IOC Report
Taburetka client.exe

loading gifFilesProcessesURLsIPsRegistryMemdumps8642010010Label

Files

File Path
Type
Category
Malicious
Download
Taburetka client.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Taburetka client.exe.log
ASCII text, with CRLF line terminators
modified
 malicious
C:\Users\user\AppData\Local\Temp\spoolsv.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spoolsv.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6f0d393b28186b5f7e6994690a43f7b.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6f0d393b28186b5f7e6994690a43f7b.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\autorun.inf
Microsoft Windows Autorun file
modified
 malicious
C:\lox.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\lox.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\spoolsv.exe.log
ASCII text, with CRLF line terminators
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Taburetka client.exe
"C:\Users\user\Desktop\Taburetka client.exe"
 malicious
C:\Users\user\AppData\Local\Temp\spoolsv.exe
"C:\Users\user\AppData\Local\Temp\spoolsv.exe"
malicious
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\spoolsv.exe" "spoolsv.exe" ENABLE
 malicious
C:\Users\user\AppData\Local\Temp\spoolsv.exe
"C:\Users\user\AppData\Local\Temp\spoolsv.exe" ..
 malicious
C:\Users\user\AppData\Local\Temp\spoolsv.exe
"C:\Users\user\AppData\Local\Temp\spoolsv.exe" ..
 malicious
C:\Users\user\AppData\Local\Temp\spoolsv.exe
"C:\Users\user\AppData\Local\Temp\spoolsv.exe" ..
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://dl.dropbox.c#
unknown
http://go.microsoft.
unknown
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
unknown
http://go.microsoft.LinkId=42127
unknown

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e6f0d393b28186b5f7e6994690a43f7b
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
e6f0d393b28186b5f7e6994690a43f7b

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
8F2000
unkown
page readonly
 malicious
2781000
trusted library allocation
page read and write
 malicious
1400000
trusted library allocation
page read and write
D27000
trusted library allocation
page execute and read and write
A30000
trusted library allocation
page read and write
C21000
heap
page read and write
B10000
heap
page read and write
50EE000
stack
page read and write
597E000
stack
page read and write
C1E000
heap
page read and write
910000
heap
page read and write
39D1000
trusted library allocation
page read and write
2F71000
trusted library allocation
page read and write
513F000
stack
page read and write
C74000
heap
page read and write
5208000
heap
page read and write
C2E000
heap
page read and write
C29000
heap
page read and write
5ABF000
stack
page read and write
559F000
stack
page read and write
900000
heap
page execute and read and write
C40000
heap
page read and write
7DE000
heap
page read and write
1167000
trusted library allocation
page execute and read and write
3894000
trusted library allocation
page read and write
C24000
heap
page read and write
CD2000
trusted library allocation
page execute and read and write
D8E000
stack
page read and write
503F000
stack
page read and write
C30000
heap
page read and write
810000
heap
page read and write
C63000
heap
page read and write
2FA1000
trusted library allocation
page read and write
4B6E000
stack
page read and write
14A2000
trusted library allocation
page execute and read and write
DC5000
heap
page read and write
EA0000
heap
page read and write
12DF000
stack
page read and write
111F000
stack
page read and write
C23000
heap
page read and write
8D7000
heap
page read and write
C77000
heap
page read and write
C75000
heap
page read and write
FC0000
heap
page read and write
98B000
stack
page read and write
4D80000
heap
page read and write
C06000
heap
page read and write
C62000
heap
page read and write
34F4000
trusted library allocation
page read and write
C6D000
heap
page read and write
B5D000
unkown
page read and write
5AFE000
stack
page read and write
268E000
stack
page read and write
C20000
heap
page read and write
EFA000
trusted library allocation
page execute and read and write
CF6000
stack
page read and write
4D70000
heap
page read and write
14DB000
trusted library allocation
page execute and read and write
C80000
heap
page read and write
1130000
trusted library allocation
page read and write
C74000
heap
page read and write
C6D000
heap
page read and write
1056000
heap
page read and write
8FC000
unkown
page readonly
1A90000
heap
page execute and read and write
133E000
stack
page read and write
515E000
stack
page read and write
C6D000
heap
page read and write
1860000
heap
page read and write
2C1E000
trusted library allocation
page read and write
14F8000
heap
page read and write
11EE000
stack
page read and write
C2D000
heap
page read and write
A70000
trusted library allocation
