IOC Report
Bjl3geiFEK.exe

loading gif

Files

File Path
Type
Category
Malicious
Bjl3geiFEK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\229472814.exe
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\264162301.exe
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\33080.scr
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\818921588.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\sysppvrdnvs.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\1[1]
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\dwntbl[1]
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rddolps.u41.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bdgt3o4r.xla.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ol2t3fun.mdp.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbs1l3jm.nlg.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\tbtcmds.dat
data
dropped
C:\Users\user\tbtnds.dat
data
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Bjl3geiFEK.exe
"C:\Users\user\Desktop\Bjl3geiFEK.exe"
 malicious
C:\Users\user\AppData\Local\Temp\33080.scr
"C:\Users\user\AppData\Local\Temp\33080.scr" /S
 malicious
C:\Windows\sysppvrdnvs.exe
C:\Windows\sysppvrdnvs.exe
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
malicious
C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
 malicious
C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
 malicious
C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
 malicious
C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
 malicious
C:\Windows\SysWOW64\sc.exe
sc stop BITS /wait
 malicious
C:\Windows\sysppvrdnvs.exe
"C:\Windows\sysppvrdnvs.exe"
malicious
C:\Users\user\AppData\Local\Temp\818921588.exe
C:\Users\user\AppData\Local\Temp\818921588.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
There are 6 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://91.202.233.141/
unknown
 malicious
http://185.215.113.66/tdrpl.exe
185.215.113.66
 malicious
http://185.215.113.66/
unknown
 malicious
http://schemas.xmlsoap.org/soap/encoding/
unknown
http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s
unknown
http://91.202.233.141/dwntblan
unknown
http://185.215.113.66/tdrpl.exeb1E
unknown
http://185.215.113.66/1JJC:
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://185.215.113.66/1G0td
unknown
http://185.215.113.66/2
unknown
http://91.202.233.141/dwntblt-InLMEMH
unknown
http://185.215.113.66/1C:
unknown
http://185.215.113.66/1LMEM0P
unknown
http://185.215.113.66/2C:
unknown
http://185.215.113.66/1
unknown
http://185.215.113.66/1aenh.dll
unknown
http://185.215.113.66/tdrp.exe%s:Zone.Identifier/c
unknown
http://91.202.233.141/dwntbl2C
unknown
http://91.202.233.141/dwntblhy
unknown
http://91.202.233.141/dwntbllvCkd
unknown
http://91.202.233.141/dwntbl
unknown
http://185.215.113.66/tdrp.exe
unknown
http://185.215.113.66/tdrpl.exek1L
unknown
http://185.215.113.66/2(Bf
unknown
http://185.215.113.66/1uK
unknown
http://185.215.113.66/tdrpl.exer
unknown
http://185.215.113.66/2JJC:
unknown
There are 18 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172

IPs

IP
Domain
Country
Malicious
185.215.113.66
unknown
Portugal
malicious
5.75.95.114
unknown
Iran (ISLAMIC Republic Of)
malicious
91.202.233.141
unknown
Russian Federation
malicious
5.239.153.192
unknown
Iran (ISLAMIC Republic Of)
malicious
2.186.114.89
unknown
Iran (ISLAMIC Republic Of)
239.255.255.250
unknown
Reserved
2.63.29.22
unknown
Russian Federation

