

page read and write

7C0000

unkown

page readonly

D10000

heap

page read and write

7542000

heap

page read and write

7548000

heap

page read and write

4FF0000

trusted library allocation

page read and write

2A50000

trusted library allocation

page read and write

758C000

heap

page read and write

CBD000

heap

page read and write

75E9000

heap

page read and write

74BA000

heap

page read and write

501D000

trusted library allocation

page read and write

500E000

trusted library allocation

page read and write

6850000

trusted library allocation

page execute and read and write

6776000

trusted library allocation

page read and write

75C5000

heap

page read and write

4FFB000

trusted library allocation

page read and write

750A000

heap

page read and write

2D1C000

trusted library allocation

page read and write

73A0000

heap

page read and write

6800000

trusted library allocation

page read and write

67E0000

trusted library allocation

page read and write

3CEE000

trusted library allocation

page read and write

3080000

trusted library allocation

page read and write

295E000

stack

page read and write

76A0000

trusted library allocation

page read and write

6A20000

trusted library allocation

page read and write

54E5000

heap

page read and write

74A0000

heap

page read and write

6D40000

trusted library allocation

page execute and read and write

C2F000

heap

page read and write

30A3000

trusted library allocation

page read and write

5090000

heap

page read and write

5D0E000

stack

page read and write

77A0000

trusted library allocation

page read and write

5030000

trusted library allocation

page read and write

6D7F000

trusted library allocation

page read and write

8AEE000

stack

page read and write

3101000

trusted library allocation

page read and write

84AB000

heap

page read and write

3007000

trusted library allocation

page read and write

CDA000

heap

page read and write

505E000

trusted library allocation

page read and write

624E000

stack

page read and write

1102000

trusted library allocation

page read and write

6A10000

trusted library allocation

page read and write

1160000

trusted library allocation

page execute and read and write

74DA000

heap

page read and write

7530000

heap

page read and write

29A0000

trusted library allocation

page read and write

6A9C000

stack

page read and write

5D8E000

stack

page read and write

10E0000

trusted library allocation

page read and write

774D000

stack

page read and write

6D52000

trusted library allocation

page read and write

6CDC000

stack

page read and write

76A4000

trusted library allocation

page read and write

678E000

trusted library allocation

page read and write

30CE000

trusted library allocation

page read and write

2FEA000

trusted library allocation

page read and write

65AE000

stack

page read and write

3B92000

trusted library allocation

page read and write

3077000

trusted library allocation

page read and write

There are 299 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
file.exe