IOC Report
NewInst.exe

loading gif

Files

File Path
Type
Category
Malicious
NewInst.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NewInst.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_bc4a4c4fb437bcca3219060cc715fc13afa711_8c6fa16e_977c0c66-5e8a-41e9-a4c3-85b89f066d6a\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF87.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Aug 29 20:59:00 2024, 0x1205a4 type
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\NewInst.exe
"C:\Users\user\Desktop\NewInst.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 1764

URLs

Name
IP
Malicious
https://froytnewqowv.shop/api
188.114.97.3
 malicious
froytnewqowv.shop
malicious
stamppreewntnq.shop
malicious
condedqpwqm.shop
malicious
evoliutwoqm.shop
malicious
locatedblsoqp.shop
malicious
caffegclasiqwp.shop
malicious
millyscroqwp.shop
malicious
stagedchheiqwo.shop
malicious
traineiwnqo.shop
malicious
https://froytnewqowv.shop/
unknown
http://upx.sf.net
unknown
https://froytnewqowv.shop/apiv
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
froytnewqowv.shop
188.114.97.3
 malicious

IPs

IP
Domain
Country
Malicious
188.114.97.3
froytnewqowv.shop
European Union
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProgramId
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
FileId
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LowerCaseLongPath
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LongPathHash
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Name
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
OriginalFileName
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Publisher
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Version
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinFileVersion
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinaryType
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductName
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductVersion
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LinkDate
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinProductVersion
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageFullName
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageRelativeId
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Size
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Language
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
IsOsComponent
\REGISTRY\A\{316dee87-104a-d41a-6166-dc8897bb3410}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 12 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
241F000
stack
page read and write
7DD000
heap
page read and write
2F4F000
stack
page read and write
A00000
heap
page read and write
245E000
stack
page read and write
2290000
heap
page execute and read and write
5D0000
heap
page read and write
8FC000
stack
page read and write
74E000
stack
page read and write
605000
heap
page read and write
5F0000
heap
page read and write
A4D000
heap
page read and write
26DE000
stack
page read and write
21B0000
trusted library allocation
page execute and read and write
AAA000
heap
page read and write
27DE000
stack
page read and write
CC0000
heap
page read and write
14C000
stack
page read and write
AD4000
heap
page read and write
221E000
stack
page read and write
790000
trusted library allocation
page read and write
255D000
stack
page read and write
7BE000
heap
page read and write
453E000
stack
page read and write
600000
heap
page read and write
78E000
stack
page read and write
2B9D000
stack
page read and write
A5F000
heap
page read and write
A57000
heap
page read and write
A20000
heap
page read and write
2DDE000
stack
page read and write
9B0000
heap
page read and write
1F0000
heap
page read and write
57C000
stack
page read and write
23A1000
trusted library allocation
page read and write
2E4E000
stack
page read and write
AE1000
heap
page read and write
23A2000
trusted library allocation
page execute and read and write
21D0000
heap
page read and write
9D0000
heap
page read and write
A2A000
heap
page read and write
2C9E000
stack
page read and write
5C5000
heap
page read and write
7A4000
trusted library allocation
page read and write
72000
unkown
page readonly
21C0000
trusted library allocation
page read and write
218B000
trusted library allocation
page execute and read and write
1C0000
heap
page read and write
4FB000
stack
page read and write
225E000
stack
page read and write
269D000
stack
page read and write
33A2000
trusted library allocation
page read and write
449000
remote allocation
page execute and read and write
2CDE000
stack
page read and write
70000
unkown
page readonly
B8000
unkown
page readonly
A6D000
heap
page read and write
21A0000
trusted library allocation
page read and write
231E000
stack
page read and write
64E000
stack
page read and write
A79000
heap
page read and write
2180000
trusted library allocation
page read and write
7B8000
heap
page read and write
259D000
stack
page read and write
400000
remote allocation
page execute and read and write
239F000
stack
page read and write
9AF000
stack
page read and write
2164000
trusted library allocation
page read and write
7A3000
trusted library allocation
page execute and read and write
7B0000
heap
page read and write
33A5000
trusted library allocation
page read and write
7F4000
heap
page read and write
A45000
heap
page read and write
A70000
heap
page read and write
1B0000
heap
page read and write
2160000
trusted library allocation
page read and write
5C0000
heap
page read and write
2F50000
trusted library allocation
page read and write
There are 68 hidden memdumps, click here to show them.