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
FirewallOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
FirewallDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
AntiSpywareOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
AntiVirusOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
AntiVirusDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
UpdatesOverride
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
UpdatesDisableNotify
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Windows Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DisableWindowsUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
AlwaysAutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
OverrideNotice
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS
Start
There are 2 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
410000
unkown
page readonly
 malicious
410000
unkown
page readonly
 malicious
410000
unkown
page readonly
 malicious
410000
unkown
page readonly
 malicious
42E000
heap
page read and write
 malicious
410000
unkown
page readonly
 malicious
48C1000
heap
page read and write
 malicious
410000
unkown
page readonly
 malicious
410000
unkown
page readonly
 malicious
410000
unkown
page readonly
 malicious
3B3E000
stack
page read and write
520000
heap
page read and write
4B2000
unkown
page readonly
2BC0000
heap
page read and write
860000
heap
page read and write
387F000
stack
page read and write
64A000
heap
page read and write
61E000
heap
page read and write
76E000
stack
page read and write
363E000
stack
page read and write
610000
heap
page read and write
1670000
heap
page read and write
2AC8000
heap
page read and write
6AB000
heap
page read and write
65F000
heap
page read and write
6F8000
heap
page read and write
810000
heap
page read and write
27DE000
stack
page read and write
408000
heap
page read and write
79D000
stack
page read and write
69F000
heap
page read and write
453E000
stack
page read and write
6CB000
heap
page read and write
4AE000
stack
page read and write
380D000
stack
page read and write
2FEF000
stack
page read and write
9B000
stack
page read and write
702000
heap
page read and write
2D9D000
stack
page read and write
699000
heap
page read and write
709000
heap
page read and write
33C0000
heap
page read and write
570000
heap
page read and write
6FF000
heap
page read and write
688000
heap
page read and write
2A4E000
stack
page read and write
401000
unkown
page execute read
358E000
stack
page read and write
6F1000
heap
page read and write
6AA000
heap
page read and write
4C0000
heap
page read and write
31A0000
heap
page read and write
5A0D000
stack
page read and write
37CC000
stack
page read and write
420000
heap
page read and write
19C000
stack
page read and write
DB9000
stack
page read and write
42BE000
stack
page read and write
69A000
heap
page read and write
139C000
heap
page read and write
3000000
heap
page read and write
8EE000
stack
page read and write
3C7E000
stack
page read and write
38BE000
stack
page read and write
97F000
stack
page read and write
2F30000
heap
page read and write
32C0000
heap
page read and write
9C000
stack
page read and write
7AE000
stack
page read and write
6EC000
heap
page read and write
6ED000
heap
page read and write
520000
heap
page read and write
291F000
stack
page read and write
2DE3000
heap
page read and write
9CF000
stack
page read and write
2AC0000
heap
page read and write
46E000
stack
page read and write
210F000
stack
page read and write
540000
heap
page read and write
2AF0000
heap
page read and write
98E000
stack
page read and write
80F000
stack
page read and write
315F000
stack
page read and write
414000
unkown
page write copy
3FFF000
stack
page read and write
75F000
stack
page read and write
320F000
stack
page read and write
400000
unkown
page readonly
170000
heap
page read and write
463F000
stack
page read and write
400000
unkown
page readonly
1680000
heap
page read and write
1F0000
heap
page read and write
69A000
heap
page read and write
47BE000
stack
page read and write
414000
unkown
page write copy
6AE000
heap
page read and write
85E000
stack
page read and write
3EBF000
stack
page read and write
427F000
stack
page read and write
3270000
heap
page read and write
429000
heap
page read and write
36CB000
stack
page read and write
118E000
stack
page read and write
6AD000
heap
page read and write
377E000
stack
page read and write
4B1000
unkown
page execute read
1F0000
heap
page read and write
709000
heap
page read and write
6CB000
heap
page read and write
2A4F000
stack
page read and write
705000
heap
page read and write
4F0000
heap
page read and write
69F000
heap
page read and write
414000
unkown
page write copy
6F4000
heap
page read and write
414000
unkown
page write copy
319E000
stack
page read and write
2A5F000
stack
page read and write
6F6000
heap
page read and write
6B6000
heap
page read and write
650000
heap
page read and write
3C3F000
stack
page read and write
BD000
stack
page read and write
4B2000
unkown
page readonly
400000
unkown
page readonly
1BE000
stack
page read and write
32F8000
heap
page read and write
199000
stack
page read and write
79E000
stack
page read and write
330E000
stack
page read and write
591000
heap
page read and write
6FD000
heap
page read and write
95E000
stack
page read and write
860000
heap
page read and write
34FE000
stack
page read and write
6F2000
heap
page read and write
2F38000
heap
page read and write
2A8F000
stack
page read and write
390E000
stack
page read and write
99F000
stack
page read and write
CBB000
stack
page read and write
9C000
stack
page read and write
1F0000
heap
page read and write
61A000
heap
page read and write
2BDC000
stack
page read and write
2D7B000
stack
page read and write
16CE000
stack
page read and write
12DF000
stack
page read and write
30EE000
stack
