IOC Report
1L8qjfD9J2.exe

loading gif

Files

File Path
Type
Category
Malicious
1L8qjfD9J2.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1L8qjfD9J2.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp8E14.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eEUHByXtioQ.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1idprecd.j5j.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dg01vz0j.xmc.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jdbtjsx3.srr.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k0zr0w0z.igo.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oogz05jz.pn5.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q3ppax1x.uwp.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sytrkr4x.iy0.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmg3treg.xkk.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpA1EA.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\1L8qjfD9J2.exe
"C:\Users\user\Desktop\1L8qjfD9J2.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\1L8qjfD9J2.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8E14.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe
C:\Users\user\AppData\Roaming\eEUHByXtioQ.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eEUHByXtioQ" /XML "C:\Users\user\AppData\Local\Temp\tmpA1EA.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
ronymahmoud.casacam.net
52.201.248.168
 malicious
bg.microsoft.map.fastly.net
199.232.210.172
s-part-0035.t-0009.t-msedge.net
13.107.246.63
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
52.201.248.168
ronymahmoud.casacam.net
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
HKEY_CURRENT_USER\SOFTWARE\0100398783ec4727
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
2948000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2960000
trusted library allocation
page read and write
 malicious
29D1000
trusted library allocation
page read and write
 malicious
33E8000
trusted library allocation
page read and write
 malicious
3351000
trusted library allocation
page read and write
 malicious
2958000
trusted library allocation
page read and write
 malicious
3400000
trusted library allocation
page read and write
 malicious
3168000
trusted library allocation
page read and write
9B3E000
stack
page read and write
4552000
trusted library allocation
page read and write
5D30000
trusted library allocation
page read and write
A80000
heap
page read and write
4CD0000
trusted library allocation
page execute and read and write
8D9000
heap
page read and write
2CF0000
heap
page read and write
614D000
stack
page read and write
A36C000
stack
page read and write
4ACD000
stack
page read and write
8ED000
heap
page read and write
39D9000
trusted library allocation
page read and write
2801000
trusted library allocation
page read and write
A35E000
stack
page read and write
58B1000
trusted library allocation
page read and write
589B000
trusted library allocation
page read and write
5093000
heap
page execute and read and write
1678000
heap
page read and write
1884000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
4382000
trusted library allocation
page read and write
1886000
trusted library allocation
page read and write
5140000
heap
page read and write
E34000
trusted library allocation
page read and write
75F3000
heap
page read and write
59DE000
stack
page read and write
5DCE000
stack
page read and write
6EF2000
trusted library allocation
page read and write
280D000
trusted library allocation
page read and write
5784000
trusted library allocation
page read and write
38F2000
trusted library allocation
page read and write
EB0000
heap
page read and write
4F70000
trusted library allocation
page read and write
6DD8000
heap
page read and write
B38000
heap
page read and write
3412000
trusted library allocation
page read and write
9EBD000
stack
page read and write
1582000
trusted library allocation
page read and write
4E51000
trusted library allocation
page read and write
1587000
heap
page read and write
58B6000
trusted library allocation
page read and write
182E000
stack
page read and write
AE9000
heap
page read and write
5910000
trusted library allocation
page execute and read and write
5894000
trusted library allocation
page read and write
A5D0000
trusted library allocation
page read and write
408000
remote allocation
page execute and read and write
156D000
trusted library allocation
page execute and read and write
5125000
heap
page read and write
3340000
heap
page execute and read and write
84F000
heap
page read and write
17E0000
heap
page read and write
5796000
trusted library allocation
