Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

4wECQoBvYC.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.596232553765719
Filename:	4wECQoBvYC.exe
Filesize:	4087808
MD5:	472cd96b1b5771243c40c10cd034324e
SHA1:	e6544fd71357a36bf5bad454a2662ef3af7a4e03
SHA256:	24c3329fc783efce51593d5e4274008fcff8d86f8df9fd8a47ca0af8df1e031d
SHA512:	3ed7fbffc297595e71193c26e3d6468f943dd94f13fbdd65358c4e47c89ab35f50c294894f6e798e05491de9518d8281864752659f84f33fea589099ed466a1f
SSDEEP:	49152:SqXI6JHV5G/XEeLTSB/PzpvxGDNMzZxiOkwSF3Gsw/D+ZuWjH6CiolZ:St6JHS/KnzpvxGpM9xUX3rPjR
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............j...j...j...b...j...f...j...f..8j...b...j..MI...j...b...j...b...j..mI...j...j...h...}...j...}..^j...f...j..{a...j...f...j.

Signature Hits	Behavior Group	Mitre Attack
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Found malware configuration	AV Detection	Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery Ingress Tool Transfer
Drops PE files to the document folder of the user	Persistence and Installation Behavior
Drops large PE files	System Summary	Access Token Manipulation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Input Capture
Abnormal high CPU Usage	System Summary	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery Ingress Tool Transfer
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion	Security Software Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder Access Token Manipulation File and Directory Discovery
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary	Access Token Manipulation
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Executes visual basic scripts	System Summary	Scripting
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery
Reads ini files	System Summary
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample might require command line arguments	System Summary	Access Token Manipulation Security Software Discovery
Sample reads its own file content	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\ukiglbypimmphepyxgwyogkqxgydyyk.vbs

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\ukiglbypimmphepyxgwyogkqxgydyyk.vbs
Category:	dropped
Dump:	ukiglbypimmphepyxgwyogkqxgydyyk.vbs.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Users\user\Desktop\4wECQoBvYC.exe
Type:	data
Entropy:	3.5107221010612366
Encrypted:	false
Ssdeep:	12:xQ4lA2++ugypjBQMPURoFEOw4Q3DxFEOw49Hz/0aimi:7a2+SD/Ow4QT4Ow49Aait
Size:	472
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Script Interpreter Execution From Suspicious Folder	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Sigma detected: WScript or CScript Dropper	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Creates temporary files	System Summary
Executes visual basic scripts	System Summary	Scripting
Spawns processes	System Summary	Process Injection

C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exe
Category:	dropped
Dump:	PerfectouinVans.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\4wECQoBvYC.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.0665821266031963
Encrypted:	false
Size:	979567347
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files to the document folder of the user	Persistence and Installation Behavior
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary

C:\ProgramData\registro\registros.dat

data

dropped

Details

File:	C:\ProgramData\registro\registros.dat
Category:	dropped
Dump:	registros.dat.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Users\user\Desktop\4wECQoBvYC.exe
Type:	data
Entropy:	3.338316661577143
Encrypted:	false
Ssdeep:	12:6l9NOlMecml9NcbWFe5Ul9NwMQcl9NwEAbWFe5Ul9Ne6cl9NgbW+:6vNKxcmvNoWqUvNwMQcvNwNWqUvNWvNw
Size:	488
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
Category:	dropped
Dump:	json[1].json.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Users\user\Desktop\4wECQoBvYC.exe
Type:	JSON data
Entropy:	5.012684553542002
Encrypted:	false
Ssdeep:	12:tkluJnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkw7S:qluNdbauKyGX85jvXhNlT3/7CcVKWro
Size:	963
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\4wECQoBvYC.exe

