IOC Report
SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tzoqm1k.hk2.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_21lqgs3s.2lh.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpzdcvwv.4oj.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duoksdqd.zn1.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe"
 malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
http://aborters.duckdns.org:8081
unknown
 malicious
http://anotherarmy.dns.army:8081
unknown
 malicious
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://api.telegram.org
unknown
https://api.telegram.org/bot
unknown
http://www.fontbureau.com/designers?
unknown
http://www.galapagosdesign.com/staff/dennis.htmE
unknown
https://www.office.com/lB
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://www.goodfont.co.kr
unknown
https://chrome.google.com/webstore?hl=en
unknown
http://varders.kozow.com:8081
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://checkip.dyndns.org/
132.226.8.169
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2026/09/2024%20/%2021:13:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20a
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
https://reallyfreegeoip.org/xml/
unknown
https://www.office.com/
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
http://www.carterandcone.coml
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://www.jiyu-kobo.co.jp/
unknown
https://reallyfreegeoip.org
unknown
http://www.fontbureau.com/designers8
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
There are 40 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
api.telegram.org
149.154.167.220
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.8.169

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
132.226.8.169
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2BC1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3D19000
trusted library allocation
page read and write
 malicious
A37E000
stack
page read and write
7F090000
trusted library allocation
page execute and read and write
2D74000
trusted library allocation
page read and write
5710000
heap
page read and write
6870000
trusted library allocation
page execute and read and write
2C39000
trusted library allocation
page read and write
3E24000
trusted library allocation
page read and write
F0A000
trusted library allocation
page execute and read and write
3C7A000
trusted library allocation
page read and write
52E0000
heap
page read and write
56D0000
heap
page read and write
2C7F000
trusted library allocation
page read and write
2CB0000
trusted library allocation
page read and write
5350000
trusted library allocation
page execute and read and write
552E000
stack
page read and write
2C3B000
stack
page read and write
3C90000
trusted library allocation
page read and write
522A000
trusted library allocation
page read and write
3EB6000
trusted library allocation
page read and write
2ED8000
trusted library allocation
page read and write
6940000
trusted library allocation
page read and write
CF7000
stack
page read and write
3E90000
trusted library allocation
page read and write
7D0E000
stack
page read and write
3C97000
trusted library allocation
page read and write
10FE000
stack
page read and write
651F000
stack
page read and write
2E3A000
trusted library allocation
page read and write
E92000
trusted library allocation
page read and write
A57E000
stack
page read and write
E7D000
trusted library allocation
page execute and read and write
3E4F000
trusted library allocation
page read and write
3CAB000
trusted library allocation
page read and write
7830000
trusted library allocation
page execute and read and write
56D9000
heap
page read and write
ED0000
trusted library allocation
page read and write
7E0E000
stack
page read and write
2B76000
trusted library allocation
page read and write
7A4E000
stack
page read and write
2D00000
heap
page read and write
D10000
heap
page read and write
74CE000
stack
page read and write
534D000
trusted library allocation
page read and write
5712000
heap
page read and write
5160000
heap
page read and write
AA3C000
stack
page read and write
F00000
trusted library allocation
page read and write
3CDD000
trusted library allocation
page read and write
E70000
trusted library allocation
page read and write
3E49000
trusted library allocation
page read and write
6950000
trusted library allocation
page execute and read and write
3DC9000
trusted library allocation
page read and write
1150000
trusted library allocation
page read and write
A67E000
stack
page read and write
2C40000
trusted library allocation
page read and write
2C1C000
trusted library allocation
page read and write
3E57000
trusted library allocation
page read and write
639F000
stack
page read and write
FF7000
heap
page read and write
51E0000
heap
page read and write
EED000
trusted library allocation
page execute and read and write
13B0000
heap
page read and write
6E72000
trusted library allocation
page read and write
3082000
trusted library allocation
page read and write
2C70000
trusted library allocation
page read and write
2B71000
trusted library allocation