page read and write
143E000
stack
page read and write
7A69000
trusted library allocation
page read and write
BF0000
heap
page read and write
57C0000
trusted library allocation
page read and write
32C0000
heap
page execute and read and write
7A50000
trusted library allocation
page read and write
333E000
stack
page read and write
5900000
heap
page read and write
B5A000
trusted library allocation
page execute and read and write
13A0000
heap
page read and write
3510000
trusted library allocation
page read and write
A68000
heap
page read and write
A23E000
stack
page read and write
322000
unkown
page readonly
ABEE000
stack
page read and write
2BBB000
trusted library allocation
page read and write
E30000
heap
page read and write
5D39000
trusted library allocation
page read and write
142E000
stack
page read and write
310E000
stack
page read and write
A9AE000
stack
page read and write
400000
remote allocation
page execute and read and write
18A0000
trusted library allocation
page read and write
6AB8000
heap
page read and write
2CBF000
unkown
page read and write
5BB0000
heap
page read and write
E33000
trusted library allocation
page execute and read and write
2F4D000
trusted library allocation
page read and write
B33000
trusted library allocation
page execute and read and write
6DD0000
trusted library allocation
page read and write
6AA0000
heap
page read and write
5B8E000
stack
page read and write
123A000
stack
page read and write
E30000
trusted library allocation
page read and write
5799000
trusted library allocation
page read and write
57B0000
trusted library allocation
page read and write
B56000
trusted library allocation
page execute and read and write
5120000
heap
page read and write
5230000
heap
page read and write
15FE000
heap
page read and write
1632000
heap
page read and write
871000
heap
page read and write
5730000
trusted library allocation
page read and write
4E80000
trusted library allocation
page read and write
83E000
heap
page read and write
5922000
trusted library allocation
page read and write
6DD0000
heap
page read and write
77A9000
heap
page read and write
19BE000
stack
page read and write
157A000
heap
page read and write
2A10000
trusted library allocation
page read and write
5F25000
heap
page read and write
4D83000
heap
page read and write
4F90000
heap
page read and write
810000
heap
page read and write
B50000
trusted library allocation
page read and write
7A60000
trusted library allocation
page read and write
155D000
trusted library allocation
page execute and read and write
2BA3000
trusted library allocation
page read and write
B7A000
stack
page read and write
4E5D000
trusted library allocation
page read and write
4E4A000
trusted library allocation
page read and write
790E000
stack
page read and write
3B9000
stack
page read and write
7790000
heap
page read and write
E80000
trusted library allocation
page read and write
9C7E000
stack
page read and write
E5A000
trusted library allocation
page execute and read and write
36BB000
trusted library allocation
page read and write
A60000
heap
page read and write
930000
heap
page read and write
13F0000
heap
page read and write
57B6000
trusted library allocation
page read and write
573A000
trusted library allocation
page read and write
A7E000
heap
page read and write
5B80000
heap
page read and write
5FAE000
stack
page read and write
2CD0000
heap
page read and write
BE0000
heap
page read and write
6EE0000
heap
page read and write
5890000
trusted library allocation
page read and write
E3D000
trusted library allocation
page execute and read and write
A86C000
stack
page read and write
5A1E000
stack
page read and write
80D000
stack
page read and write
6C2E000
stack
page read and write
5FCD000
stack
page read and write
494C000
stack
page read and write
1695000
heap
page read and write
1573000
heap
page read and write
17B0000
trusted library allocation
page read and write
E4D000
trusted library allocation
page execute and read and write
5B90000
heap
page execute and read and write
1570000
trusted library allocation
page read and write
ADE000
heap
page read and write
5050000
trusted library allocation
page read and write
BA0000
heap
page read and write
4E10000
trusted library allocation
page read and write
A8A000
heap
page read and write
1580000
trusted library allocation
page read and write
4CE2000
trusted library allocation
page read and write
4E45000
trusted library allocation
page read and write
6DD5000
trusted library allocation
page read and write
4F5B000
stack
page read and write
296B000
trusted library allocation
page read and write
4E70000
