Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

OneDrive.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.0457642087720345
Filename:	OneDrive.exe
Filesize:	3368960
MD5:	7056e050ebbfca6ae325797d51eb2d0a
SHA1:	055cd6e4bde3449d72f7061620647ecb73d6b9cd
SHA256:	c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00
SHA512:	0c54802ad35f5a00c5db1195df2d566bc18a384f486cc3ca00dc63bb86e3fc5d105192cfe5efe9ed62bdedb441877486ec7aedbd7a6bf59fcda2f772308b150e
SSDEEP:	49152:ivlI22SsaNYfdPBldt698dBcjH09L/RBxwcoGdb9THHB72eh2NT:ivu22SsaNYfdPBldt6+dBcjHq/lL
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. ........................3...........@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for sample	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OneDrive.exe.log

CSV text

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OneDrive.exe.log
Category:	dropped
Dump:	OneDrive.exe.log.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\OneDrive.exe
Type:	CSV text
Entropy:	5.370111951859942
Encrypted:	false
Ssdeep:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
Size:	1281
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe
Category:	dropped
Dump:	Onedrive.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\OneDrive.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.0457642087720345
Encrypted:	false
Ssdeep:	49152:ivlI22SsaNYfdPBldt698dBcjH09L/RBxwcoGdb9THHB72eh2NT:ivu22SsaNYfdPBldt6+dBcjHq/lL
Size:	3368960
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Yara detected Quasar RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for dropped file	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Yara detected Generic Downloader	Networking
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Encrypted Channel Archive Collected Data
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\OneDrive.exe

"C:\Users\user\Desktop\OneDrive.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3184
Target ID:	0
Parent PID:	1028
Name:	OneDrive.exe
Path:	C:\Users\user\Desktop\OneDrive.exe
Commandline:	"C:\Users\user\Desktop\OneDrive.exe"
Size:	3368960
MD5:	7056E050EBBFCA6AE325797D51EB2D0A
Time:	00:40:00
Date:	27/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xc20000
Modulesize:	3391488
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Quasar RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for sample	AV Detection
Yara detected Generic Downloader	Networking
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\schtasks.exe

"schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f

Details

Is windows:	true
Is dropped:	false
PID:	5268
Target ID:	2
Parent PID:	3184
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\System32\schtasks.exe
Commandline:	"schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
Size:	235008
MD5:	76CD6626DD8834BD4A42E6A565104DC2
Time:	00:40:02
Date:	27/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff61a4d0000
Modulesize:	253952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe

"C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe"

Details

Is windows:	false
Is dropped:	true
PID:	6348
Target ID:	4
Parent PID:	3184
Name:	Onedrive.exe
Path:	C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe
Commandline:	"C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe"
Size:	3368960
MD5:	7056E050EBBFCA6AE325797D51EB2D0A
Time:	00:40:02
Date:	27/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb40000
Modulesize:	3391488
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Quasar RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for sample	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe

Details

Is windows:	false
Is dropped:	true
PID:	5460
Target ID:	5
Parent PID:	1068
Name:	Onedrive.exe
Path:	C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe
Commandline:	C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe
Size:	3368960
MD5:	7056E050EBBFCA6AE325797D51EB2D0A
Time:	00:40:03
Date:	27/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x6a0000
Modulesize:	3391488
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Quasar RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Machine Learning detection for sample	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\schtasks.exe

"schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f

Details

Is windows:	true
Is dropped:	false
PID:	5408
Target ID:	6
Parent PID:	6348
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\System32\schtasks.exe
Commandline:	"schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
Size:	235008
MD5:	76CD6626DD8834BD4A42E6A565104DC2
Time:	00:40:03
Date:	27/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff61a4d0000
Modulesize:	253952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6752
Target ID:	3
Parent PID:	5268
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	00:40:02
Date:	27/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1816
Target ID:	7
Parent PID:	5408
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	00:40:03
Date:	27/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

147.185.221.22

Details

Name:	147.185.221.22
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\OneDrive.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking

https://api.ipify.org/

unknown

https://stackoverflow.com/q/14436606/23354

unknown

https://stackoverflow.com/q/2152978/23354sCannot

unknown

https://ipwho.is/

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\OneDrive.exe
Source:	OneDrive.exe, 00000000.00000002.2060484287.0000000003211000.00000004.00000800.00020000.00000000.sdmp, Onedrive.exe, 00000004.00000002.3291009274.000000000336E000.00000004.00000800.00020000.00000000.sdmp, Onedrive.exe, 00000004.00000002.3291009274.0000000003089000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://stackoverflow.com/q/11564914/23354;

unknown

IPs

Domain

Country

Malicious

147.185.221.22

unknown

United States

Details

IP:	147.185.221.22
TargetID:	4
Current Path:	C:\Users\user\AppData\Roaming\Onedrive\Onedrive.exe
Country:	United States
Countrycode:	USA
ASN number:	12087
ASN name:	SALSGIVERUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