page read and write
3D0C000
trusted library allocation
page read and write
2C35000
trusted library allocation
page read and write
6980000
heap
page read and write
2B4E000
stack
page read and write
3E1E000
trusted library allocation
page read and write
3CA5000
trusted library allocation
page read and write
77A0000
trusted library section
page read and write
3D6C000
trusted library allocation
page read and write
3CCF000
trusted library allocation
page read and write
1230000
trusted library allocation
page read and write
2B68000
trusted library allocation
page read and write
2C62000
trusted library allocation
page read and write
3DB1000
trusted library allocation
page read and write
6830000
trusted library allocation
page execute and read and write
567E000
stack
page read and write
3CEC000
trusted library allocation
page read and write
2DA7000
trusted library allocation
page read and write
2C28000
trusted library allocation
page read and write
D60000
heap
page read and write
4BC0000
trusted library allocation
page read and write
2DA3000
trusted library allocation
page read and write
2C66000
trusted library allocation
page read and write
2CD0000
trusted library allocation
page read and write
6880000
trusted library allocation
page execute and read and write
A93B000
stack
page read and write
3F13000
trusted library allocation
page read and write
5233000
heap
page read and write
E6D000
trusted library allocation
page execute and read and write
7B4E000
stack
page read and write
3D11000
trusted library allocation
page read and write
2DA5000
trusted library allocation
page read and write
6D10000
heap
page read and write
D9D000
stack
page read and write
3C2A000
trusted library allocation
page read and write
3BC1000
trusted library allocation
page read and write
EE0000
trusted library allocation
page read and write
E8A000
trusted library allocation
page execute and read and write
51C0000
trusted library section
page readonly
5550000
trusted library allocation
page read and write
AB7F000
stack
page read and write
2D9F000
trusted library allocation
page read and write
F57000
heap
page read and write
2DD1000
trusted library allocation
page read and write
3E22000
trusted library allocation
page read and write
3D54000
trusted library allocation
page read and write
3CAF000
trusted library allocation
page read and write
E95000
trusted library allocation
page execute and read and write
F65000
heap
page read and write
3F45000
trusted library allocation
page read and write
EB0000
trusted library allocation
page read and write
3F5E000
trusted library allocation
page read and write
EE4000
trusted library allocation
page read and write
919000
stack
page read and write
2B7D000
trusted library allocation
page read and write
122E000
stack
page read and write
2D51000
trusted library allocation
page read and write
681E000
stack
page read and write
D7E000
heap
page read and write
7485000
trusted library allocation
page read and write
52D0000
trusted library allocation
page execute and read and write
127E000
stack
page read and write
E64000
trusted library allocation
page read and write
E86000
trusted library allocation
page execute and read and write
2F13000
trusted library allocation
page read and write
3C7E000
trusted library allocation
page read and write
2C31000
trusted library allocation
page read and write
570C000
heap
page read and write
3E47000
trusted library allocation
page read and write
EE0000
heap
page read and write
3D77000
trusted library allocation
page read and write
E9B000
trusted library allocation
page execute and read and write
655E000
stack
page read and write
669E000
stack
page read and write
6860000
trusted library allocation
page execute and read and write
3EF1000
trusted library allocation
page read and write
970000
heap
page read and write
7350000
heap
page read and write
5360000
heap
page execute and read and write
66DE000
stack
page read and write
54EE000
stack
page read and write
2DD9000
trusted library allocation
page read and write
2C26000
trusted library allocation
page read and write
2DAD000
trusted library allocation
page read and write
3E93000
trusted library allocation
page read and write
75D0000
trusted library allocation
page read and write
6840000
trusted library allocation
page read and write
6E50000
trusted library allocation
page read and write
2B6E000
trusted library allocation
page read and write
64DE000
stack
page read and write
D89000
heap
page read and write
870000
unkown
page readonly
E82000
trusted library allocation
page read and write
3CF5000
trusted library allocation
page read and write
3EB4000
trusted library allocation
page read and write
50DD000
stack
page read and write
F12000
trusted library allocation
page read and write
3F66000
trusted library allocation
page read and write
3026000
trusted library allocation
page read and write
13AF000
stack
page read and write
2D76000
trusted library allocation
page read and write
E60000
trusted library allocation
page read and write
2C6A000
trusted library allocation
page read and write
3F57000
trusted library allocation