trusted library allocation
page read and write
5E9C000
stack
page read and write
B34000
trusted library allocation
page read and write
2851000
trusted library allocation
page read and write
B6B000
trusted library allocation
page execute and read and write
1764000
trusted library allocation
page read and write
A5DE000
stack
page read and write
9C0000
heap
page read and write
BA5000
heap
page read and write
4CE0000
trusted library allocation
page read and write
7A65000
trusted library allocation
page read and write
1337000
stack
page read and write
57A0000
heap
page read and write
4351000
trusted library allocation
page read and write
E37000
heap
page read and write
77D4000
heap
page read and write
196D000
stack
page read and write
282000
unkown
page readonly
A4AE000
stack
page read and write
4E34000
trusted library allocation
page read and write
1587000
trusted library allocation
page execute and read and write
6AF1000
heap
page read and write
864000
heap
page read and write
1550000
trusted library allocation
page read and write
280000
unkown
page readonly
5F30000
trusted library allocation
page read and write
604B000
heap
page read and write
5920000
trusted library allocation
page read and write
7F7000
stack
page read and write
E00000
trusted library allocation
page read and write
720000
heap
page read and write
500C000
stack
page read and write
5960000
trusted library allocation
page execute and read and write
27FE000
trusted library allocation
page read and write
B3D000
heap
page read and write
4D40000
trusted library section
page readonly
192E000
stack
page read and write
5B60000
trusted library section
page readonly
5B70000
heap
page read and write
699E000
stack
page read and write
4D50000
heap
page read and write
5090000
heap
page execute and read and write
179B000
trusted library allocation
page execute and read and write
4E57000
trusted library allocation
page read and write
6A9E000
stack
page read and write
54F0000
trusted library allocation
page read and write
5774000
trusted library allocation
page read and write
5BEB000
heap
page read and write
E90000
heap
page read and write
42D5000
trusted library allocation
page read and write
900000
heap
page read and write
DD0000
heap
page read and write
5790000
heap
page read and write
1470000
heap
page read and write
3220000
trusted library allocation
page read and write
BF0000
heap
page read and write
27DC000
stack
page read and write
32D1000
trusted library allocation
page read and write
B67000
trusted library allocation
page execute and read and write
1890000
trusted library allocation
page read and write
13EE000
stack
page read and write
26E0000
trusted library allocation
page read and write
27DC000
stack
page read and write
1572000
trusted library allocation
page read and write
123B000
stack
page read and write
E43000
trusted library allocation
page read and write
28B3000
heap
page read and write
1450000
heap
page read and write
1689000
heap
page read and write
E40000
trusted library allocation
page read and write
4435000
trusted library allocation
page read and write
BE0000
trusted library allocation
page read and write
710000
heap
page read and write
5480000
heap
page read and write
1576000
trusted library allocation
page execute and read and write
1750000
trusted library allocation
page read and write
E20000
trusted library allocation
page read and write
5056000
trusted library allocation
page read and write
857000
heap
page read and write
B70000
heap
page read and write
9D7D000
stack
page read and write
FF5E0000
trusted library allocation
page execute and read and write
3230000
heap
page read and write
2CC0000
heap
page read and write
28A0000
trusted library allocation
page read and write
4506000
trusted library allocation
page read and write
6010000
trusted library allocation
page read and write
6D8E000
stack
page read and write
A61E000
stack
page read and write
15B0000
heap
page read and write
A5C0000
trusted library allocation
page read and write
B62000
trusted library allocation
page read and write
735E000
stack
page read and write
5CCE000
stack
page read and write
A4DD000
stack
page read and write
A49D000
stack
page read and write
1553000
trusted library allocation
page execute and read and write
321E000
stack
page read and write
4D80000
heap
page read and write
186C000
stack
page read and write
13A0000
heap
page read and write
1790000
trusted library allocation
page read and write
DFE000
stack
page read and write
2C7E000
unkown
page read and write
83A000
heap
page read and write
9C3F000
stack
page read and write
B20000
trusted library allocation
