Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
sample-20240612.exe
|
PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
|
initial sample
|
 |
|
|
C:\Users\user\Pictures\pressica.exe
|
PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
|
dropped
|
|
|
|
C:\Users\user\Pictures\pressica.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
modified
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\sample-20240612.exe
|
"C:\Users\user\Desktop\sample-20240612.exe"
|
|
|
|
C:\Windows\SysWOW64\mspaint.exe
|
mspaint.exe
|
|
|
|
C:\Users\user\Pictures\pressica.exe
|
"C:\Users\user\Pictures\pressica.exe"
|
|
|
|
C:\Windows\SysWOW64\mspaint.exe
|
mspaint.exe
|
|
|
|
C:\Users\user\Pictures\pressica.exe
|
"C:\Users\user\Pictures\pressica.exe"
|
|
|
|
C:\Windows\SysWOW64\mspaint.exe
|
mspaint.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\xcopy.exe
|
"C:\Windows\System32\xcopy.exe" /f /y "C:\Users\user\Desktop\sample-20240612.exe" "C:\Users\user\Pictures\pressica.exe*"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 1 hidden processes, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
S(]H7p#}ho:P4p__.str4ng3l.ov
|
unknown
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
|
VirtualBox Guest Additions Manager
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
741000
|
heap
|
page read and write
|
|
|
|
6E0000
|
remote allocation
|
page execute and read and write
|
|
|
|
52B000
|
heap
|
page read and write
|
|
|
|
730000
|
remote allocation
|
page execute and read and write
|
|
|
|
3230000
|
remote allocation
|
page execute and read and write
|
|
|
|
6A1000
|
heap
|
page read and write
|
|
|
|
410000
|
heap
|
page read and write
|
||
|
18C000
|
stack
|
page read and write
|
||
|
3D0E000
|
stack
|
page read and write
|
||
|
739000
|
heap
|
page read and write
|
||
|
410000
|
heap
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
6BE000
|
heap
|
page read and write
|
||
|
227E000
|
stack
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
40C000
|
unkown
|
page execute and read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
75E000
|
heap
|
page read and write
|
||
|
5E5000
|
heap
|
page read and write
|
||
|
501000
|
heap
|
page read and write
|
||
|
741000
|
heap
|
page read and write
|
||
|
8F5000
|
heap
|
page read and write
|
||
|
3834000
|
heap
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
91B000
|
heap
|
page read and write
|
||
|
221E000
|
stack
|
page read and write
|
||
|
3D10000
|
trusted library allocation
|
page read and write
|
||
|
5E5000
|
heap
|
page read and write
|
||
|
4FE000
|
heap
|
page read and write
|
||
|
40D000
|
unkown
|
page execute and write copy
|
||
|
6A6000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page execute and read and write
|
||
|
505000
|
heap
|
page read and write
|
||
|
18E000
|
stack
|
page read and write
|
||
|
9F0000
|
heap
|
page read and write
|
||
|
4E0000
|
heap
|
page read and write
|
||
|
73E000
|
heap
|
page read and write
|
||
|
A8F000
|
stack
|
page read and write
|
||
|
7BF000
|
stack
|
page read and write
|
||
|
40C000
|
unkown
|
page execute and write copy
|
||
|
40C000
|
unkown
|
page execute and read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
48ED000
|
stack
|
page read and write
|
||
|
8BE000
|
stack
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
A00000
|
heap
|
page read and write
|
||
|
530000
|
heap
|
page read and write
|
||
|
A99000
|
heap
|
page read and write
|
||
|
517000
|
heap
|
page read and write
|
||
|
6A1000
|
heap
|
page read and write
|
||
|
6BE000
|
heap
|
page read and write
|
||
|
23BE000
|
stack
|
page read and write
|
||
|
410000
|
heap
|
page read and write
|
||
|
242E000
|
stack
|
page read and write
|
||
|
22EF000
|
stack
|
page read and write
|
||
|
49E000
|
stack
|
page read and write
|
||
|
4A0000
|
heap
|
page read and write
|
||
|
40C000
|
unkown
|
page execute and write copy
|
||
|
A95000
|
heap
|
page read and write
|
||
|
8C0000
|
heap
|
page read and write
|
||
|
18C000
|
stack
|
page read and write
