IOC Report
stub.exe

loading gif

Files

File Path
Type
Category
Malicious
stub.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tmp5F.tmp.bat
ASCII text, with CRLF line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\stub.exe
"C:\Users\user\Desktop\stub.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp5F.tmp.bat
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 1732
C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak

URLs

Name
IP
Malicious
https://discord.com
unknown
 malicious
https://discord.com/api/webhooks/1216977598710812722/eEJiGM8jVlIOF9WMbphPIuNdIEZhhSSu4T_LZSo0WE_S2YnMqS8z5lz1bmAKfC9V08aI
162.159.136.232
 malicious
https://discord.com/api/webhooks/1216977598710812722/eEJiGM8jVlIOF9WMbphPIuNdIEZhhSSu4T_LZSo0WE_S2Yn
unknown
 malicious
https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958
unknown
https://github.com/dotnet/runtime8
unknown
https://aka.ms/dotnet-warnings/
unknown
https://github.com/kgnfth
unknown
https://github.com/dotnet/roslyn/issues/46646~
unknown
https://aka.ms/serializationformat-binary-obsolete
unknown
https://user-images.githubusercontent.com/73314940/227717196-0165bb7f-c33a-4985-8be8-2bd898eacc2b.pn
unknown
https://aka.ms/binaryformatter
unknown
https://github.com/dotnet/runtime/issues/73124.
unknown
http://discord.com
unknown
http://discord.comd
unknown
https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/dotnet/runtime
unknown
https://github.com/dotnet/roslyn/issues/46646
unknown
There are 8 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
discord.com
162.159.136.232
 malicious

IPs

IP
Domain
Country
Malicious
162.159.136.232
discord.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\stub_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3191000
trusted library allocation
page read and write
 malicious
C72000
unkown
page readonly
 malicious
5AE6000
heap
page read and write
1493000
heap
page read and write
5AE000
stack
page read and write
694E000
stack
page read and write
13E2000
trusted library allocation
page read and write
5ACA000
heap
page read and write
19D0000
heap
page read and write
41B9000
trusted library allocation
page read and write
5CF0000
heap
page read and write
356C000
trusted library allocation
page read and write
1990000
trusted library allocation
page read and write
1430000
heap
page read and write
2D40000
heap
page read and write
5AC5000
heap
page read and write
164E000
stack
page read and write
60EE000
stack
page read and write
6D2B000
stack
page read and write
72AC000
stack
page read and write
168E000
stack
page read and write
16E7000
heap
page read and write
19D6000
heap
page read and write
16DB000
trusted library allocation
page read and write
716C000
stack
page read and write
430F000
trusted library allocation
page read and write
6E70000
heap
page read and write
1255000
heap
page read and write
57AE000
stack
page read and write
1980000
trusted library allocation
page read and write
33D6000
trusted library allocation
page read and write
3170000
heap
page read and write
1420000
trusted library allocation
page execute and read and write
410000
heap
page read and write
356E000
trusted library allocation
page read and write
13C0000
trusted library allocation
page read and write
1410000
trusted library allocation
page read and write
636F000
stack
page read and write
64AE000
stack
page read and write
353E000
trusted library allocation
page read and write
C70000
unkown
page readonly
6E6E000
stack
page read and write
5E9E000
stack
page read and write
33D1000
trusted library allocation
page read and write
5FA0000
trusted library section
page read and write
3559000
trusted library allocation
page read and write
33D4000
trusted library allocation
page read and write
16E0000
heap
page read and write
698E000
stack
page read and write
353C000
trusted library allocation
page read and write
354E000
trusted library allocation
page read and write
2CCC000
stack
page read and write
13FB000
trusted library allocation
page execute and read and write
532E000
stack
page read and write
19DB000
heap
page read and write
60AD000
stack
page read and write
72A000
heap
page read and write
1450000
heap
page read and write
E9C000
stack
page read and write
65EE000
stack
page read and write
41F7000
trusted library allocation
page read and write
16D000
stack
page read and write
59F0000
heap
page read and write
2E30000
heap
page read and write
14E1000
heap
page read and write
5198000
trusted library allocation
page read and write
16CC000
stack
page read and write
1AD000
stack
page read and write
1490000
heap
page read and write
13F2000
trusted library allocation
page read and write
16DE000
trusted library allocation
page read and write
684E000
stack
page read and write
720000
heap
page read and write
6BED000
stack
page read and write
13D0000
trusted library allocation
page read and write
64EE000
stack
page read and write
59EE000
stack
page read and write
3140000
trusted library allocation
page read and write
3150000
heap
page execute and read and write
3538000
trusted library allocation
page read and write
65F0000
trusted library allocation
page read and write
727000
heap
page read and write
6D6E000
stack
page read and write
13AE000
stack
page read and write
33D9000
trusted library allocation
page read and write
2F6E000
stack
page read and write
3568000
trusted library allocation
page read and write
1210000
heap
page read and write
13E6000
trusted library allocation
page execute and read and write
3541000
trusted library allocation
page read and write
58AF000
stack
page read and write
6A8E000
stack
page read and write
13C4000
trusted library allocation
page read and write
1200000
heap
page read and write
43C5000
trusted library allocation
page read and write
2D30000
heap
page read and write
FEF00000
trusted library allocation
page execute and read and write
1250000
heap
page read and write
13C3000
trusted library allocation
page execute and read and write
58EE000
stack
page read and write
153B000
heap
page read and write
302F000
stack
page read and write
2C8C000
stack
page read and write
2E38000
heap
page read and write
33CE000
trusted library allocation
page read and write
13F7000
trusted library allocation
page execute and read and write
30EE000
stack
page read and write
71A0000
heap
page read and write
13EA000
trusted library allocation
page execute and read and write
145E000
heap
page read and write
60F000
stack
page read and write
1478000
heap
page read and write
4950000
heap
page read and write
33DF000
trusted library allocation
page read and write
13E0000
trusted library allocation
page read and write
33E7000
trusted library allocation
page read and write
312E000
stack
page read and write
F96000
stack
page read and write
63AD000
stack
page read and write
710000
heap
page read and write
13B0000
trusted library allocation
page read and write
56F000
stack
page read and write
5AF0000
heap
page read and write
5B0000
heap
page read and write
136D000
stack
page read and write
6030000
trusted library section
page read and write
33E4000
trusted library allocation
page read and write
4191000
trusted library allocation
page read and write
3548000
trusted library allocation
page read and write
5F9F000
stack
page read and write
17EE000
stack
page read and write
1458000
heap
page read and write
33E2000
trusted library allocation
page read and write
3552000
trusted library allocation
page read and write
668E000
stack
page read and write
2E20000
heap
page read and write
6AEE000
stack
page read and write
576F000
stack
page read and write
626D000
stack
page read and write
2FEE000
stack
page read and write
33DB000
trusted library allocation
page read and write
52E000
stack
page read and write
5C0000
heap
page read and write
2FAE000
stack
page read and write
3160000
heap
page execute and read and write
16D0000
trusted library allocation
page read and write
678C000
stack
page read and write
13CD000
trusted library allocation
page execute and read and write
13F0000
trusted library allocation
page read and write
3180000
heap
page read and write
6C2C000
stack
page read and write
There are 141 hidden memdumps, click here to show them.