IOC Report
Rr6TGP9rEq.exe

loading gif

Files

File Path
Type
Category
Malicious
Rr6TGP9rEq.exe
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
initial sample
 malicious
C:\Users\user\XPCwyNRACAjFfEg.pdf
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\bgEoRLupllWTRAp.pdf
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Rr6TGP9rEq.exe
"C:\Users\user\Desktop\Rr6TGP9rEq.exe"
 malicious
C:\Program Files (x86)\AutoIt3\Au3Check.exe
"C:\Program Files (x86)\autoit3\Au3Check.exe"
 malicious

URLs

Name
IP
Malicious
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
http://www.winimage.com/zLibDll
unknown
https://t.me/RiseProSUPPORT
unknown
https://ipinfo.io/
unknown
https://www.autoitscript.com/autoit3/
unknown
https://www.maxmind.com/en/locate-my-ip-address
unknown

IPs

IP
Domain
Country
Malicious
193.233.132.67
unknown
Russian Federation

Memdumps

Base Address
Regiontype
Protect
Malicious
C0004F2000
direct allocation
page read and write
 malicious
510000
remote allocation
page execute and read and write
 malicious
C000800000
direct allocation
page read and write
 malicious
22DEE0C0000
direct allocation
page read and write
 malicious
22DEDF70000
direct allocation
page read and write
 malicious
7FF68228C000
unkown
page readonly
C000743000
direct allocation
page read and write
22DE89D0000
heap
page read and write
C000106000
direct allocation
page read and write
C00011A000
direct allocation
page read and write
C00004C000
direct allocation
page read and write
22DE8AF0000
heap
page read and write
22DEE257000
direct allocation
page read and write
C000010000
direct allocation
page read and write
94E000
stack
page read and write
22DE8B35000
heap
page read and write
7FF682121000
unkown
page execute read
7FF68228C000
unkown
page readonly
7FF68264A000
unkown
page readonly
9E8000
heap
page read and write
22DE88F0000
heap
page read and write
7FF68263D000
unkown
page read and write
C000166000
direct allocation
page read and write
C00016B000
direct allocation
page read and write
7FF68228A000
unkown
page read and write
C00003C000
direct allocation
page read and write
C000041000
direct allocation
page read and write
C000025000
direct allocation
page read and write
C000164000
direct allocation
page read and write
7FF6824FD000
unkown
page readonly
C000029000
direct allocation
page read and write
C00074A000
direct allocation
page read and write
7E0000
heap
page read and write
C00001A000
direct allocation
page read and write
C000030000
direct allocation
page read and write
C000796000
direct allocation
page read and write
C00078A000
direct allocation
page read and write
C000108000
direct allocation
page read and write
4F4F5FC000
stack
page read and write
C000076000
direct allocation
page read and write
7FF6825EA000
unkown
page read and write
C0000BA000
direct allocation
page read and write
C000012000
direct allocation
page read and write
805000
heap
page read and write
22DEDE1B000
direct allocation
page read and write
C000054000
direct allocation
page read and write
24F0000
heap
page read and write
7FF6824E3000
unkown
page readonly
C00016D000
direct allocation
page read and write
C000110000
direct allocation
page read and write
C000016000
direct allocation
page read and write
22DEDCA0000
direct allocation
page read and write
C000002000
direct allocation
page read and write
C00000A000
direct allocation
page read and write
7FF682288000
unkown
page read and write
C000116000
direct allocation
page read and write
22DEE0A8000
direct allocation
page read and write
22DEDCB0000
direct allocation
page read and write
22DEDF50000
direct allocation
page read and write
C000793000
direct allocation
page read and write
C00001C000
direct allocation
page read and write
C000058000
direct allocation
page read and write
7FF682264000
unkown
page read and write
C000787000
direct allocation
page read and write
C000000000
direct allocation
page read and write
C000020000
direct allocation
page read and write
9E8000
heap
page read and write
7FF68264A000
unkown
page readonly
7FF682645000
unkown
page write copy
22DE8AD0000
heap
page read and write
9E0000
heap
page read and write
22DE8B30000
heap
page read and write
22DE89D8000
heap
page read and write
22DEDE1E000
direct allocation
page read and write
4F4F7FE000
stack
page read and write
9D3000
heap
page read and write
740000
heap
page read and write
C000747000
direct allocation
page read and write
C00005A000
direct allocation
page read and write
22DEDE60000
direct allocation
page read and write
C000047000
direct allocation
page read and write
970000
heap
page read and write
22DE8B20000
direct allocation
page read and write
C000035000
direct allocation
page read and write
7FF682120000
unkown
page readonly
C00078C000
direct allocation
page read and write
22DE8B49000
direct allocation
page read and write
C00004E000
direct allocation
page read and write
7FF682264000
unkown
page write copy
C000027000
direct allocation
page read and write
C000084000
direct allocation
page read and write
7FF682616000
unkown
page read and write
C000088000
direct allocation
page read and write
22DEDE10000
direct allocation
page read and write
C000240000
direct allocation
page read and write
C000004000
direct allocation
page read and write
22DEE150000
direct allocation
page read and write
22DE8B40000
direct allocation
page read and write
C000162000
direct allocation
page read and write
7FF682268000
unkown
page read and write
7FF6824E3000
unkown
page readonly
C000006000
direct allocation
page read and write
7FF682120000
unkown
page readonly
7FF682285000
unkown
page write copy
C000074000
direct allocation
page read and write
C00000C000
direct allocation
page read and write
979000
heap
page read and write
4F4FFFE000
stack
page read and write
C00007C000
direct allocation
page read and write
7FF68260F000
unkown
page read and write
7FF682289000
unkown
page write copy
22DEDE71000
direct allocation
page read and write
7FF6824FD000
unkown
page readonly
4F4FBFE000
stack
page read and write
7FF68226A000
unkown
page write copy
C000100000
direct allocation
page read and write
97E000
heap
page read and write
C000014000
direct allocation
page read and write
C000045000
direct allocation
page read and write
4F4F9FE000
stack
page read and write
C000160000
direct allocation
page read and write
22DEDCA4000
direct allocation
page read and write
240E000
stack
page read and write
7FF682644000
unkown
page write copy
C000022000
direct allocation
page read and write
660000
heap
page read and write
7FF682644000
unkown
page read and write
22DEE110000
direct allocation
page read and write
9DD000
heap
page read and write
C000008000
direct allocation
page read and write
C000037000
direct allocation
page read and write
7FF682279000
unkown
page read and write
9C000
stack
page read and write
7FF682648000
unkown
page write copy
C00006E000
direct allocation
page read and write
22DEDF60000
direct allocation
page read and write
19D000
stack
page read and write
4F4FDFE000
stack
page read and write
22DEDDD1000
direct allocation
page read and write
C00006A000
direct allocation
page read and write
C000068000
direct allocation
page read and write
C000400000
direct allocation
page read and write
22DEDEB0000
direct allocation
page read and write
7FF682266000
unkown
page write copy
C00011C000
direct allocation
page read and write
C00001E000
direct allocation
page read and write
4F501FF000
stack
page read and write
22DE8B44000
direct allocation
page read and write
4F503FF000
stack
page read and write
7FF682648000
unkown
page write copy
800000
heap
page read and write
7FF682121000
unkown
page execute read
There are 142 hidden memdumps, click here to show them.