|
||
|
51B000
|
heap
|
page read and write
|
||
|
67F000
|
stack
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
57E000
|
stack
|
page read and write
|
||
|
40D000
|
unkown
|
page execute and write copy
|
||
|
509000
|
heap
|
page read and write
|
||
|
18E000
|
stack
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
A54000
|
heap
|
page read and write
|
||
|
45E000
|
stack
|
page read and write
|
||
|
3D30000
|
trusted library allocation
|
page read and write
|
||
|
8F9000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page write copy
|
||
|
40E000
|
unkown
|
page read and write
|
||
|
24BF000
|
stack
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute and read and write
|
||
|
518000
|
heap
|
page read and write
|
||
|
2320000
|
heap
|
page read and write
|
||
|
A05000
|
heap
|
page read and write
|
||
|
8D0000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page write copy
|
||
|
231F000
|
stack
|
page read and write
|
||
|
680000
|
heap
|
page read and write
|
||
|
4F9000
|
heap
|
page read and write
|
||
|
745000
|
heap
|
page read and write
|
||
|
87F000
|
stack
|
page read and write
|
||
|
40C000
|
unkown
|
page execute and write copy
|
||
|
19D000
|
stack
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
69E000
|
heap
|
page read and write
|
||
|
746000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
6EE000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute and read and write
|
||
|
66D000
|
stack
|
page read and write
|
||
|
237F000
|
stack
|
page read and write
|
||
|
4E8000
|
heap
|
page read and write
|
||
|
8C4000
|
heap
|
page read and write
|
||
|
506000
|
heap
|
page read and write
|
||
|
728000
|
heap
|
page read and write
|
||
|
A90000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page write copy
|
||
|
720000
|
heap
|
page read and write
|
||
|
3A9F000
|
stack
|
page read and write
|
||
|
20DE000
|
stack
|
page read and write
|
||
|
40C000
|
unkown
|
page execute and read and write
|
||
|
99000
|
stack
|
page read and write
|
||
|
A4E000
|
stack
|
page read and write
|
||
|
18C000
|
stack
|
page read and write
|
||
|
21DF000
|
stack
|
page read and write
|
||
|
49E000
|
stack
|
page read and write
|
||
|
87E000
|
stack
|
page read and write
|
||
|
2580000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
18E000
|
stack
|
page read and write
|
||
|
83D000
|
stack
|
page read and write
|
||
|
3EA0000
|
trusted library allocation
|
page read and write
|
||
|
8BE000
|
stack
|
page read and write
|
||
|
501000
|
heap
|
page read and write
|
||
|
45E000
|
stack
|
page read and write
|
||
|
40E000
|
unkown
|
page read and write
|
||
|
699000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute and read and write
|
||
|
6F0000
|
heap
|
page read and write
|
||
|
6A5000
|
heap
|
page read and write
|
||
|
47AF000
|
stack
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
232E000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4510000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
4A0000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page execute and read and write
|
||
|
8FF000
|
stack
|
page read and write
|
||
|
3830000
|
heap
|
page read and write
|
||
|
21EE000
|
stack
|
page read and write
|
||
|
91F000
|
stack
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
918000
|
heap
|
page read and write
|
||
|
6AA000
|
stack
|
page read and write
|
||
|
A09000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
40D000
|
unkown
|
page execute and write copy
|
||
|
6A2000
|
heap
|
page read and write
|
||
|
880000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
47EC000
|
stack
|
page read and write
|
||
|
A4E000
|
stack
|
page read and write
|
||
|
688000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page execute and read and write
|
||
|
542000
|
heap
|
page read and write
|
||
|
4A5000
|
heap
|
page read and write
|
||
|
52E000
|
stack
|
page read and write
|
||
|
40E000
|
unkown
|
page read and write
|
There are 151 hidden memdumps, click here to show them.