IOC Report
41DLTjkmOm.exe

loading gif

Files

File Path
Type
Category
Malicious
41DLTjkmOm.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\remcos\logs.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\41DLTjkmOm.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Roaming\Lamsses.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Lamsses.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Lamsses.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MangoDB[1].ytyp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Paatapas[1].ytyp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\41DLTjkmOm.exe
"C:\Users\user\Desktop\41DLTjkmOm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\System32\cmd.exe
"cmd.exe" /c schtasks /create /tn "WidgetData" /tr "C:\Users\user\AppData\Roaming\Lamsses.exe " /sc minute /mo 5 /f
 malicious
C:\Windows\System32\schtasks.exe
schtasks /create /tn "WidgetData" /tr "C:\Users\user\AppData\Roaming\Lamsses.exe " /sc minute /mo 5 /f
 malicious
C:\Users\user\AppData\Roaming\Lamsses.exe
C:\Users\user\AppData\Roaming\Lamsses.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://geoplugin.net/json.gp
178.237.33.50
 malicious
bignight.net
malicious
https://investdirectinsurance.com/assuence/litesolidCha/MangoDB.ytyp
172.67.189.102
https://investdirectinsurance.com/assuence/litesolidCha/MangoDB.ytypim)_
unknown
https://investdirectinsurance.com/
unknown
http://geoplugin.net/json.gp/C
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Paatapas.ytyp
172.67.189.102
https://investdirectinsurance.com/assuence/litesolidCha/MangoDB.ytypcm#_
unknown
http://geoplugin.net/jso
unknown
http://geoplugin.net/json.gp?
unknown

Domains

Name
IP
Malicious
bignight.net
146.70.57.34
 malicious
geoplugin.net
178.237.33.50
 malicious
bg.microsoft.map.fastly.net
199.232.210.172
investdirectinsurance.com
172.67.189.102
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
178.237.33.50
geoplugin.net
Netherlands
malicious
146.70.57.34
bignight.net
United Kingdom
malicious
172.67.189.102
investdirectinsurance.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-SIVP85
exepath
HKEY_CURRENT_USER\SOFTWARE\Rmc-SIVP85
licence
HKEY_CURRENT_USER\SOFTWARE\Rmc-SIVP85
time