C22000

unkown

page readonly

7FF848D36000

trusted library allocation

page execute and read and write

2F63000

trusted library allocation

page read and write

1C34E000

stack

page read and write

E61000

heap

page read and write

7FF848C7D000

trusted library allocation

page execute and read and write

1820000

heap

page read and write

1B5DD000

stack

page read and write

7FF848D10000

trusted library allocation

page execute and read and write

2940000

heap

page read and write

D95000

heap

page read and write

353A000

trusted library allocation

page read and write

1780000

trusted library allocation

page read and write

1B5A0000

heap

page read and write

7FF848E80000

trusted library allocation

page read and write

1B6D0000

heap

page execute and read and write

7FF848FE0000

trusted library allocation

page execute and read and write

7FF848E58000

trusted library allocation

page read and write

7FF848E1C000

trusted library allocation

page read and write

1200000

heap

page read and write

1BAEC000

heap

page read and write

895FAFF000

unkown

page read and write

14E1000

heap

page read and write

7FF848D26000

trusted library allocation

page read and write

1BDF3000

heap

page read and write

7FF848E10000

trusted library allocation

page read and write

31A9000

trusted library allocation

page read and write

7FF8490C0000

trusted library allocation

page read and write

7FF848E84000

trusted library allocation

page read and write

7FF848E60000

trusted library allocation

page read and write

F40000

heap

page read and write

7FF848E65000

trusted library allocation

page read and write

1B5E2000

heap

page read and write

1B3DE000

heap

page read and write

1305E000

trusted library allocation

page read and write

106E000

stack

page read and write

1260000

heap

page read and write

1B920000

heap

page read and write

1428000

heap

page read and write

7FF848F90000

trusted library allocation

page read and write

2CCE000

stack

page read and write

1BA9E000

stack

page read and write

7FF848EE0000

trusted library allocation

page read and write

7FF848D0C000

trusted library allocation

page execute and read and write

1BC23000

heap

page read and write

22DCCE70000

heap

page read and write

12F3000

stack

page read and write

7FF848F50000

trusted library allocation

page read and write

3051000

trusted library allocation

page read and write

1BD50000

heap

page read and write

7FF848E70000

trusted library allocation

page read and write

22DCCF30000

heap

page read and write

17C0000

heap

page read and write

1100000

trusted library allocation

page read and write

7FF848C83000

trusted library allocation

page read and write

1195000

heap

page read and write

27493230000

heap

page read and write

7FF8490AC000

trusted library allocation

page read and write

7FF849062000

trusted library allocation

page read and write

7FF848C90000

trusted library allocation

page read and write

F51000

unkown

page readonly

1321E000

trusted library allocation

page read and write

1BB70000

heap

page read and write

F60000

heap

page read and write

7FF848E41000

trusted library allocation

page read and write

1296000

heap

page read and write

1400000

heap

page read and write

6DA58FF000

unkown

page read and write

14DF000

heap

page read and write

1BD10000

heap

page read and write

1BE6F000

stack

page read and write

29C0000

heap

page read and write

7FF848D90000

trusted library allocation

page execute and read and write

1BD44000

heap

page read and write

1090000

heap

page read and write

1210000

heap

page read and write

7FF848E5C000

trusted library allocation

page read and write

6DA5879000

stack

page read and write

143E000

heap

page read and write

146D000

heap

page read and write

1870000

heap

page execute and read and write

1B7A0000

heap

page read and write

126B000

heap

page read and write

7FF848C9D000

trusted library allocation

page execute and read and write

1B59A000

heap

page read and write

7FF848DF0000

trusted library allocation

page read and write

895FA79000

stack

page read and write

2FA0000

heap

page execute and read and write

3086000

trusted library allocation

page read and write

7FF848EC0000

trusted library allocation

page read and write

1407000

heap

page read and write

13211000

trusted library allocation

page read and write

7FF848E15000

trusted library allocation

page read and write

1070000

heap

page read and write

1B259000

stack

page read and write

7FF848E93000

trusted library allocation

page read and write

7FF848C54000

trusted library allocation

page read and write

7FF848C83000

trusted library allocation

page read and write

124F000

heap

page read and write

7FF848E15000

trusted library allocation

page read and write

22DCCF38000

heap

page read and write

1BB9F000

stack

page read and write

7FF848E5B000

trusted library allocation

page read and write

7FF848C70000

trusted library allocation

page read and write

7FF848F70000

trusted library allocation

page read and write

1BC9E000

stack

page read and write

1BD50000

heap

page read and write

7FF848E89000

trusted library allocation

page read and write

7FF848E90000

trusted library allocation

page execute and read and write