page read and write
507E000
stack
page read and write
EDA000
trusted library allocation
page execute and read and write
8D3000
heap
page read and write
C63000
heap
page read and write
5204000
heap
page read and write
1410000
heap
page read and write
C7F000
heap
page read and write
C2B000
heap
page read and write
EF2000
trusted library allocation
page execute and read and write
4788000
trusted library allocation
page read and write
51FC000
heap
page read and write
B70000
trusted library allocation
page read and write
2AF8000
trusted library allocation
page read and write
C16000
heap
page read and write
2F74000
trusted library allocation
page read and write
BD0000
heap
page read and write
C7E000
heap
page read and write
C6D000
heap
page read and write
C42000
heap
page read and write
C62000
heap
page read and write
F27000
trusted library allocation
page execute and read and write
31AE000
stack
page read and write
51FB000
heap
page read and write
DCE000
unkown
page read and write
1460000
heap
page execute and read and write
534D000
stack
page read and write
A4A000
trusted library allocation
page execute and read and write
83C000
heap
page read and write
44F1000
trusted library allocation
page read and write
112A000
trusted library allocation
page execute and read and write
CE6000
trusted library allocation
page execute and read and write
51F1000
heap
page read and write
C73000
heap
page read and write
2F4E000
stack
page read and write
C22000
heap
page read and write
7D8000
heap
page read and write
243F000
stack
page read and write
C62000
heap
page read and write
520B000
heap
page read and write
4BA0000
trusted library allocation
page execute and read and write
51F7000
heap
page read and write
C67000
heap
page read and write
13C0000
heap
page read and write
4E70000
trusted library allocation
page read and write
C21000
heap
page read and write
C19000
heap
page read and write
C66000
heap
page read and write
1290000
trusted library allocation
page read and write
A6A000
trusted library allocation
page execute and read and write
5190000
heap
page read and write
14D0000
trusted library allocation
page read and write
EE0000
heap
page read and write
51D0000
heap
page read and write
51FD000
heap
page read and write
5BFF000
stack
page read and write
CC7000
heap
page read and write
1380000
heap
page execute and read and write
E5E000
stack
page read and write
7F0000
heap
page read and write
C7E000
heap
page read and write
DA0000
heap
page read and write
F1A000
trusted library allocation
page execute and read and write
C62000
heap
page read and write
12EE000
stack
page read and write
4BEC000
stack
page read and write
EF0000
trusted library allocation
page read and write
2BFF000
trusted library allocation
page read and write
C20000
heap
page read and write
776000
stack
page read and write
573F000
stack
page read and write
29D1000
trusted library allocation
page read and write
13DE000
stack
page read and write
BBD000
stack
page read and write
7E0000
heap
page read and write
DC0000
heap
page read and write
4C9E000
stack
page read and write
B00000
trusted library allocation
page read and write
4D6D000
stack
page read and write
9E0000
heap
page read and write
C62000
heap
page read and write
4C50000
heap
page read and write
4EDE000
stack
page read and write
51F1000
heap
page read and write
18A0000
heap
page read and write
14A0000
trusted library allocation
page read and write
A87000
trusted library allocation
page execute and read and write
ED2000
trusted library allocation
page execute and read and write
C3F000
heap
page read and write
516E000
stack
page read and write
92D000
heap
page read and write
C6D000
heap
page read and write
4B00000
heap
page read and write
A67000
trusted library allocation
page execute and read and write
B7F000
stack
page read and write
C63000
heap
page read and write
383F000
trusted library allocation
page read and write
CE0000
trusted library allocation
page read and write
113C000
trusted library allocation
page execute and read and write
C79000
heap
page read and write
4F3E000
stack
page read and write
A30000
heap
page read and write
B5E000
stack
page read and write
505E000
stack
page read and write
13A0000
trusted library allocation
page read and write
4BAB000
stack
page read and write
1160000
trusted library allocation
page read and write
A82000
trusted library allocation
page read and write
13F0000
trusted library allocation
page execute and read and write
C80000
heap
page read and write
4C6C000
stack
page read and write
CDA000
trusted library allocation
page execute and read and write
14C2000
trusted library allocation
page execute and read and write
E60000
heap
page read and write
520D000
heap
page read and write
C7F000
heap
page read and write
BAE000
stack
page read and write
9F0000
heap
page read and write
A42000
trusted library allocation