Memdumps

Base Address
Regiontype
Protect
Malicious
13D7000
heap
page read and write
 malicious
1416000
heap
page read and write
 malicious
2F6F000
stack
page read and write
 malicious
130A9000
trusted library allocation
page read and write
 malicious
11F8000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
105C000
stack
page read and write
24095D40000
heap
page read and write
11B0000
heap
page read and write
2FB0000
heap
page read and write
7FFD34480000
trusted library allocation
page read and write
13BB000
stack
page read and write
36AE000
stack
page read and write
7FFD34600000
trusted library allocation
page read and write
24095D30000
heap
page read and write
2641000
trusted library allocation
page read and write
C2ADFFF000
stack
page read and write
1B90E000
stack
page read and write
8B0000
heap
page read and write
7FFD34462000
trusted library allocation
page read and write
338E000
trusted library allocation
page read and write
132F000
heap
page read and write
7FFD34602000
trusted library allocation
page read and write
2FA0000
heap
page read and write
127A2000
trusted library allocation
page read and write
1545000
heap
page read and write
DE5000
heap
page read and write
8DF000
heap
page read and write
7FFD34606000
trusted library allocation
page read and write
12FC7000
trusted library allocation
page read and write
1364000
heap
page read and write
7FFD34610000
trusted library allocation
page read and write
3382000
trusted library allocation
page read and write
2DF0000
trusted library allocation
page read and write
263E000
stack
page read and write
1C50D000
stack
page read and write
7FFD34460000
trusted library allocation
page read and write
1B638000
heap
page read and write
24F0000
heap
page read and write
CD5000
heap
page read and write
830000
trusted library allocation
page read and write
959000
heap
page read and write
7FFD34510000
trusted library allocation
page read and write
3C0000
heap
page read and write
CA0000
heap
page execute and read and write
1429000
heap
page read and write
474000
remote allocation
page execute and read and write
12893000
trusted library allocation
page read and write
2E10000
trusted library allocation
page read and write
1BF27000
heap
page read and write
1300000
heap
page read and write
24095F90000
heap
page read and write
144B000
heap
page read and write
7D0000
heap
page read and write
B50000
heap
page read and write
7FFD34463000
trusted library allocation
page execute and read and write
7FFD34472000
trusted library allocation
page read and write
956000
heap
page read and write
3F5F000
stack
page read and write
7FFD34464000
trusted library allocation
page read and write
8F2000
heap
page read and write
7FFD3448B000
trusted library allocation
page execute and read and write
923000
heap
page read and write
1B54C000
stack
page read and write
B10000
heap
page read and write
7FFD34520000
trusted library allocation
page execute and read and write
12643000
trusted library allocation
page read and write
7FFD34580000
trusted library allocation
page execute and read and write
98B000
heap
page read and write
7FFD34510000
trusted library allocation
page read and write
164E000
stack
page read and write
24096150000
heap
page read and write
7FFD3448D000
trusted library allocation
page execute and read and write
1B00C000
stack
page read and write
1C1AE000
stack
page read and write
13E8000
heap
page read and write
11F0000
heap
page read and write
1C30C000
stack
page read and write
7FFD34463000
trusted library allocation
page execute and read and write
1BEE3000
heap
page read and write
CD0000
heap
page read and write
7FFD3460D000
trusted library allocation
page read and write
337F000
trusted library allocation
page read and write
115B000
stack
page read and write
24095DC0000
heap
page read and write
7F0000
heap
page read and write
8B6000
heap
page read and write
DC0000
heap
page read and write
1BEE0000
heap
page read and write
7FFD3446D000
trusted library allocation
page execute and read and write
920000
heap
page read and write
12F0000
heap
page read and write
12FC3000
trusted library allocation
page read and write
C5E000
stack
page read and write
2FC1000
trusted library allocation
page read and write
B55000
heap
page read and write
1C1B0000
heap
page execute and read and write
C70000
unkown
page readonly
1B10E000
stack
page read and write
338C000
trusted library allocation
page read and write
AAF000
stack
page read and write
1BF63000
heap
page read and write
1B636000
heap
page read and write
1BF25000
heap
page read and write
1BF6C000
heap
page read and write
1410000
heap
page read and write
128EB000
trusted library allocation
page read and write
12FC000
heap
page read and write
7FFD34470000
trusted library allocation
page read and write
DE0000
heap
page read and write
13097000
trusted library allocation
page read and write
7FFD344BC000
trusted library allocation
page execute and read and write
1B98B000
stack
page read and write
1BC8E000
stack
page read and write
37AF000
stack
page read and write
2F1E000
stack
page read and write
7FFD3446D000
trusted library allocation
page execute and read and write
143E000
stack
page read and write
3D0000
heap
page read and write
7FFD34460000
trusted library allocation
page read and write
1B20E000
stack
page read and write
2F60000
heap
page read and write
135E000
heap
page read and write
30EC000
stack
page read and write
1540000
heap
page read and write
2F80000
heap
page read and write
3E5E000
stack
page read and write
1ABCD000
stack
page read and write
1BB8E000
stack
page read and write
C2ADB8B000
stack
page read and write
12E0000
heap
page read and write
7FFD34604000
trusted library allocation
page read and write
12F0000
heap
page read and write
153E000
stack
page read and write
137E000
stack
page read and write
7FF477E90000
trusted library allocation
page execute and read and write
322D000
stack
page read and write
152E000
stack
page read and write
1BF65000
heap
page read and write
12729000
trusted library allocation
page read and write
7FFD344BC000
trusted library allocation
page execute and read and write
11D0000
heap
page read and write
13D0000
heap
page read and write
850000
trusted library allocation
page read and write
24095DE4000
heap
page read and write
1B80E000
stack
page read and write
1C160000
trusted library allocation
page read and write
2F30000
heap
page execute and read and write
157E000
stack
page read and write
C72000
unkown
page readonly
985000
heap
page read and write
1C70E000
stack
page read and write
24096155000
heap
page read and write
332F000
stack
page read and write
118C000
stack
page read and write
2772000
trusted library allocation
page read and write
135C000
heap
page read and write
1B610000
heap
page read and write
16CF000
stack
page read and write
471000
remote allocation
page execute and read and write
6F2000
stack
page read and write
1320000
heap
page read and write
1C0EE000
stack
page read and write
1BA8D000
stack
page read and write
8BC000
heap
page read and write
1B40E000
stack
page read and write
478000
remote allocation
page execute and read and write
7FFD34600000
trusted library allocation
page read and write
1C60E000
stack
page read and write
1BEE8000
heap
page read and write
1C40B000
stack
page read and write
126A9000
trusted library allocation
page read and write
24095D60000
heap
page read and write
31EF000
stack
page read and write
12DE000
stack
page read and write
7FFD3447D000
trusted library allocation
page execute and read and write
12F6000
heap
page read and write
13C6000
heap
page read and write
7FFD34462000
trusted library allocation
page read and write
12641000
trusted library allocation
page read and write
7FFD34479000
trusted library allocation
page read and write
142B000
heap
page read and write
7FFD34546000
trusted library allocation
page execute and read and write
2F70000
heap
page read and write
2530000
heap
page execute and read and write
1B30E000
stack
page read and write
7FFD34474000
trusted library allocation
page read and write
7FFD34520000
trusted library allocation
page execute and read and write
108C000
stack
page read and write
7FFD34580000
trusted library allocation
page execute and read and write
12FC1000
trusted library allocation
page read and write
167E000
stack
page read and write
13F0000
heap
page read and write
C2ADEFF000
unkown
page read and write
1290000
heap
page read and write
1324000
heap
page read and write
8DD000
heap
page read and write
474000
remote allocation
page execute and read and write
7FFD34546000
trusted library allocation
page execute and read and write
8E6000
heap
page read and write
7FFD3451C000
trusted library allocation
page execute and read and write
1B60E000
stack
page read and write
1295000
heap
page read and write
8F4000
heap
page read and write
131A000
heap
page read and write
961000
heap
page read and write
7FFD34470000
trusted library allocation
page read and write
7FFD34616000
trusted library allocation
page read and write
1BD8E000
stack
page read and write
30AF000
stack
page read and write
1B50E000
stack
page read and write
7FFD34464000
trusted library allocation
page read and write
14E0000
heap
page read and write
12EF000
stack
page read and write
1438000
heap
page read and write
1450000
heap
page read and write
10F2000
stack
page read and write
12649000
trusted library allocation
page read and write
1BE8E000
stack
page read and write
24095DCA000
heap
page read and write
1331000
heap
page read and write
14D0000
heap
page read and write
1281B000
trusted library allocation
page read and write
C70000
unkown
page readonly
12FC9000
trusted library allocation
page read and write
7FFD34606000
trusted library allocation
page read and write
1C130000
trusted library section
page read and write
12669000
trusted library allocation
page read and write
7FFD34610000
trusted library allocation
page read and write
7FFD3451C000
trusted library allocation
page execute and read and write
There are 220 hidden memdumps, click here to show them.