Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
FS001_ DT103024.bat
|
DOS batch file, ASCII text, with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\x
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\x.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\x.vbs
|
ASCII text, with CRLF line terminators
|
modified
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\FS001_ DT103024.bat" "
|
|
|
|
C:\Windows\System32\cscript.exe
|
cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs
|
|
|
|
C:\Users\user\AppData\Local\Temp\x.exe
|
C:\Users\user\AppData\Local\Temp\x.exe
|
|
|
|
C:\Users\user\AppData\Local\Temp\x.exe
|
"C:\Users\user\AppData\Local\Temp\x.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /e "'v" "C:\Users\user\Desktop\FS001_ DT103024.bat"
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1340000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
E60000
|
heap
|
page read and write
|
||
|
5060000
|
heap
|
page read and write
|
||
|
7CE0000
|
trusted library section
|
page read and write
|
||
|
4FA0000
|
trusted library allocation
|
page read and write
|
||
|
4FF0000
|
trusted library allocation
|
page read and write
|
||
|
50E0000
|
heap
|
page read and write
|
||
|
118C000
|
stack
|
page read and write
|
||
|
875C6FF000
|
stack
|
page read and write
|
||
|
24361549000
|
heap
|
page read and write
|
||
|
2435E931000
|
heap
|
page read and write
|
||
|
2435E8BB000
|
heap
|
page read and write
|
||
|
D6D000
|
heap
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
4FD0000
|
trusted library allocation
|
page read and write
|
||
|
7337000
|
trusted library allocation
|
page read and write
|
||
|
133F000
|
stack
|
page read and write
|
||
|
2435E921000
|
heap
|
page read and write
|
||
|
ED2000
|
trusted library allocation
|
page read and write
|
||
|
11ED000
|
trusted library allocation
|
page read and write
|
||
|
2435E90F000
|
heap
|
page read and write
|
||
|
EDB000
|
trusted library allocation
|
page execute and read and write
|
||
|
5C90000
|
heap
|
page read and write
|
||
|
24360400000
|
heap
|
page read and write
|
||
|
2AC1000
|
trusted library allocation
|
page read and write
|
||
|
4FC0000
|
trusted library allocation
|
page read and write
|
||
|
2435E880000
|
heap
|
page read and write
|
||
|
24361142000
|
trusted library allocation
|
page read and write
|
||
|
153E000
|
direct allocation
|
page execute and read and write
|
||
|
24360F13000
|
heap
|
page read and write
|
||
|
24360F17000
|
heap
|
page read and write
|
||
|
2435E926000
|
heap
|
page read and write
|
||
|
2435E94A000
|
heap
|
page read and write
|
||
|
3B05000
|
trusted library allocation
|
page read and write
|
||
|
100E000
|
stack
|
page read and write
|
||
|
7DBD000
|
stack
|
page read and write
|
||
|
B90000
|
heap
|
page read and write
|
||
|
2ABF000
|
stack
|
page read and write
|
||
|
702000
|
unkown
|
page readonly
|
||
|
2436179B000
|
heap
|
page read and write
|
||
|
EB0000
|
trusted library allocation
|
page read and write
|
||
|
24360F40000
|
heap
|
page read and write
|
||
|
50F3000
|
heap
|
page read and write
|
||
|
24360ACF000
|
heap
|
page read and write
|
||
|
EA0000
|
trusted library allocation
|
page read and write
|
||
|
2435E923000
|
heap
|
page read and write
|
||
|
431A000
|
trusted library allocation
|
page read and write
|
||
|
50A0000
|
trusted library allocation
|
page read and write
|
||
|
EC0000
|
trusted library allocation
|
page read and write
|
||
|
875C3FF000
|
stack
|
page read and write
|
||
|
24360F0D000
|
heap
|
page read and write
|
||
|
50D0000
|
heap
|
page read and write
|
||
|
9200000
|
heap
|
page read and write
|
||
|
EAD000
|
trusted library allocation
|
page execute and read and write
|
||
|
D90000