1BA73000

heap

page read and write

22DCD175000

heap

page read and write

1307D000

trusted library allocation

page read and write

C20000

unkown

page readonly

2BC0000

heap

page execute and read and write

7FF848C63000

trusted library allocation

page read and write

7FF848C74000

trusted library allocation

page read and write

7FF848F30000

trusted library allocation

page read and write

7FF848D70000

trusted library allocation

page execute and read and write

D60000

heap

page read and write

1238000

heap

page read and write

1490000

trusted library allocation

page read and write

7FF848FB0000

trusted library allocation

page read and write

7FF848F80000

trusted library allocation

page read and write

336E000

trusted library allocation

page read and write

3020000

heap

page execute and read and write

7FF848E90000

trusted library allocation

page read and write

7FF4754C0000

trusted library allocation

page execute and read and write

7FF848E80000

trusted library allocation

page read and write

13D0000

heap

page read and write

7FF848E45000

trusted library allocation

page read and write

1BD9E000

stack

page read and write

7FF8490D0000

trusted library allocation

page read and write

2F60000

trusted library allocation

page read and write

27492E70000

heap

page read and write

7FF848C74000

trusted library allocation

page read and write

1880000

heap

page read and write

DAA000

heap

page read and write

FB1000

stack

page read and write

D8F000

heap

page read and write

3089000

trusted library allocation

page read and write

7FF848D56000

trusted library allocation

page execute and read and write

1B080000

trusted library allocation

page read and write

337A000

trusted library allocation

page read and write

12CD3000

trusted library allocation

page read and write

1190000

heap

page read and write

1550000

heap

page read and write

1230000

heap

page read and write

7FF849087000

trusted library allocation

page read and write

1BAE0000

heap

page read and write

1BF6E000

stack

page read and write

7FF848E70000

trusted library allocation

page read and write

2FF4000

trusted library allocation

page read and write

1B843000

heap

page read and write

7FF848E40000

trusted library allocation

page read and write

DAD000

heap

page read and write

16B5000

heap

page read and write

146B000

heap

page read and write

7FF848F60000

trusted library allocation

page read and write

16B0000

heap

page read and write

895FB7F000

stack

page read and write

7FF848C7D000

trusted library allocation

page execute and read and write

1500000

heap

page read and write

1258000

heap

page read and write

7FF848E6A000

trusted library allocation

page read and write

1400000

heap

page read and write

3092000

trusted library allocation

page read and write

13225000

trusted library allocation

page read and write

1B05E000

heap

page read and write

D78000

heap

page read and write

175E000

stack

page read and write

7FF848D26000

trusted library allocation

page read and write

D8B000

heap

page read and write

1885000

heap

page read and write

2FF6000

trusted library allocation

page read and write

7FF848E90000

trusted library allocation

page read and write

C20000

unkown

page readonly

13219000

trusted library allocation

page read and write

7FF848D30000

trusted library allocation

page execute and read and write

D70000

heap

page read and write

1420000

heap

page read and write

17C3000

heap

page read and write

22DCCE50000

heap

page read and write

7FF848D20000

trusted library allocation

page read and write

7FF848EB0000

trusted library allocation

page execute and read and write

F43000

unkown

page readonly

7FF848C76000

trusted library allocation

page read and write

7FF848C8D000

trusted library allocation

page execute and read and write

1520000

heap

page read and write

1255000

heap

page read and write

7FF848EA4000

trusted library allocation

page read and write

10E0000

trusted library allocation

page read and write

7FF848C50000

trusted library allocation

page read and write

7FF848C72000

trusted library allocation

page read and write

7FF848FD0000

trusted library allocation

page read and write

7FF848FA0000

trusted library allocation

page read and write

1AD00000

trusted library allocation

page read and write

7FF848E10000

trusted library allocation

page read and write

13069000

trusted library allocation

page read and write

7FF848C73000

trusted library allocation

page execute and read and write

1BB22000

heap

page read and write

1C24F000

stack

page read and write

7FF848D2C000

trusted library allocation

page execute and read and write

1298000

heap

page read and write

DD9000

heap

page read and write

7FF848E60000

trusted library allocation

page read and write

7FF848EA0000

trusted library allocation

page read and write

F65000

heap

page read and write

1BC50000

heap

page execute and read and write

7FF848E8F000

trusted library allocation

page read and write

1BA70000

heap

page read and write

14A0000

heap

page read and write

1B79A000

stack

page read and write

7FF848C94000

trusted library allocation

page read and write

7FF848C5D000

trusted library allocation