page read and write
6B9000
heap
page read and write
64F000
stack
page read and write
414000
unkown
page write copy
48BF000
stack
page read and write
1020000
heap
page read and write
400000
unkown
page readonly
6BA000
heap
page read and write
60E000
stack
page read and write
1FF000
stack
page read and write
69F000
heap
page read and write
65E000
stack
page read and write
44FF000
stack
page read and write
2DBE000
stack
page read and write
19C000
stack
page read and write
9A0000
heap
page read and write
281E000
stack
page read and write
2EF0000
heap
page read and write
820000
heap
page read and write
688000
heap
page read and write
467E000
stack
page read and write
703000
heap
page read and write
4B0000
unkown
page readonly
448000
heap
page read and write
A17000
heap
page read and write
400000
unkown
page readonly
72D000
stack
page read and write
98E000
stack
page read and write
57E000
heap
page read and write
354F000
stack
page read and write
25FD000
stack
page read and write
32F0000
heap
page read and write
65F000
heap
page read and write
2D5D000
stack
page read and write
2D2C000
stack
page read and write
130E000
heap
page read and write
6F5000
heap
page read and write
48C3000
heap
page read and write
610000
heap
page read and write
395E000
stack
page read and write
6B6000
heap
page read and write
2FB0000
heap
page read and write
70A000
heap
page read and write
76D000
stack
page read and write
401000
unkown
page execute read
477F000
stack
page read and write
6F8000
heap
page read and write
79E000
stack
page read and write
3EFE000
stack
page read and write
65E000
stack
page read and write
32C2000
heap
page read and write
414000
unkown
page write copy
3C5C000
stack
page read and write
7AD000
stack
page read and write
6B8000
heap
page read and write
3D5C000
stack
page read and write
9BE000
stack
page read and write
4B0000
unkown
page readonly
48C0000
heap
page read and write
702000
heap
page read and write
3AFE000
stack
page read and write
6FF000
heap
page read and write
702000
heap
page read and write
700000
heap
page read and write
32CE000
stack
page read and write
43BF000
stack
page read and write
75F000
stack
page read and write
135B000
heap
page read and write
6BA000
heap
page read and write
1300000
heap
page read and write
114D000
stack
page read and write
401000
unkown
page execute read
3D7F000
stack
page read and write
9C0000
heap
page read and write
6AD000
heap
page read and write
6F8000
heap
page read and write
2AF8000
heap
page read and write
6FD000
heap
page read and write
401000
unkown
page execute read
688000
heap
page read and write
7D0000
heap
page read and write
400000
heap
page read and write
57A000
heap
page read and write
6F6000
heap
page read and write
92F000
stack
page read and write
414000
unkown
page read and write
31C0000
heap
page read and write
35FF000
stack
page read and write
1600000
heap
page read and write
70B000
heap
page read and write
6FF000
heap
page read and write
940000
heap
page read and write
6EE000
heap
page read and write
340E000
stack
page read and write
4B4000
unkown
page readonly
6F5000
heap
page read and write
414000
unkown
page write copy
FE000
stack
page read and write
700000
heap
page read and write
295E000
stack
page read and write
B2F000
stack
page read and write
76F000
stack
page read and write
9C0000
heap
page read and write
1100000
heap
page read and write
9C000
stack
page read and write
373F000
stack
page read and write
A00000
heap
page read and write
94E000
stack
page read and write
2EEC000
stack
page read and write
2DE0000
heap
page read and write
6F1000
heap
page read and write
130A000
heap
page read and write
6EC000
heap
page read and write
56E000
stack
page read and write
401000
unkown
page execute read
709000
heap
page read and write
69F000
heap
page read and write
15FF000
stack
page read and write
1F0000
heap
page read and write
4B1000
unkown
page execute read
4B4000
unkown
page readonly
417E000
stack
page read and write
14FF000
stack
page read and write
39FE000
stack
page read and write
322F000
stack
page read and write
7DE000
stack
page read and write
11CE000
stack
page read and write
5B0D000
stack
page read and write
440000
heap
page read and write
89F000
stack
page read and write
70B000
heap
page read and write
312E000
stack
page read and write
39BF000
stack
page read and write
403E000
stack
page read and write
DB6000
stack
page read and write
32A0000
heap
page read and write
4C5000
heap
page read and write
69A000
heap
page read and write
33D0000
heap
page read and write
A10000
heap
page read and write
400000
unkown
page readonly
5B0000
heap
page read and write
11D5000
heap
page read and write
420000
heap
page read and write
11D0000
heap
page read and write
344E000
stack
page read and write
2B9F000
stack
page read and write
413F000
stack
page read and write
2CDC000
stack
page read and write
368E000
stack
page read and write
400000
unkown
page readonly
3230000
heap
page read and write
43FE000
stack
page read and write
136A000
heap
page read and write
401000
unkown
page execute read
3A5F000
stack
page read and write
1377000
heap
page read and write
26D0000
heap
page read and write
16E0000
heap
page read and write
2A9E000
stack
page read and write
401000
unkown
page execute read
3DBE000
stack
page read and write
130000
heap
page read and write
19D000
stack
page read and write
90F000
stack
page read and write
401000
unkown
page execute read
840000
heap
page read and write
70A000
heap
page read and write
420000
heap
page read and write
400000
unkown
page readonly
1379000
heap
page read and write
311E000
stack
page read and write
710000
heap
page read and write
70C000
heap
page read and write
49C1000
heap
page read and write
6EC000
heap
page read and write
930000
heap
page read and write
There are 316 hidden memdumps, click here to show them.