|
heap
|
page read and write
|
||
|
EC2000
|
trusted library allocation
|
page read and write
|
||
|
5C70000
|
heap
|
page read and write
|
||
|
1666000
|
direct allocation
|
page execute and read and write
|
||
|
24361144000
|
trusted library allocation
|
page read and write
|
||
|
3AC1000
|
trusted library allocation
|
page read and write
|
||
|
728E000
|
stack
|
page read and write
|
||
|
EF0000
|
heap
|
page read and write
|
||
|
2435E8CB000
|
heap
|
page read and write
|
||
|
24360550000
|
heap
|
page read and write
|
||
|
2435E94A000
|
heap
|
page read and write
|
||
|
6F90000
|
trusted library allocation
|
page execute and read and write
|
||
|
920B000
|
heap
|
page read and write
|
||
|
2435E932000
|
heap
|
page read and write
|
||
|
14C9000
|
direct allocation
|
page execute and read and write
|
||
|
24360570000
|
heap
|
page read and write
|
||
|
2435E8DD000
|
heap
|
page read and write
|
||
|
2435EC3B000
|
heap
|
page read and write
|
||
|
4FC5000
|
trusted library allocation
|
page read and write
|
||
|
52CB000
|
stack
|
page read and write
|
||
|
719E000
|
stack
|
page read and write
|
||
|
24361148000
|
trusted library allocation
|
page read and write
|
||
|
2435E8B0000
|
heap
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
2435E934000
|
heap
|
page read and write
|
||
|
243608C2000
|
heap
|
page read and write
|
||
|
550D000
|
stack
|
page read and write
|
||
|
11C0000
|
trusted library allocation
|
page read and write
|
||
|
4FB0000
|
trusted library allocation
|
page read and write
|
||
|
2435E8BD000
|
heap
|
page read and write
|
||
|
7A9E000
|
stack
|
page read and write
|
||
|
24360F13000
|
heap
|
page read and write
|
||
|
4C5C000
|
stack
|
page read and write
|
||
|
56A1000
|
trusted library allocation
|
page read and write
|
||
|
24360F50000
|
heap
|
page read and write
|
||
|
2435E931000
|
heap
|
page read and write
|
||
|
24361861000
|
heap
|
page read and write
|
||
|
2435E924000
|
heap
|
page read and write
|
||
|
799E000
|
stack
|
page read and write
|
||
|
2435E930000
|
heap
|
page read and write
|
||
|
700E000
|
heap
|
page read and write
|
||
|
50F0000
|
heap
|
page read and write
|
||
|
6F30000
|
trusted library section
|
page read and write
|
||
|
5030000
|
heap
|
page read and write
|
||
|
2435E90E000
|
heap
|
page read and write
|
||
|
24360F05000
|
heap
|
page read and write
|
||
|
5C60000
|
heap
|
page read and write
|
||
|
5090000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
trusted library allocation
|
page read and write
|
||
|
7D70000
|
trusted library allocation
|
page execute and read and write
|
||
|
700A000
|
heap
|
page read and write
|
||
|
6D60000
|
heap
|
page read and write
|
||
|
C3D000
|
stack
|
page read and write
|
||
|
24360F20000
|
heap
|
page read and write
|
||
|
4AC8000
|
trusted library allocation
|
page read and write
|
||
|
D2E000
|
heap
|
page read and write
|
||
|
24360F06000
|
heap
|
page read and write
|
||
|
2435E934000
|
heap
|
page read and write
|
||
|
1190000
|
trusted library allocation
|
page execute and read and write
|
||
|
24361143000
|
trusted library allocation
|
page read and write
|
||
|
2435E92D000
|
heap
|
page read and write
|
||
|
875BFFE000
|
stack
|
page read and write
|
||
|
13A0000
|
direct allocation
|
page execute and read and write
|
||
|
E5E000
|
stack
|
page read and write
|
||
|
2435E8CD000
|
heap
|
page read and write
|
||
|
2435EA60000
|
heap
|
page read and write
|
||
|
2B85000
|
trusted library allocation
|
page read and write
|
||
|
24360AC9000
|
heap
|
page read and write
|
||
|
2435E934000
|
heap
|
page read and write
|
||
|
CFE000
|
stack
|
page read and write
|
||
|
EAE000
|
stack
|
page read and write
|
||
|
CB0000
|
heap
|
page read and write