"C:\Users\user\Desktop\4wECQoBvYC.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6172
Target ID:	0
Parent PID:	1028
Name:	4wECQoBvYC.exe
Path:	C:\Users\user\Desktop\4wECQoBvYC.exe
Commandline:	"C:\Users\user\Desktop\4wECQoBvYC.exe"
Size:	4087808
MD5:	472CD96B1B5771243C40C10CD034324E
Time:	16:41:52
Date:	09/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	4186112
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sigma detected: Script Interpreter Execution From Suspicious Folder	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Sigma detected: WScript or CScript Dropper	System Summary
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
PE file has an executable .text section and no other executable section	System Summary
Public key (encryption) found	Cryptography	Archive Collected Data
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\4wECQoBvYC.exe

"C:\Users\user\Desktop\4wECQoBvYC.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6580
Target ID:	2
Parent PID:	6172
Name:	4wECQoBvYC.exe
Path:	C:\Users\user\Desktop\4wECQoBvYC.exe
Commandline:	"C:\Users\user\Desktop\4wECQoBvYC.exe"
Size:	4087808
MD5:	472CD96B1B5771243C40C10CD034324E
Time:	16:42:07
Date:	09/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	4186112
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sigma detected: Script Interpreter Execution From Suspicious Folder	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Sigma detected: WScript or CScript Dropper	System Summary
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
PE file has an executable .text section and no other executable section	System Summary
Public key (encryption) found	Cryptography	Archive Collected Data
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\ukiglbypimmphepyxgwyogkqxgydyyk.vbs"

Details

Is windows:	true
Is dropped:	false
PID:	1864
Target ID:	5
Parent PID:	6580
Name:	wscript.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\wscript.exe
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\ukiglbypimmphepyxgwyogkqxgydyyk.vbs"
Size:	147456
MD5:	FF00E0480075B095948000BDC66E81F0
Time:	16:43:58
Date:	09/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xf0000
Modulesize:	159744
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Script Interpreter Execution From Suspicious Folder	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Sigma detected: WScript or CScript Dropper	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript	System Summary
Executes visual basic scripts	System Summary	Scripting
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

formationslistcomplet2.sexidude.com

http://geoplugin.net/json.gp

178.237.33.50

http://www.evenbalance.com/troubletick

unknown

http://www.evenbalance.com/

unknown

http://www.evenbalance.com/index.php?page=pbsvcfaq.phpChecking

unknown

http://www.evenbalance.com/troubleticket/

unknown

http://geoplugin.net/

unknown

http://geoplugin.net/json.gp/C

unknown

http://geoplugin.net/json.gpl

unknown

http://www.evenbalance.com/index.php?page=pbsvcfaq.php

unknown

http://geoplugin.net/json.gpq

unknown

http://www.evenbalance.com/index.php?page=pbsvcfaq.phpDisplayVersion%d.%dDisplayNamePunkBuster

unknown

http://geoplugin.net/json.gp:

unknown

http://geoplugin.net/json.gpSystem32

unknown

There are 4 hidden URLs, click here to show them.

Domains

Name

Malicious

formationslistcomplet2.sexidude.com

181.131.217.244

Details

Name:	formationslistcomplet2.sexidude.com
IP:	181.131.217.244
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

181.131.217.244

formationslistcomplet2.sexidude.com

Colombia

Details

IP:	181.131.217.244
TargetID:	2
Current Path:	C:\Users\user\Desktop\4wECQoBvYC.exe
Country:	Colombia
Countrycode:	COL
ASN number:	13489
ASN name:	EPMTelecomunicacionesSAESPCO
Private:	false
Domain:	formationslistcomplet2.sexidude.com

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	2
Current Path:	C:\Users\user\Desktop\4wECQoBvYC.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

PerfectouinVans

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	PerfectouinVans
Value data:	C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\kkdhhcnbvyrmqyodgffgfdds-SO2AWR

exepath

HKEY_CURRENT_USER\SOFTWARE\kkdhhcnbvyrmqyodgffgfdds-SO2AWR

licence

HKEY_CURRENT_USER\SOFTWARE\kkdhhcnbvyrmqyodgffgfdds-SO2AWR

time

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

LangID

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Windows\System32\WScript.exe.FriendlyAppName

