IOC Report
Server.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps21010010Label

Files

File Path
Type
Category
Malicious
Download
Server.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Server.exe
"C:\Users\user\Desktop\Server.exe"
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
unknown

Domains

Name
IP
Malicious
dedekond33.zapto.org
196.128.8.158
 malicious

IPs

IP
Domain
Country
Malicious
196.128.8.158
dedekond33.zapto.org
Egypt
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
502000
unkown
page readonly
 malicious
E4B000
trusted library allocation
page execute and read and write
8F3000
stack
page read and write
D53000
heap
page read and write
D07000
heap
page read and write
4EE9000
heap
page read and write
BE0000
heap
page read and write
8FB000
stack
page read and write
4F1B000
stack
page read and write
4D1E000
stack
page read and write
ACE000
unkown
page read and write
CB0000
heap
page read and write
D1E000
heap
page read and write
CD0000
heap
page read and write
E32000
trusted library allocation
page execute and read and write
D1B000
heap
page read and write
D4D000
heap
page read and write
2C94000
trusted library allocation
page read and write
D3E000
heap
page read and write
8EE000
stack
page read and write
5FD000
stack
page read and write
500000
unkown
page readonly
D56000
heap
page read and write
2C43000
trusted library allocation
page read and write
D53000
heap
page read and write
D4A000
heap
page read and write
4E1E000
stack
page read and write
CFF000
heap
page read and write
D55000
heap
page read and write
CF9000
heap
page read and write
4EF4000
heap
page read and write
D4A000
heap
page read and write
CF5000
heap
page read and write
D4A000
heap
page read and write
D4F000
heap
page read and write
D52000
heap
page read and write
C40000
heap
page read and write
BDE000
stack
page read and write
D55000
heap
page read and write
CFC000
heap
page read and write
DA7000
heap
page read and write
D49000
heap
page read and write
CF9000
heap
page read and write
4EEB000
heap
page read and write
D9F000
heap
page read and write
1210000
heap
page read and write
570000
heap
page read and write
D5D000
heap
page read and write
D08000
heap
page read and write
E12000
trusted library allocation
page execute and read and write
E8E000
stack
page read and write
11F0000
heap
page read and write
D25000
heap
page read and write
2C86000
trusted library allocation
page read and write
D46000
heap
page read and write
DA0000
heap
page read and write
DA4000
heap
page read and write
8FE000
stack
page read and write
5000000
trusted library allocation
page execute and read and write
D01000
heap
page read and write
C60000
heap
page read and write
910000
heap
page read and write
D05000
heap
page read and write
4F99000
stack
page read and write
D4E000
heap
page read and write
D4A000
heap
page read and write
D4D000
heap
page read and write
D3E000
heap
page read and write
DA9000
heap
page read and write
4EEC000
heap
page read and write
CF5000
heap
page read and write
5D0000
heap
page read and write
CFB000
heap
page read and write
AD5000
heap
page read and write
CF0000
heap
page read and write
D3E000
heap
page read and write
AD0000
heap
page read and write
4E90000
heap
page read and write
D5C000
heap
page read and write
E47000
trusted library allocation
page execute and read and write
5BE000
unkown
page read and write
4E80000
trusted library allocation
page read and write
D50000
heap
page read and write
D07000
heap
page read and write
D07000
heap
page read and write
D59000
heap
page read and write
ED0000
heap
page execute and read and write
D52000
heap
page read and write
101E000
stack
page read and write
DA1000
heap
page read and write
D3E000
heap
page read and write
D53000
heap
page read and write
4EE7000
heap
page read and write
94E000
heap
page read and write
BB0000
heap
page read and write
8F9000
stack
page read and write
D40000
heap
page read and write
1050000
heap
page read and write
D53000
heap
page read and write
DA5000
heap
page read and write
D1C000
heap
page read and write
1030000
trusted library allocation
page execute and read and write
4D70000
heap
page read and write
CD0000
heap
page read and write
CE5000
heap
page read and write
CC1000
heap
page read and write
DA8000
heap
page read and write
4EC0000
heap
page read and write
2D00000
trusted library allocation
page read and write
4F5C000
stack
page read and write
D05000
heap
page read and write
D41000
heap
page read and write