|
||
|
11DE000
|
trusted library allocation
|
page read and write
|
||
|
11E6000
|
trusted library allocation
|
page read and write
|
||
|
B67000
|
stack
|
page read and write
|
||
|
1040000
|
heap
|
page read and write
|
||
|
7320000
|
trusted library allocation
|
page read and write
|
||
|
6F60000
|
trusted library allocation
|
page execute and read and write
|
||
|
6FE1000
|
heap
|
page read and write
|
||
|
EBD000
|
trusted library allocation
|
page execute and read and write
|
||
|
114E000
|
stack
|
page read and write
|
||
|
EEE000
|
stack
|
page read and write
|
||
|
2435E919000
|
heap
|
page read and write
|
||
|
875C2FF000
|
stack
|
page read and write
|
||
|
50C0000
|
trusted library section
|
page readonly
|
||
|
16E8000
|
direct allocation
|
page execute and read and write
|
||
|
24360BD8000
|
heap
|
page read and write
|
||
|
24360F01000
|
heap
|
page read and write
|
||
|
EC6000
|
trusted library allocation
|
page execute and read and write
|
||
|
2435E948000
|
heap
|
page read and write
|
||
|
24360DFC000
|
heap
|
page read and write
|
||
|
785E000
|
stack
|
page read and write
|
||
|
6F2E000
|
stack
|
page read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
D64000
|
heap
|
page read and write
|
||
|
123F000
|
stack
|
page read and write
|
||
|
2435E8DD000
|
heap
|
page read and write
|
||
|
2435E8B6000
|
heap
|
page read and write
|
||
|
D3D000
|
stack
|
page read and write
|
||
|
700000
|
unkown
|
page readonly
|
||
|
24361542000
|
heap
|
page read and write
|
||
|
24360F1A000
|
heap
|
page read and write
|
||
|
2435E94A000
|
heap
|
page read and write
|
||
|
2435E8B0000
|
heap
|
page read and write
|
||
|
6F70000
|
trusted library allocation
|
page read and write
|
||
|
2435E919000
|
heap
|
page read and write
|
||
|
2435E905000
|
heap
|
page read and write
|
||
|
24360E30000
|
heap
|
page read and write
|
||
|
554E000
|
stack
|
page read and write
|
||
|
2435E89C000
|
heap
|
page read and write
|
||
|
1200000
|
heap
|
page read and write
|
||
|
55A0000
|
trusted library allocation
|
page read and write
|
||
|
24361146000
|
trusted library allocation
|
page read and write
|
||
|
2435E934000
|
heap
|
page read and write
|
||
|
56A6000
|
trusted library allocation
|
page read and write
|
||
|
24360FF0000
|
heap
|
page read and write
|
||
|
2435E8B6000
|
heap
|
page read and write
|
||
|
24360401000
|
heap
|
page read and write
|
||
|
243618A3000
|
heap
|
page read and write
|
||
|
F40000
|
heap
|
page read and write
|
||
|
D57000
|
heap
|
page read and write
|
||
|
2435E94A000
|
heap
|
page read and write
|
||
|
5360000
|
heap
|
page execute and read and write
|
||
|
7EBE000
|
stack
|
page read and write
|
||
|
DFF000
|
heap
|
page read and write
|
||
|
2435E980000
|
heap
|
page read and write
|
||
|
5050000
|
trusted library allocation
|
page read and write
|
||
|
2435E8DB000
|
heap
|
page read and write
|
||
|
243608C0000
|
heap
|
page read and write
|
||
|
ECA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2435E8AB000
|
heap
|
page read and write
|
||
|
243618A4000
|
heap
|
page read and write
|
||
|
110F000
|
stack
|
page read and write
|
||
|
2435E8AA000
|
heap
|
page read and write
|
||
|
7007000
|
heap
|
page read and write
|
||
|
A6A000
|
stack
|
page read and write
|
||
|
24361147000
|
trusted library allocation
|
page read and write
|
||
|
2435EA80000
|
heap
|
page read and write
|
||
|
1217000
|
heap
|
page read and write
|
||
|
243618E5000
|
heap
|
page read and write
|
||
|
875C4FE000
|
stack
|
page read and write
|
||
|
2435E936000
|
heap
|
page read and write
|
||
|
24360E20000
|
heap
|
page read and write
|
||
|
6FA0000
|
heap
|
page read and write
|
||
|
55B0000
|
heap
|
page read and write
|
||
|