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Windows\System32\WScript.exe.ApplicationCompany

Memdumps

Base Address

Regiontype

Protect

Malicious

700000

unkown

page execute and read and write

21B0000

direct allocation

page execute and read and write

C0000

remote allocation

page execute and read and write

353E000

stack

page read and write

8B6E000

stack

page read and write

FF8000

stack

page read and write

2FE7000

heap

page read and write

3012000

heap

page read and write

353A000

heap

page read and write

400000

unkown

page readonly

1ABC000

stack

page read and write

3029000

heap

page read and write

8EEC000

unkown

page read and write

4E1000

unkown

page readonly

2F60000

heap

page read and write

3026000

heap

page read and write

301B000

heap

page read and write

1AC8000

heap

page read and write

300F000

heap

page read and write

3018000

heap

page read and write

116E000

stack

page read and write

3014000

heap

page read and write

301D000

heap

page read and write

5D8F000

stack

page read and write

3008000

heap

page read and write

300A000

heap

page read and write

34E0000

heap

page read and write

3003000

heap

page read and write

79D000

unkown

page readonly

799E000

stack

page read and write

300E000

heap

page read and write

2226000

direct allocation

page execute and read and write

3D8F000

stack

page read and write

1B32000

heap

page read and write

302E000

heap

page read and write

972E000

stack

page read and write

301E000

heap

page read and write

3029000

heap

page read and write

3031000

heap

page read and write

3DB0000

direct allocation

page read and write

53EF000

stack

page read and write

400000

unkown

page readonly

819F000

stack

page read and write

77B000

unkown

page readonly

300E000

heap

page read and write

791000

unkown

page readonly

400000

unkown

page readonly

301D000

heap

page read and write

3016000

heap

page read and write

2FD8000

heap

page read and write

791000

unkown

page readonly

2FAE000

stack

page read and write

301D000

heap

page read and write

2FF1000

heap

page read and write

3030000

heap

page read and write

1B04000

heap

page read and write

3100000

heap

page read and write

301B000

heap

page read and write

3012000

heap

page read and write

3520000

heap

page read and write

3024000

heap

page read and write

1A2C000

stack

page read and write

301D000

heap

page read and write

79D000

unkown

page execute and write copy

302C000

heap

page read and write

19AE000

stack

page read and write

795F000

stack

page read and write

34FE000

stack

page read and write

21AE000

stack

page read and write

3020000

heap

page read and write

3024000

heap

page read and write

3DA3000

direct allocation

page read and write

791000

unkown

page readonly

3004000

heap

page read and write

3018000

heap

page read and write

458F000

stack

page read and write

34DE000

stack

page read and write

3020000

heap

page read and write

3001000

heap

page read and write

401000

unkown

page execute read

821E000

stack

page read and write

788000

unkown

page readonly

3105000

heap

page read and write

1030000

heap

page read and write

103A000

heap

page read and write

558F000

stack

page read and write

133000

remote allocation

page execute and read and write

54EF000

stack

page read and write

52B000

unkown

page write copy

301D000

heap

page read and write

401000

unkown

page execute read

3035000

heap

page read and write

400000

unkown

page readonly

7D2000

unkown

page readonly

3035000

heap

page read and write

300C000

heap

page read and write

788000

unkown

page readonly

8E0F000

unkown

page read and write

3587000

heap

page read and write

3029000

heap

page read and write

4E1000

unkown

page readonly

300D000

heap

page read and write

301D000

heap

page read and write

9C000

stack

page read and write

1BF0000

heap

page read and write

2290000

heap

page read and write

3B21000

direct allocation

page read and write

401000

unkown

page execute read

18E5000

heap

page read and write

3014000

heap

page read and write

8A1F000

stack

page read and write

32DE000

stack

page read and write

3022000

heap

page read and write

1B55000

heap

page read and write

