IOC Report
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

FilesProcessesURLsDomainsIPsRegistryMemdumps4321010010Label

Files

File Path
Type
Category
Malicious
Download
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
"C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe"
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" "#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" ENABLE
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
unknown

Domains

Name
IP
Malicious
2.tcp.eu.ngrok.io
18.156.13.209
 malicious

IPs

IP
Domain
Country
Malicious
18.156.13.209
2.tcp.eu.ngrok.io
United States
malicious
3.127.138.57
unknown
United States
malicious
18.157.68.73
unknown
United States
malicious
18.197.239.5
unknown
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
482000
unkown
page readonly
 malicious
4DAC000
stack
page read and write
48C000
unkown
page readonly
9D9000
heap
page read and write
BFE000
heap
page read and write
A60000
trusted library allocation
page read and write
4F8E000
stack
page read and write
4950000
heap
page read and write
52A0000
heap
page read and write
4D00000
unclassified section
page read and write
BEE000
stack
page read and write
E2E000
stack
page read and write
A97000
trusted library allocation
page execute and read and write
580000
heap
page read and write
2AFC000
trusted library allocation
page read and write
9D8000
heap
page read and write
A82000
trusted library allocation
page execute and read and write
4E8E000
stack
page read and write
9B5000
heap
page read and write
93B000
stack
page read and write
C8C000
heap
page read and write
F80000
trusted library allocation
page execute and read and write
C2E000
heap
page read and write
A50000
heap
page execute and read and write
92E000
stack
page read and write
CF6000
heap
page read and write
9E4000
heap
page read and write
52C0000
heap
page read and write
A7A000
trusted library allocation
page execute and read and write
C98000
heap
page read and write
480000
unkown
page readonly
C61000
heap
page read and write
CAC000
heap
page read and write
480E000
stack
page read and write
4D23000
heap
page read and write
9C0000
heap
page read and write
F50000
heap
page read and write
F60000
trusted library allocation
page read and write
50DF000
stack
page read and write
F2E000
stack
page read and write
CCE000
unkown
page read and write
AE0000
heap
page read and write
46EE000
stack
page read and write
4B5C000
stack
page read and write
3A81000
trusted library allocation
page read and write
A92000
trusted library allocation
page read and write
4E9F000
stack
page read and write
A37000
trusted library allocation
page read and write
52B0000
heap
page read and write
4C5E000
stack
page read and write
CAA000
heap
page read and write
A8A000
trusted library allocation
page execute and read and write
5DE000
stack
page read and write
A9B000
trusted library allocation
page execute and read and write
A77000
trusted library allocation
page execute and read and write
CD0000
heap
page read and write
83B000
stack
page read and write
5220000
trusted library allocation
page execute and read and write
935000
stack
page read and write
9A0000
heap
page read and write
A30000
trusted library allocation
page read and write
4EA0000
heap
page read and write
4DE9000
stack
page read and write
9AA000
heap
page read and write
D00000
heap
page read and write
BFA000
heap
page read and write
9B2000
heap
page read and write
A42000
trusted library allocation
page execute and read and write
93F000
stack
page read and write
CF0000
heap
page read and write
AB0000
heap
page read and write
BF0000
heap
page read and write
4830000
heap
page read and write
AA0000
heap
page read and write
2AD8000
trusted library allocation
page read and write
4FDE000
stack
page read and write
A4A000
trusted library allocation
page execute and read and write
AA0000
heap
page read and write
A6A000
trusted library allocation
page execute and read and write
F90000
heap
page read and write
4CEC000
stack
page read and write
51A000
stack
page read and write
F96000
heap
page read and write
4D6B000
stack
page read and write
4CF0000
trusted library allocation
page read and write
8F6000
stack
page read and write
F40000
trusted library allocation
page execute and read and write
4A88000
trusted library allocation
page read and write
7F410000
trusted library allocation
page execute and read and write
AA5000
heap
page read and write
590000
heap
page read and write
C9D000
heap
page read and write
4D20000
heap
page read and write
9C1000
heap
page read and write
F30000
trusted library allocation
page read and write
9C0000
heap
page read and write
BCD000
unkown
page read and write
2A81000
trusted library allocation
page read and write
DFD000
stack
page read and write
A62000
trusted library allocation
page execute and read and write
E10000
heap
page read and write
There are 91 hidden memdumps, click here to show them.