page read and write
43F2000
trusted library allocation
page read and write
15D0000
heap
page read and write
1550000
heap
page read and write
DBF000
stack
page read and write
3474000
trusted library allocation
page read and write
27EB000
trusted library allocation
page read and write
A71E000
stack
page read and write
A5AE000
stack
page read and write
77AE000
heap
page read and write
7BAE000
stack
page read and write
A1E000
stack
page read and write
4D60000
heap
page execute and read and write
E67000
trusted library allocation
page execute and read and write
785000
heap
page read and write
A39D000
stack
page read and write
18A5000
trusted library allocation
page read and write
6F7000
stack
page read and write
5D70000
heap
page read and write
5710000
heap
page read and write
3851000
trusted library allocation
page read and write
9A3E000
stack
page read and write
A5F000
stack
page read and write
58AE000
trusted library allocation
page read and write
A25E000
stack
page read and write
6040000
heap
page read and write
77CA000
heap
page read and write
4E3B000
trusted library allocation
page read and write
4E36000
trusted library allocation
page read and write
5B5B000
stack
page read and write
4E20000
trusted library allocation
page read and write
43D2000
trusted library allocation
page read and write
5FC0000
trusted library allocation
page execute and read and write
15F0000
heap
page read and write
1970000
heap
page read and write
15E0000
trusted library allocation
page execute and read and write
9BF000
unkown
page read and write
5049000
stack
page read and write
1624000
heap
page read and write
1560000
trusted library allocation
page read and write
1455000
heap
page read and write
1880000
trusted library allocation
page read and write
B3D000
trusted library allocation
page execute and read and write
2806000
trusted library allocation
page read and write
B80000
trusted library allocation
page read and write
A5E0000
trusted library allocation
page execute and read and write
4E3E000
trusted library allocation
page read and write
6ABD000
heap
page read and write
7AAE000
stack
page read and write
5080000
trusted library allocation
page execute and read and write
9FFE000
stack
page read and write
E20000
trusted library allocation
page read and write
E28000
trusted library allocation
page read and write
A5D2000
trusted library allocation
page read and write
5EA0000
trusted library allocation
page read and write
76E000
stack
page read and write
AFE000
stack
page read and write
5C8E000
stack
page read and write
9D80000
heap
page read and write
161B000
heap
page read and write
279E000
stack
page read and write
2969000
trusted library allocation
page read and write
26F0000
heap
page read and write
5EC0000
trusted library allocation
page execute and read and write
78CE000
stack
page read and write
8CA000
stack
page read and write
97E000
unkown
page read and write
4CC0000
heap
page read and write
9D0000
heap
page read and write
A15F000
stack
page read and write
9FBE000
stack
page read and write
158B000
trusted library allocation
page execute and read and write
AAEE000
stack
page read and write
1338000
stack
page read and write
6AD7000
heap
page read and write
4E42000
trusted library allocation
page read and write
B60000
heap
page read and write
42D1000
trusted library allocation
page read and write
2E00000
heap
page read and write
1870000
trusted library allocation
page read and write
CFE000
stack
page read and write
50DE000
stack
page read and write
27F8000
trusted library allocation
page read and write
54E0000
heap
page execute and read and write
16AD000
heap
page read and write
27E0000
heap
page read and write
13EE000
stack
page read and write
5950000
trusted library allocation
page read and write
3934000
trusted library allocation
page read and write
5745000
trusted library allocation
page read and write
52DE000
stack
page read and write
4E62000
trusted library allocation
page read and write
A13E000
stack
page read and write
160F000
heap
page read and write
AAAE000
stack
page read and write
5130000
heap
page read and write
B4D000
trusted library allocation
page execute and read and write
E25000
trusted library allocation
page read and write
1770000
trusted library allocation
page read and write
58DE000
stack
page read and write
5F0E000
stack
page read and write
4E4E000
trusted library allocation
page read and write
5460000
heap
page read and write
ABF1000
trusted library allocation
page read and write
88D000
stack
page read and write
39D1000
trusted library allocation
page read and write
18B0000
heap