page execute and read and write

7FF848F00000

trusted library allocation

page read and write

12CD9000

trusted library allocation

page read and write

367B000

trusted library allocation

page read and write

312F000

stack

page read and write

7FF848CCC000

trusted library allocation

page execute and read and write

7FF848C94000

trusted library allocation

page read and write

7FF848E50000

trusted library allocation

page read and write

7FF848EF0000

trusted library allocation

page read and write

D9F000

heap

page read and write

7FF849070000

trusted library allocation

page read and write

142F000

heap

page read and write

12CDE000

trusted library allocation

page read and write

13213000

trusted library allocation

page read and write

12DA000

heap

page read and write

7FF8490B0000

trusted library allocation

page execute and read and write

7FF848EB0000

trusted library allocation

page execute and read and write

D97000

heap

page read and write

1470000

trusted library allocation

page read and write

7FF848CCC000

trusted library allocation

page execute and read and write

1B240000

trusted library allocation

page read and write

1C433000

stack

page read and write

7FF848CAC000

trusted library allocation

page execute and read and write

2CD1000

trusted library allocation

page read and write

13051000

trusted library allocation

page read and write

7FF849060000

trusted library allocation

page read and write

D9B000

heap

page read and write

7FF848E38000

trusted library allocation

page read and write

7FF848E58000

trusted library allocation

page read and write

7FF848F40000

trusted library allocation

page read and write

7FF848C6D000

trusted library allocation

page execute and read and write

7FF848C9D000

trusted library allocation

page execute and read and write

3538000

trusted library allocation

page read and write

12CD1000

trusted library allocation

page read and write

22DCCD70000

heap

page read and write

3040000

heap

page read and write

7FF848D30000

trusted library allocation

page execute and read and write

F40000

unkown

page readonly

2ACE000

stack

page read and write

7FF848EA0000

trusted library allocation

page read and write

7FF848C7B000

trusted library allocation

page execute and read and write

1C06E000

stack

page read and write

22DCD170000

heap

page read and write

1B962000

heap

page read and write

7FF848C90000

trusted library allocation

page read and write

1B5A4000

heap

page read and write

6DA597F000

stack

page read and write

7FF848D90000

trusted library allocation

page execute and read and write

7FF848D00000

trusted library allocation

page read and write

DD7000

heap

page read and write

14A5000

heap

page read and write

1441000

heap

page read and write

3060000

trusted library allocation

page read and write

27492D90000

heap

page read and write

7FF848D06000

trusted library allocation

page read and write

2FF0000

heap

page read and write

1555000

heap

page read and write

7FF848C53000

trusted library allocation

page execute and read and write

7FF848E41000

trusted library allocation

page read and write

7FF848F20000

trusted library allocation

page read and write

7FF848EA0000

trusted library allocation

page read and write

7FF848F10000

trusted library allocation

page read and write

7FF848EA4000

trusted library allocation

page read and write

7FF848C74000

trusted library allocation

page read and write

12CE5000

trusted library allocation

page read and write

7FF848C7D000

trusted library allocation

page execute and read and write

7FF848C52000

trusted library allocation

page read and write

1C14F000

stack

page read and write

FE0000

heap

page read and write

125C000

heap

page read and write

7FF848FC0000

trusted library allocation

page read and write

1B793000

heap

page read and write

165E000

stack

page read and write

27492F70000

heap

page read and write

27492F78000

heap

page read and write

7FF848EB0000

trusted library allocation

page read and write

1B930000

heap

page read and write

7FF8490A5000

trusted library allocation

page read and write

3200000

heap

page read and write

2F5F000

stack

page read and write

D13000

stack

page read and write

7FF849082000

trusted library allocation

page read and write

7FF848C73000

trusted library allocation

page execute and read and write

7FF8490A0000

trusted library allocation

page read and write

27492E90000

heap

page read and write

27493235000

heap

page read and write

1C04E000

stack

page read and write

1B790000

heap

page read and write

1BD0E000

heap

page read and write

7FF848ED0000

trusted library allocation

page read and write

1760000

trusted library allocation

page read and write

1B862000

heap

page read and write

7FF848C8D000

trusted library allocation

page execute and read and write

7FF848D56000

trusted library allocation

page execute and read and write

7FF848E65000

trusted library allocation

page read and write

3211000

trusted library allocation

page read and write

There are 299 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
OneDrive.exe

Files

Processes

URLs

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportOneDrive.exe

Files

Processes

URLs

IPs

Memdumps

IOC Report
OneDrive.exe