IOC Report
RFQ STS3780082024.exe

loading gif

Files

File Path
Type
Category
Malicious
RFQ STS3780082024.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ STS3780082024.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ukbocuc.xhg.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aj4revyi.lf2.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdoz4beh.t1g.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vplyho4s.lei.ps1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\RFQ STS3780082024.exe
"C:\Users\user\Desktop\RFQ STS3780082024.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ STS3780082024.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://tempuri.org/tt.xsd;VP_Lab_6.Properties.Resources
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 17 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.210.172
fp2e7a.wpc.phicdn.net
192.229.221.95

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
CB0000
direct allocation
page read and write
 malicious
27D3000
heap
page read and write
27D0000
heap
page read and write
135E000
direct allocation
page execute and read and write
9F5000
heap
page read and write
72BE000
stack
page read and write
4D75000
trusted library allocation
page read and write
6950000
trusted library allocation
page read and write
9FDD000
stack
page read and write
4D70000
trusted library allocation
page read and write
3855000
trusted library allocation
page read and write
28CB000
trusted library allocation
page read and write
9A0000
heap
page read and write
83A000
stack
page read and write
27C0000
trusted library allocation
page read and write
9B9E000
stack
page read and write
74E3000
heap
page read and write
E8B000
trusted library allocation
page execute and read and write
990000
heap
page read and write
4D40000
trusted library allocation
page read and write
E60000
trusted library allocation
page read and write
4D31000
trusted library allocation
page read and write
6D50000
heap
page read and write
CCE000
stack
page read and write
A26E000
stack
page read and write
727E000
stack
page read and write
A92000
heap
page read and write
6F30000
trusted library allocation
page execute and read and write
A36F000
stack
page read and write
518E000
stack
page read and write
148D000
direct allocation
page execute and read and write
E60000
heap
page read and write
6940000
trusted library allocation
page read and write
51F0000
heap
page read and write
51B0000
heap
page read and write
F00000
heap
page read and write
4DF0000
trusted library allocation
page execute and read and write
1486000
direct allocation
page execute and read and write
282A000
trusted library allocation
page read and write
27AE000
stack
page read and write
707E000
stack
page read and write
74CF000
heap
page read and write
E4E000
stack
page read and write
4D42000
trusted library allocation
page read and write
9C9F000
stack
page read and write
EEE000
stack
page read and write
E5D000
trusted library allocation
page execute and read and write
CF0000
trusted library allocation
page read and write
4F60000
trusted library allocation
page execute and read and write
E54000
trusted library allocation
page read and write
6972000
trusted library allocation
page read and write
4D10000
trusted library allocation
page read and write
D68000
heap
page read and write
B8E000
stack
page read and write
37F1000
trusted library allocation
page read and write
3897000
trusted library allocation
page read and write
9C0000
heap
page read and write
4EB0000
trusted library allocation
page read and write
74A0000
heap
page read and write
A60C000
stack
page read and write
6F20000
trusted library allocation
page read and write
E50000
trusted library allocation
page read and write
4D36000
trusted library allocation
page read and write
D60000
heap
page read and write
74C6000
heap
page read and write
4D2E000
trusted library allocation
page read and write
769E000
stack
page read and write
EA0000
trusted library allocation
page read and write
115F000
stack
page read and write
A74E000
stack
page read and write
9D9E000
stack
page read and write
48CB000
stack
page read and write
E53000
trusted library allocation
page execute and read and write
51A0000
heap
page read and write
11C0000
direct allocation
page execute and read and write
5190000
heap
page read and write
4F50000
heap
page read and write
4EF0000
heap
page read and write
4F70000
trusted library allocation
page read and write
6F1B000
trusted library allocation
page read and write
F07000
heap
page read and write
9FF000
heap
page read and write
A22E000
stack
page read and write
6931000
trusted library allocation
page read and write
4D60000
trusted library allocation
page read and write
7F770000
trusted library allocation
page execute and read and write
A64E000
stack
page read and write
1508000
direct allocation
page execute and read and write
B4E000
stack
page read and write
E7A000
trusted library allocation
page execute and read and write
4DA0000
trusted library allocation
page read and write
6E80000
trusted library section
page read and write
4C2000
unkown
page readonly
9EA0000
heap
page read and write
72FE000
stack
page read and write
1471000
direct allocation
page execute and read and write
4EE0000
trusted library section
page readonly
4C0000
unkown
page readonly
E72000
trusted library allocation
page read and write
16E0000
heap
page read and write
9E9D000
stack
page read and write
27B0000
trusted library allocation
page execute and read and write
4F4B000
stack
page read and write
4F05000
heap
page read and write
BD0000
heap
page read and write
B90000
heap
page read and write
4F00000
heap
page read and write
AFD000
stack
page read and write
47F8000
trusted library allocation
page read and write
7230000
trusted library allocation
page read and write
74DF000
heap
page read and write
A64000
heap
page read and write
B00000
heap
page read and write
52A0000
trusted library section
page read and write
E6D000
trusted library allocation
page execute and read and write
D00000
heap
page read and write
105F000
stack
page read and write
E70000
trusted library allocation
page read and write
51F4000
heap
page read and write
9CE000
heap
page read and write
BCE000
stack
page read and write
4D14000
trusted library allocation
page read and write
27F1000
trusted library allocation
page read and write
4E02000
trusted library allocation
page read and write
37F9000
trusted library allocation
page read and write
A50B000
stack
page read and write
4D1B000
trusted library allocation
page read and write
937000
stack
page read and write
9C8000
heap
page read and write
49CD000
stack
page read and write
EF0000
heap
page read and write
12ED000
direct allocation
page execute and read and write
E82000
trusted library allocation
page read and write
E87000
trusted library allocation
page execute and read and write
6F7E000
stack
page read and write
A6F000
heap
page read and write
4DE0000
heap
page read and write
733E000
stack
page read and write
4F90000
heap
page execute and read and write
A0DF000
stack
page read and write
4D50000
trusted library allocation
page read and write
79D000
stack
page read and write
4D80000
trusted library allocation
page read and write
4D3D000
trusted library allocation
page read and write
12E9000
direct allocation
page execute and read and write
A12D000
stack
page read and write
692E000
stack
page read and write
A02000
heap
page read and write
27E0000
heap
page execute and read and write
51DE000
heap
page read and write
6F10000
trusted library allocation
page read and write
980000
heap
page read and write
D4E000
stack
page read and write
4E00000
trusted library allocation
page read and write
E76000
trusted library allocation
page execute and read and write
There are 146 hidden memdumps, click here to show them.