ED7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1850000
|
heap
|
page read and write
|
||
|
7330000
|
trusted library allocation
|
page read and write
|
||
|
24361145000
|
trusted library allocation
|
page read and write
|
||
|
1210000
|
heap
|
page read and write
|
||
|
795F000
|
stack
|
page read and write
|
||
|
EB3000
|
trusted library allocation
|
page read and write
|
||
|
24360F16000
|
heap
|
page read and write
|
||
|
F48000
|
heap
|
page read and write
|
||
|
875C0FE000
|
stack
|
page read and write
|
||
|
24360500000
|
heap
|
page read and write
|
||
|
EA4000
|
trusted library allocation
|
page read and write
|
||
|
7D2000
|
unkown
|
page readonly
|
||
|
5350000
|
trusted library allocation
|
page execute and read and write
|
||
|
2435E905000
|
heap
|
page read and write
|
||
|
24360F08000
|
heap
|
page read and write
|
||
|
EF0000
|
trusted library allocation
|
page read and write
|
||
|
5040000
|
trusted library allocation
|
page execute and read and write
|
||
|
166D000
|
direct allocation
|
page execute and read and write
|
||
|
6F80000
|
trusted library allocation
|
page execute and read and write
|
||
|
5080000
|
trusted library allocation
|
page read and write
|
||
|
11E1000
|
trusted library allocation
|
page read and write
|
||
|
6FC3000
|
heap
|
page read and write
|
||
|
1651000
|
direct allocation
|
page execute and read and write
|
||
|
24360E31000
|
heap
|
page read and write
|
||
|
2435E907000
|
heap
|
page read and write
|
||
|
2435E8CA000
|
heap
|
page read and write
|
||
|
2435E8DB000
|
heap
|
page read and write
|
||
|
2435EC30000
|
heap
|
page read and write
|
||
|
24360DF0000
|
heap
|
page read and write
|
||
|
875BEFA000
|
stack
|
page read and write
|
||
|
11A0000
|
heap
|
page execute and read and write
|
||
|
6FD4000
|
heap
|
page read and write
|
||
|
2435EC35000
|
heap
|
page read and write
|
||
|
94FE000
|
stack
|
page read and write
|
||
|
243618E5000
|
heap
|
page read and write
|
||
|
7382000
|
trusted library allocation
|
page read and write
|
||
|
2D3E000
|
trusted library allocation
|
page read and write
|
||
|
24361140000
|
trusted library allocation
|
page read and write
|
||
|
2435E8CD000
|
heap
|
page read and write
|
||
|
24361790000
|
heap
|
page read and write
|
||
|
2D36000
|
trusted library allocation
|
page read and write
|
||
|
2435E905000
|
heap
|
page read and write
|
||
|
2435E91F000
|
heap
|
page read and write
|
||
|
2435E905000
|
heap
|
page read and write
|
||
|
2435E92F000
|
heap
|
page read and write
|
||
|
3AC9000
|
trusted library allocation
|
page read and write
|
||
|
24360F23000
|
heap
|
page read and write
|
||
|
B95000
|
heap
|
page read and write
|
||
|
558E000
|
stack
|
page read and write
|
||
|
7FC80000
|
trusted library allocation
|
page execute and read and write
|
||
|
5C94000
|
heap
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
EA3000
|
trusted library allocation
|
page execute and read and write
|
||
|
2435E909000
|
heap
|
page read and write
|
||
|
24361141000
|
trusted library allocation
|
page read and write
|
||
|
14CD000
|
direct allocation
|
page execute and read and write
|
||
|
2435E8C9000
|
heap
|
page read and write
|
||
|
2435E8A1000
|
heap
|
page read and write
|
||
|
875C5FE000
|
stack
|
page read and write
|
||
|
243618E5000
|
heap
|
page read and write
|
||
|
2435E8EB000
|
heap
|
page read and write
|
||
|
11B0000
|
trusted library allocation
|
page read and write
|
||
|
2435E922000
|
heap
|
page read and write
|
||
|
24361791000
|
heap
|
page read and write
|
||
|
6F50000
|
trusted library allocation
|
page read and write
|
||
|
2435E910000
|
heap
|
page read and write
|
||
|
55B5000
|
heap
|
page read and write
|
There are 258 hidden memdumps, click here to show them.