page execute and read and write
520B000
heap
page read and write
C09000
heap
page read and write
4D9E000
stack
page read and write
568E000
stack
page read and write
C19000
heap
page read and write
5207000
heap
page read and write
C7B000
heap
page read and write
16EF000
stack
page read and write
B90000
heap
page execute and read and write
C6C000
heap
page read and write
C63000
heap
page read and write
C84000
heap
page read and write
5690000
trusted library allocation
page read and write
D10000
heap
page read and write
A7A000
trusted library allocation
page execute and read and write
1132000
trusted library allocation
page execute and read and write
2C1C000
trusted library allocation
page read and write
ACE000
stack
page read and write
4C2D000
stack
page read and write
C1E000
heap
page read and write
14A6000
trusted library allocation
page execute and read and write
F6E000
stack
page read and write
8F0000
unkown
page readonly
C6F000
heap
page read and write
C20000
heap
page read and write
FD0000
heap
page read and write
501F000
stack
page read and write
F4B000
stack
page read and write
C78000
heap
page read and write
A4E000
stack
page read and write
C67000
heap
page read and write
C6C000
heap
page read and write
370000
heap
page read and write
E1E000
stack
page read and write
558E000
stack
page read and write
CC0000
trusted library allocation
page read and write
13E0000
trusted library allocation
page read and write
CC3000
heap
page read and write
80D000
heap
page read and write
BD7000
heap
page read and write
8D0000
heap
page read and write
C78000
heap
page read and write
5206000
heap
page read and write
59BE000
stack
page read and write
577E000
stack
page read and write
1300000
trusted library allocation
page read and write
12A0000
heap
page read and write
4780000
trusted library allocation
page read and write
29D4000
trusted library allocation
page read and write
1A80000
trusted library allocation
page execute and read and write
7CB000
stack
page read and write
F9E000
stack
page read and write
C2A000
heap
page read and write
C50000
heap
page read and write
11A0000
heap
page read and write
5203000
heap
page read and write
38E9000
trusted library allocation
page read and write
13C5000
heap
page read and write
9B6000
stack
page read and write
1880000
trusted library allocation
page read and write
517F000
stack
page read and write
51FC000
heap
page read and write
C46000
heap
page read and write
380000
heap
page read and write
1524000
heap
page read and write
3E5000
heap
page read and write
815000
heap
page read and write
C6A000
heap
page read and write
C7B000
heap
page read and write
3781000
trusted library allocation
page read and write
9D0000
heap
page read and write
BF0000
heap
page read and write
FF0000
heap
page read and write
DE0000
heap
page read and write
CCE000
heap
page read and write
CCE000
heap
page read and write
59BE000
stack
page read and write
7D0000
heap
page read and write
EFC000
trusted library allocation
page execute and read and write
C2E000
heap
page read and write
C19000
heap
page read and write
C22000
heap
page read and write
5C6E000
stack
page read and write
1A7E000
stack
page read and write
918000
heap
page read and write
587F000
stack
page read and write
12F0000
trusted library allocation
page execute and read and write
14F0000
heap
page read and write
67B000
stack
page read and write
116B000
trusted library allocation
page execute and read and write
C62000
heap
page read and write
B60000
trusted library allocation
page execute and read and write
2BFD000
trusted library allocation
page read and write
1640000
heap
page read and write
A20000
heap
page read and write
DC0000
heap
page read and write
4AC0000
heap
page read and write
5201000
heap
page read and write
1830000
heap
page read and write
C7F000
heap
page read and write
C80000
heap
page read and write
DBE000
stack
page read and write
1545000
heap
page read and write
A52000
trusted library allocation
page execute and read and write
C40000
heap
page read and write
FC0000
trusted library allocation
page read and write
37EA000
trusted library allocation
page read and write
5B6E000
stack
page read and write
FBE000
stack
page read and write
544E000
stack
page read and write
548E000
stack
page read and write
512E000
stack
page read and write
C77000
heap
page read and write
C46000
heap
page read and write
FB0000
heap
page read and write
C71000
heap
page read and write
CE2000
trusted library allocation
page execute and read and write
D2B000
trusted library allocation
page execute and read and write
13BA000
trusted library allocation
page execute and read and write
7CE000
stack
page read and write
C64000
heap
page read and write
C69000
heap
page read and write
5203000
heap
page read and write
C6F000
heap
page read and write
A72000
trusted library allocation