D44000
heap
page read and write
D4A000
heap
page read and write
BF0000
heap
page read and write
D4F000
heap
page read and write
E27000
trusted library allocation
page execute and read and write
59A000
stack
page read and write
D09000
heap
page read and write
D59000
heap
page read and write
97F000
heap
page read and write
4EEA000
heap
page read and write
D51000
heap
page read and write
4EF6000
heap
page read and write
D3F000
heap
page read and write
E10000
trusted library allocation
page read and write
D09000
heap
page read and write
50B000
stack
page read and write
D5A000
heap
page read and write
D5D000
heap
page read and write
5D5000
heap
page read and write
E02000
trusted library allocation
page execute and read and write
D25000
heap
page read and write
D25000
heap
page read and write
DF0000
trusted library allocation
page read and write
4EDD000
stack
page read and write
CEF000
heap
page read and write
DA3000
heap
page read and write
DF3000
trusted library allocation
page read and write
1040000
trusted library allocation
page read and write
D05000
heap
page read and write
DA5000
heap
page read and write
D5A000
heap
page read and write
4EF0000
heap
page read and write
4EEB000
heap
page read and write
D5D000
heap
page read and write
D09000
heap
page read and write
D4A000
heap
page read and write
D3E000
heap
page read and write
D3E000
heap
page read and write
D4A000
heap
page read and write
DA4000
heap
page read and write
DAB000
heap
page read and write
4D6F000
stack
page read and write
4EF7000
heap
page read and write
D1B000
heap
page read and write
D5A000
heap
page read and write
8F6000
stack
page read and write
D09000
heap
page read and write
4EEC000
heap
page read and write
DC0000
heap
page read and write
4C6E000
stack
page read and write
D4A000
heap
page read and write
E0A000
trusted library allocation
page execute and read and write
4EEB000
heap
page read and write
DA9000
heap
page read and write
CFF000
heap
page read and write
E3A000
trusted library allocation
page execute and read and write
D3E000
heap
page read and write
CBB000
heap
page read and write
D4D000
heap
page read and write
D59000
heap
page read and write
920000
heap
page read and write
4EE1000
heap
page read and write
2C41000
trusted library allocation
page read and write
D59000
heap
page read and write
4C48000
trusted library allocation
page read and write
D4E000
heap
page read and write
D3E000
heap
page read and write
E2A000
trusted library allocation
page execute and read and write
50C000
unkown
page readonly
4EF4000
heap
page read and write
4EE1000
heap
page read and write
3C41000
trusted library allocation
page read and write
2CDC000
trusted library allocation
page read and write
DAE000
heap
page read and write
D1B000
heap
page read and write
948000
heap
page read and write
4EE7000
heap
page read and write
DA8000
heap
page read and write
CC4000
heap
page read and write
C46000
heap
page read and write
1020000
trusted library allocation
page read and write
D05000
heap
page read and write
4EEB000
heap
page read and write
5010000
unclassified section
page read and write
CFA000
heap
page read and write
D3F000
heap
page read and write
D5D000
heap
page read and write
940000
heap
page read and write
E1A000
trusted library allocation
page execute and read and write
4EE2000
heap
page read and write
CD0000
heap
page read and write
D1B000
heap
page read and write
D4A000
heap
page read and write
D3E000
heap
page read and write
D1B000
heap
page read and write
D4A000
heap
page read and write
D4A000
heap
page read and write
CE8000
heap
page read and write
D51000
heap
page read and write
F10000
heap
page read and write
D80000
heap
page read and write
2CB8000
trusted library allocation
page read and write
D06000
heap
page read and write
E42000
trusted library allocation
page read and write
D4A000
heap
page read and write
DA9000
heap
page read and write
D9F000
heap
page read and write
D25000
heap
page read and write
D3E000
heap
page read and write
D41000
heap
page read and write
D52000
heap
page read and write
CFB000
heap
page read and write
4EF5000
heap
page read and write
CE8000
heap
page read and write
D3F000
heap
page read and write
4EE3000
heap
page read and write
D02000
heap
page read and write
CE4000
heap
page read and write
D25000
heap
page read and write
CF5000
heap
page read and write
E1C000
trusted library allocation
page execute and read and write
There are 223 hidden memdumps, click here to show them.