103E000

heap

page read and write

3035000

heap

page read and write

2FE7000

heap

page read and write

1B25000

heap

page read and write

3016000

heap

page read and write

1AC0000

heap

page read and write

3000000

heap

page read and write

4E1000

unkown

page readonly

3001000

heap

page read and write

982F000

stack

page read and write

17FC000

stack

page read and write

17C000

stack

page read and write

300F000

heap

page read and write

8A6E000

stack

page read and write

3035000

heap

page read and write

1B25000

heap

page read and write

795000

unkown

page execute and read and write

3580000

heap

page read and write

7D2000

unkown

page readonly

77B000

unkown

page readonly

2FC0000

heap

page read and write

3002000

heap

page read and write

79D000

unkown

page readonly

3024000

heap

page read and write

3DB9000

direct allocation

page read and write

1B3A000

heap

page read and write

6E7000

unkown

page readonly

3035000

heap

page read and write

E0000

heap

page read and write

2FC7000

heap

page read and write

77F000

unkown

page execute and read and write

691E000

stack

page read and write

4D8B000

stack

page read and write

6CE000

unkown

page write copy

3024000

heap

page read and write

1C3E000

stack

page read and write

4E1000

unkown

page readonly

52B000

unkown

page write copy

196F000

stack

page read and write

18F0000

heap

page read and write

1B3A000

heap

page read and write

300A000

heap

page read and write

8BAE000

stack

page read and write

78B000

unkown

page execute and read and write

3003000

heap

page read and write

2250000

heap

page read and write

2FB0000

heap

page read and write

96ED000

stack

page read and write

18D0000

heap

page read and write

6E7000

unkown

page readonly

7D5000

unkown

page execute and read and write

3005000

heap

page read and write

3014000

heap

page read and write

4E1E000

stack

page read and write

7D2000

unkown

page readonly

791000

unkown

page execute and write copy

2FEB000

heap

page read and write

52B000

unkown

page write copy

711F000

stack

page read and write

3530000

heap

page read and write

3029000

heap

page read and write

3023000

heap

page read and write

79D000

unkown

page readonly

2FD5000

heap

page read and write

658E000

stack

page read and write

6E7000

unkown

page readonly

2BFB000

stack

page read and write

3490000

heap

page read and write

300F000

heap

page read and write

3017000

heap

page read and write

6E7000

unkown

page readonly

77B000

unkown

page execute and write copy

3470000

heap

page read and write

3017000

heap

page read and write

1B0000

heap

page read and write

301D000

heap

page read and write

2FF0000

heap

page read and write

4EB0000

heap

page read and write

1A7E000

stack

page read and write

52B000

unkown

page write copy

77B000

unkown

page readonly

3A40000

direct allocation

page read and write

3031000

heap

page read and write

1E0000

heap

page read and write

1B3A000

heap

page read and write

100000

heap

page read and write

3028000

heap

page read and write

2EFB000

stack

page read and write

8CAB000

stack

page read and write

3DC5000

direct allocation

page read and write

1900000

heap

page read and write

788000

unkown

page readonly

300A000

heap

page read and write

30FE000

stack

page read and write

2FEA000

heap

page read and write

3010000

heap

page read and write

401000

unkown

page execute read

1FC000

stack

page read and write

3032000

heap

page read and write

3015000

heap

page read and write

715E000

stack

page read and write

3027000

heap

page read and write

7A2000

unkown

page execute and read and write

7D2000

unkown

page execute and write copy

3DFA000

direct allocation

page read and write

33DF000

stack

page read and write

6CD000

unkown

page read and write

302D000

heap

page read and write

18E0000

heap

page read and write

301A000

heap

page read and write

136000

remote allocation

page execute and read and write

788000

unkown

page execute and write copy

There are 216 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
4wECQoBvYC.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report4wECQoBvYC.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
4wECQoBvYC.exe