page execute and read and write
14AC000
trusted library allocation
page execute and read and write
150D000
heap
page read and write
C75000
heap
page read and write
A50000
trusted library allocation
page read and write
C3F000
heap
page read and write
587E000
stack
page read and write
1136000
trusted library allocation
page execute and read and write
C62000
heap
page read and write
3146000
heap
page read and write
C2B000
heap
page read and write
1430000
trusted library allocation
page read and write
3FA1000
trusted library allocation
page read and write
6CB000
stack
page read and write
EC0000
trusted library allocation
page read and write
A40000
heap
page read and write
C2E000
heap
page read and write
D6E000
stack
page read and write
C6F000
heap
page read and write
583E000
stack
page read and write
137E000
stack
page read and write
1122000
trusted library allocation
page execute and read and write
4F1E000
stack
page read and write
4B90000
trusted library allocation
page read and write
C21000
heap
page read and write
CBE000
heap
page read and write
50AD000
stack
page read and write
14D7000
trusted library allocation
page execute and read and write
C64000
heap
page read and write
C19000
heap
page read and write
C86000
heap
page read and write
C80000
heap
page read and write
A5A000
trusted library allocation
page execute and read and write
C46000
heap
page read and write
C23000
heap
page read and write
B60000
heap
page read and write
3F71000
trusted library allocation
page read and write
7BE000
stack
page read and write
30A000
stack
page read and write
C1C000
heap
page read and write
C71000
heap
page read and write
1020000
heap
page read and write
8BB000
stack
page read and write
4AF0000
trusted library allocation
page execute and read and write
51FC000
heap
page read and write
E10000
heap
page read and write
13B2000
trusted library allocation
page execute and read and write
4970000
heap
page read and write
A7C000
trusted library allocation
page execute and read and write
34F1000
trusted library allocation
page read and write
CC4000
heap
page read and write
CC7000
heap
page read and write
C23000
heap
page read and write
39D4000
trusted library allocation
page read and write
C2C000
heap
page read and write
A8B000
trusted library allocation
page execute and read and write
3E0000
heap
page read and write
3140000
heap
page read and write
C21000
heap
page read and write
1006000
heap
page read and write
37DC000
trusted library allocation
page read and write
4AED000
stack
page read and write
D02000
trusted library allocation
page execute and read and write
906000
heap
page read and write
C46000
heap
page read and write
4930000
heap
page read and write
506F000
stack
page read and write
FEE000
heap
page read and write
563E000
stack
page read and write
DD0000
heap
page read and write
C63000
heap
page read and write
C3F000
heap
page read and write
C24000
heap
page read and write
4DDE000
stack
page read and write
17EF000
stack
page read and write
2C0D000
trusted library allocation
page read and write
CEC000
trusted library allocation
page execute and read and write
97B000
heap
page read and write
C58000
heap
page read and write
7C4000
stack
page read and write
491F000
stack
page read and write
51F2000
heap
page read and write
2C2E000
stack
page read and write
BB0000
heap
page read and write
F12000
trusted library allocation
page execute and read and write
1890000
heap
page read and write
A35000
heap
page read and write
44F4000
trusted library allocation
page read and write
CCA000
heap
page read and write
F2B000
trusted library allocation
page execute and read and write
2C1A000
trusted library allocation
page read and write
539E000
stack
page read and write
12F6000
stack
page read and write
59FB000
stack
page read and write
58BE000
stack
page read and write
C7B000
heap
page read and write
6F6000
stack
page read and write
51FD000
heap
page read and write
4BB0000
trusted library allocation
page read and write
FE0000
heap
page read and write
944000
heap
page read and write
11DE000
stack
page read and write
182E000
stack
page read and write
A70000
heap
page read and write
5AFC000
stack
page read and write
1152000
trusted library allocation
page execute and read and write
573D000
stack
page read and write
CCB000
heap
page read and write
C19000
heap
page read and write
4E80000
unclassified section
page read and write
C7C000
heap
page read and write
CC5000
heap
page read and write
549F000
stack
page read and write
2AC7000
trusted library allocation
page read and write
101E000
stack
page read and write
CBE000
stack
page read and write
3F74000
trusted library allocation
page read and write
529E000
stack
page read and write
C6F000
heap
page read and write
FEA000
heap
page read and write
C75000
heap
page read and write
There are 427 hidden memdumps, click here to show them.