IOC Report
Loader.exe

loading gif

Files

File Path
Type
Category
Malicious
Loader.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Loader.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_5c39e2f0624fb3ace2547e2d794ca76a89c913_e446d4ea_0d59fd07-587a-4f33-8e7e-2f122e6be1a3\Report.wer
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F48.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Aug 29 21:43:01 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3062.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3083.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Loader.exe
"C:\Users\user\Desktop\Loader.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1768

URLs

Name
IP
Malicious
https://froytnewqowv.shop/api
188.114.97.3
 malicious
froytnewqowv.shop
malicious
stamppreewntnq.shop
malicious
condedqpwqm.shop
malicious
evoliutwoqm.shop
malicious
locatedblsoqp.shop
malicious
caffegclasiqwp.shop
malicious
millyscroqwp.shop
malicious
stagedchheiqwo.shop
malicious
traineiwnqo.shop
malicious
https://froytnewqowv.shop:443/api
unknown
https://froytnewqowv.shop/5
unknown
https://froytnewqowv.shop/
unknown
https://froytnewqowv.shop/b.y
unknown
https://froytnewqowv.shop/apiMf
unknown
http://upx.sf.net
unknown
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
froytnewqowv.shop
188.114.97.3
 malicious

IPs

IP
Domain
Country
Malicious
188.114.97.3
froytnewqowv.shop
European Union
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProgramId
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
FileId
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LowerCaseLongPath
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LongPathHash
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Name
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
OriginalFileName
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Publisher
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Version
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinFileVersion
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinaryType
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductName
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductVersion
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LinkDate
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinProductVersion
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageFullName
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageRelativeId
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Size
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Language
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
IsOsComponent
\REGISTRY\A\{7f351aa5-081e-b6b6-8326-0aa3a120a949}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Usn
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1220000
trusted library allocation
page read and write
1244000
trusted library allocation
page read and write
3E22000
trusted library allocation
page read and write
FAE000
stack
page read and write
1042000
heap
page read and write
332E000
stack
page read and write
400000
remote allocation
page execute and read and write
147E000
stack
page read and write
F70000
heap
page read and write
FE0000
heap
page read and write
10CE000
heap
page read and write
2E21000
trusted library allocation
page read and write
B20000
unkown
page readonly
349E000
stack
page read and write
1270000
heap
page read and write
31ED000
stack
page read and write
1066000
heap
page read and write
1234000
trusted library allocation
page read and write
2DFE000
stack
page read and write
FE5000
heap
page read and write
1550000
heap
page read and write
2E22000
trusted library allocation
page execute and read and write
14EE000
stack
page read and write
E3C000
stack
page read and write
126B000
trusted library allocation
page execute and read and write
FCE000
stack
page read and write
452000
remote allocation
page execute and read and write
1540000
trusted library allocation
page read and write
137F000
stack
page read and write
BCC000
stack
page read and write
2D4E000
stack
page read and write
13B0000
heap
page read and write
105D000
heap
page read and write
10D4000
heap
page read and write
1076000
heap
page read and write
2ACF000
stack
page read and write
1073000
heap
page read and write
139D000
stack
page read and write
3E25000
trusted library allocation
page read and write
1039000
heap
page read and write
1490000
trusted library allocation
page read and write
4FBE000
stack
page read and write
102F000
heap
page read and write
2D0E000
stack
page read and write
FC0000
heap
page read and write
102E000
stack
page read and write
F80000
heap
page read and write
10D6000
heap
page read and write
1530000
trusted library allocation
page execute and read and write
1260000
trusted library allocation
page read and write
5300000
heap
page read and write
1065000
heap
page read and write
1026000
heap
page read and write
FB5000
heap
page read and write
2E4F000
stack
page read and write
1233000
trusted library allocation
page execute and read and write
103E000
heap
page read and write
1030000
heap
page read and write
FB0000
heap
page read and write
152E000
stack
page read and write
2E10000
heap
page execute and read and write
104F000
heap
page read and write
1240000
trusted library allocation
page read and write
342F000
stack
page read and write
100A000
heap
page read and write
14A0000
heap
page read and write
359F000
stack
page read and write
EFC000
stack
page read and write
2C0D000
stack
page read and write
32EE000
stack
page read and write
2BCD000
stack
page read and write
F40000
heap
page read and write
F3B000
stack
page read and write
1000000
heap
page read and write
1093000
heap
page read and write
103A000
heap
page read and write
B22000
unkown
page readonly
F30000
heap
page read and write
There are 68 hidden memdumps, click here to show them.