IOC Report
FYBRUTggrf.txt

loading gif

Files

File Path
Type
Category
Malicious
FYBRUTggrf.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
C:\Users\user\AppData\Local\Temp\RunAsAdmin.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsz3186.tmp\UserInfo.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\FYBRUTggrf.exe
"C:\Users\user\Desktop\FYBRUTggrf.exe"

URLs

Name
IP
Malicious
http://nsis.sf.net/NSIS_Error
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
279F000
stack
page read and write
19A000
stack
page read and write
57E000
stack
page read and write
400000
unkown
page readonly
20EE000
stack
page read and write
401000
unkown
page execute read
7DE000
stack
page read and write
9B000
stack
page read and write
401000
unkown
page execute read
407000
unkown
page readonly
79F000
stack
page read and write
437000
unkown
page readonly
409000
unkown
page write copy
520000
heap
page read and write
21B0000
heap
page read and write
5AA000
heap
page read and write
535000
heap
page read and write
434000
unkown
page read and write
400000
unkown
page readonly
414000
unkown
page read and write
213E000
stack
page read and write
437000
unkown
page readonly
42C000
unkown
page read and write
2250000
heap
page read and write
440000
heap
page read and write
407000
unkown
page readonly
5AE000
heap
page read and write
590000
heap
page read and write
2090000
heap
page read and write
5A0000
heap
page read and write
420000
unkown
page read and write
8DF000
stack
page read and write
409000
unkown
page read and write
530000
heap
page read and write
269E000
stack
page read and write
There are 25 hidden memdumps, click here to show them.