IOC Report
rbx hack 2.6.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps321010010Label

Files

File Path
Type
Category
Malicious
Download
rbx hack 2.6.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rbx hack 2.6.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Local\Temp\rbx hack.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rbx hack 2.6.exe
"C:\Users\user\Desktop\rbx hack 2.6.exe"
 malicious
C:\Users\user\AppData\Local\Temp\rbx hack.exe
"C:\Users\user\AppData\Local\Temp\rbx hack.exe"
malicious

URLs

Name
IP
Malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown
https://pastebin.com/raw/???
unknown

Domains

Name
IP
Malicious
size-ingredients.gl.at.ply.gg
147.185.221.27
 malicious

IPs

IP
Domain
Country
Malicious
147.185.221.27
size-ingredients.gl.at.ply.gg
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious
HKEY_CURRENT_USER\SOFTWARE\a1cb840a8f8b330a9629751db128f43f
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
2E41000
trusted library allocation
page read and write
 malicious
692000
unkown
page readonly
 malicious
E50000
heap
page execute and read and write
7FF93668D000
trusted library allocation
page execute and read and write
4E60000
trusted library allocation
page execute and read and write
1540000
heap
page read and write
13BE000
stack
page read and write
DCB000
trusted library allocation
page execute and read and write
7A0000
heap
page read and write
C90000
trusted library allocation
page read and write
1BCEE000
stack
page read and write
7FF936800000
trusted library allocation
page read and write
7B0000
heap
page read and write
7FE000
stack
page read and write
4F1D000
stack
page read and write
1BBEE000
stack
page read and write
6A0000
unkown
page readonly
1C0EE000
stack
page read and write
7FF93667D000
trusted library allocation
page execute and read and write
4E5E000
stack
page read and write
1020000
heap
page read and write
10A0000
trusted library allocation
page read and write
DBA000
trusted library allocation
page execute and read and write
1BA16000
heap
page read and write
7FF936720000
trusted library allocation
page execute and read and write
12E41000
trusted library allocation
page read and write
B70000
unkown
page readonly
AF6000
stack
page read and write
2DEE000
stack
page read and write
AF9000
stack
page read and write
2E30000
heap
page read and write
1104000
heap
page read and write
10C0000
heap
page read and write
DAA000
trusted library allocation
page execute and read and write
1BDEE000
stack
page read and write
2CF6000
trusted library allocation
page read and write
1136000
heap
page read and write
7FF936746000
trusted library allocation
page execute and read and write
1520000
heap
page read and write
10C6000
heap
page read and write
B7E000
heap
page read and write
10EC000
heap
page read and write
73A000
stack
page read and write
4E70000
trusted library allocation
page read and write
7FF936674000
trusted library allocation
page read and write
BAE000
heap
page read and write
2C81000
trusted library allocation
page read and write
1132000
heap
page read and write
CA2000
trusted library allocation
page execute and read and write
CB0000
trusted library allocation
page read and write
7FF936710000
trusted library allocation
page read and write
4FE0000
trusted library allocation
page read and write
7FF936780000
trusted library allocation
page execute and read and write
F20000
heap
page read and write
12E48000
trusted library allocation
page read and write
1545000
heap
page read and write
2E20000
heap
page execute and read and write
CC5000
heap
page read and write
1B9FC000
heap
page read and write
7FF9366BC000
trusted library allocation
page execute and read and write
14BF000
stack
page read and write
DA7000
trusted library allocation
page execute and read and write
4FD9000
stack
page read and write
1BEEE000
stack
page read and write
B70000
unkown
page readonly
7FF936663000
trusted library allocation
page execute and read and write
12BE000
stack
page read and write
7FF936672000
trusted library allocation
page read and write
DC2000
trusted library allocation
page read and write
B60000
heap
page read and write
5070000
unclassified section
page read and write
4F5B000
stack
page read and write
B7A000
heap
page read and write
1B8E0000
heap
page execute and read and write
2D1A000
trusted library allocation
page read and write
E90000
heap
page read and write
1B9ED000
stack
page read and write
DC7000
trusted library allocation
page execute and read and write
7FF93671C000
trusted library allocation
page execute and read and write
DB2000
trusted library allocation
page execute and read and write
5060000
trusted library allocation
page execute and read and write
1040000
heap
page read and write
1BFEB000
stack
page read and write
4F9C000
stack
page read and write
E20000
heap
page read and write
1085000
heap
page read and write
1080000
heap
page read and write
CAA000
trusted library allocation
page execute and read and write
1102000
heap
page read and write
4D5E000
stack
page read and write
7FF4F6CC0000
trusted library allocation
page execute and read and write
2CD2000
trusted library allocation
page read and write
CC0000
heap
page read and write
F9F000
stack
page read and write
CB2000
trusted library allocation
page execute and read and write
B72000
unkown
page readonly
CBC000
trusted library allocation
page execute and read and write
1000000
heap
page read and write
1BA09000
heap
page read and write
10F6000
heap
page read and write
12E43000
trusted library allocation
page read and write
293F000
stack
page read and write
EF4000
stack
page read and write
1B9FA000
heap
page read and write
14C0000
trusted library allocation
page read and write
E0E000
stack
page read and write
1B9F0000
heap
page read and write
B70000
heap
page read and write
7FF936670000
trusted library allocation
page read and write
7FF936664000
trusted library allocation
page read and write
CBA000
trusted library allocation
page execute and read and write
1B3DD000
stack
page read and write
10CC000
heap
page read and write
E80000
trusted library allocation
page read and write
4C88000
trusted library allocation
page read and write
690000
unkown
page readonly
7FF936680000
trusted library allocation
page read and write
E30000
heap
page read and write
3C81000
trusted library allocation
page read and write
7FF93666D000
trusted library allocation
page execute and read and write
1194000
heap
page read and write
4FF0000
heap
page read and write
There are 112 hidden memdumps, click here to show them.