page read and write
BD0000
trusted library allocation
page execute and read and write
5D50000
heap
page read and write
4D20000
trusted library allocation
page execute and read and write
72D0000
trusted library section
page read and write
E56000
trusted library allocation
page execute and read and write
27E0000
trusted library allocation
page read and write
57B4000
trusted library allocation
page read and write
1475000
heap
page read and write
17D0000
trusted library allocation
page execute and read and write
BCE000
stack
page read and write
AD6000
heap
page read and write
4D10000
trusted library allocation
page read and write
B46000
heap
page read and write
1554000
trusted library allocation
page read and write
5D40000
trusted library allocation
page read and write
4F8C000
stack
page read and write
4F60000
trusted library section
page read and write
1774000
trusted library allocation
page read and write
4E74000
trusted library allocation
page read and write
2840000
heap
page execute and read and write
2708000
trusted library allocation
page read and write
600B000
stack
page read and write
44BA000
trusted library allocation
page read and write
36AC000
trusted library allocation
page read and write
E6B000
trusted library allocation
page execute and read and write
5B4F000
stack
page read and write
2CFB000
heap
page read and write
26DF000
stack
page read and write
446E000
trusted library allocation
page read and write
5161000
heap
page read and write
4EA0000
trusted library allocation
page read and write
5C9D000
stack
page read and write
830000
heap
page read and write
EB6000
heap
page read and write
3200000
trusted library allocation
page read and write
58BD000
trusted library allocation
page read and write
E10000
trusted library allocation
page read and write
18EE000
stack
page read and write
A97000
heap
page read and write
28B0000
heap
page read and write
5A40000
heap
page execute and read and write
2890000
trusted library allocation
page execute and read and write
A94000
heap
page read and write
157A000
trusted library allocation
page execute and read and write
B30000
trusted library allocation
page read and write
6BA0000
trusted library allocation
page read and write
7CE000
stack
page read and write
B36000
heap
page read and write
544C000
stack
page read and write
17EE000
stack
page read and write
17C0000
heap
page read and write
314F000
stack
page read and write
28C0000
heap
page execute and read and write
15A0000
trusted library allocation
page read and write
B08000
heap
page read and write
15D7000
heap
page read and write
178A000
trusted library allocation
page execute and read and write
B3D000
stack
page read and write
340F000
trusted library allocation
page read and write
5741000
trusted library allocation
page read and write
1390000
heap
page read and write
53CE000
stack
page read and write
5788000
trusted library allocation
page read and write
5A23000
heap
page read and write
6DA0000
trusted library allocation
page execute and read and write
5D60000
heap
page read and write
5750000
heap
page read and write
174F000
stack
page read and write
57A5000
trusted library allocation
page read and write
77CC000
heap
page read and write
1780000
trusted library allocation
page read and write
A96C000
stack
page read and write
6ACA000
heap
page read and write
5130000
heap
page read and write
E62000
trusted library allocation
page read and write
1558000
heap
page read and write
7590000
heap
page read and write
A0FE000
stack
page read and write
A46C000
stack
page read and write
6ED0000
heap
page read and write
29CF000
stack
page read and write
1540000
trusted library allocation
page read and write
5A20000
heap
page read and write
745E000
stack
page read and write
5F20000
heap
page read and write
4FC9000
stack
page read and write
4E90000
trusted library allocation
page read and write
E50000
trusted library allocation
page read and write
6FA000
stack
page read and write
509D000
stack
page read and write
4D70000
heap
page read and write
2830000
trusted library allocation
page read and write
B40000
trusted library allocation
page read and write
6BEE000
stack
page read and write
780000
heap
page read and write
1763000
trusted library allocation
page execute and read and write
1797000
trusted library allocation
page execute and read and write
15FA000
heap
page read and write
4E30000
trusted library allocation
page read and write
CBE000
stack
page read and write
778F000
stack
page read and write
156E000
heap
page read and write
B10000
heap
page read and write
There are 473 hidden memdumps, click here to show them.