IOC Report
setup.exe

loading gif

Files

File Path
Type
Category
Malicious
setup.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\setup.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\setup.exe
"C:\Users\user\Desktop\setup.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
http://www.winimage.com/zLibDll
unknown
https://t.me/RiseProSUPPORT
unknown
http://www.winimage.com/zLibDllDpRTpR
unknown

IPs

IP
Domain
Country
Malicious
193.233.132.253
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
874000
trusted library allocation
page read and write
90000
unkown
page readonly
3C0000
heap
page read and write
15F6000
heap
page read and write
8EE000
heap
page read and write
873000
trusted library allocation
page execute and read and write
15E6000
heap
page read and write
23DF000
stack
page read and write
8B8000
heap
page read and write
400000
remote allocation
page execute and read and write
8AB000
trusted library allocation
page execute and read and write
513E000
stack
page read and write
A30000
trusted library allocation
page read and write
13D0000
heap
page read and write
AE0000
heap
page read and write
A8E000
stack
page read and write
1610000
heap
page read and write
8C9000
heap
page read and write
2440000
heap
page read and write
825000
heap
page read and write
5F6000
remote allocation
page execute and read and write
15EA000
heap
page read and write
264F000
stack
page read and write
880000
trusted library allocation
page read and write
92000
unkown
page readonly
15EC000
heap
page read and write
47ED000
stack
page read and write
6FB000
stack
page read and write
3655000
trusted library allocation
page read and write
8B0000
heap
page read and write
15F1000
heap
page read and write
2652000
trusted library allocation
page execute and read and write
5140000
heap
page read and write
2BC000
unkown
page readonly
15DC000
heap
page read and write
1425000
heap
page read and write
8FC000
heap
page read and write
254F000
stack
page read and write
FF0000
heap
page read and write
8E8000
heap
page read and write
12FC000
stack
page read and write
884000
trusted library allocation
page read and write
15AA000
heap
page read and write
3651000
trusted library allocation
page read and write
F8B000
stack
page read and write
540000
remote allocation
page execute and read and write
158D000
stack
page read and write
3B0000
heap
page read and write
820000
heap
page read and write
161B000
heap
page read and write
1420000
heap
page read and write
14E0000
heap
page read and write
2651000
trusted library allocation
page read and write
2653000
trusted library allocation
page read and write
15A0000
heap
page read and write
2F3F000
stack
page read and write
545000
remote allocation
page execute read
A10000
heap
page execute and read and write
86E000
stack
page read and write
A90000
heap
page read and write
34C000
stack
page read and write
14F0000
heap
page read and write
A20000
trusted library allocation
page execute and read and write
810000
trusted library allocation
page read and write
B30000
heap
page read and write
A40000
heap
page read and write
A0E000
stack
page read and write
146E000
stack
page read and write
80D000
stack
page read and write
515000
remote allocation
page readonly
15D8000
heap
page read and write
401000
remote allocation
page execute read
1609000
heap
page read and write
There are 63 hidden memdumps, click here to show them.