page read and write
2E0A000
trusted library allocation
page read and write
4BC8000
trusted library allocation
page read and write
2B56000
trusted library allocation
page read and write
3EFE000
trusted library allocation
page read and write
3E81000
trusted library allocation
page read and write
A8FE000
stack
page read and write
3E73000
trusted library allocation
page read and write
640A000
heap
page read and write
10BE000
stack
page read and write
5230000
heap
page read and write
E80000
trusted library allocation
page read and write
2D53000
trusted library allocation
page read and write
AA7E000
stack
page read and write
671E000
stack
page read and write
3F21000
trusted library allocation
page read and write
2FC9000
trusted library allocation
page read and write
113C000
stack
page read and write
2D68000
trusted library allocation
page read and write
3E3B000
trusted library allocation
page read and write
2C10000
trusted library allocation
page read and write
725E000
heap
page read and write
1140000
trusted library allocation
page read and write
5340000
trusted library allocation
page read and write
F30000
heap
page read and write
F3E000
heap
page read and write
2B6A000
trusted library allocation
page read and write
3D75000
trusted library allocation
page read and write
2D81000
trusted library allocation
page read and write
EF3000
trusted library allocation
page read and write
2C80000
trusted library allocation
page read and write
7376000
heap
page read and write
2D7C000
trusted library allocation
page read and write
55AE000
stack
page read and write
794E000
stack
page read and write
13B7000
heap
page read and write
DE2000
heap
page read and write
56B0000
heap
page read and write
665E000
stack
page read and write
2C76000
trusted library allocation
page read and write
F72000
heap
page read and write
9C0000
heap
page read and write
2FF7000
trusted library allocation
page read and write
2D6E000
trusted library allocation
page read and write
2DB2000
trusted library allocation
page read and write
F6F000
heap
page read and write
2F9C000
trusted library allocation
page read and write
3F3A000
trusted library allocation
page read and write
F1B000
trusted library allocation
page execute and read and write
2CA5000
trusted library allocation
page read and write
3F41000
trusted library allocation
page read and write
3F16000
trusted library allocation
page read and write
1144000
trusted library allocation
page read and write
2C90000
trusted library allocation
page read and write
9E0000
heap
page read and write
DDE000
stack
page read and write
3CA3000
trusted library allocation
page read and write
6910000
trusted library allocation
page read and write
3CF3000
trusted library allocation
page read and write
3CB3000
trusted library allocation
page read and write
3DA5000
trusted library allocation
page read and write
112E000
stack
page read and write
68E0000
trusted library allocation
page execute and read and write
3F19000
trusted library allocation
page read and write
30B0000
trusted library allocation
page read and write
3CB1000
trusted library allocation
page read and write
2C4B000
trusted library allocation
page read and write
D68000
heap
page read and write
3EE4000
trusted library allocation
page read and write
2B82000
trusted library allocation
page read and write
2CC8000
trusted library allocation
page read and write
E97000
trusted library allocation
page execute and read and write
3BCB000
trusted library allocation
page read and write
3F2D000
trusted library allocation
page read and write
9BE000
stack
page read and write
748F000
trusted library allocation
page read and write
2B5E000
trusted library allocation
page read and write
5240000
heap
page read and write
56B5000
heap
page read and write
2C61000
trusted library allocation
page read and write
12A0000
heap
page execute and read and write
5680000
trusted library allocation
page read and write
56FE000
heap
page read and write
F02000
trusted library allocation
page read and write
EF0000
trusted library allocation
page read and write
E4B000
heap
page read and write
629E000
stack
page read and write
1170000
heap
page execute and read and write
6850000
trusted library allocation
page execute and read and write
CF7000
stack
page read and write
7363000
heap
page read and write
2B50000
trusted library allocation
page read and write
2C6E000
trusted library allocation
page read and write
2F6E000
trusted library allocation
page read and write
3C80000
trusted library allocation
page read and write
2F41000
trusted library allocation
page read and write
3C9F000
trusted library allocation
page read and write
3EAB000
trusted library allocation
page read and write
3EF8000
trusted library allocation
page read and write
3D14000
trusted library allocation
page read and write
2BB0000
heap
page read and write
2CA0000
trusted library allocation
page read and write
F17000
trusted library allocation
page execute and read and write
2C6D000
trusted library allocation
page read and write
D95000
heap
page read and write
2EA8000
trusted library allocation
page read and write
5170000
trusted library allocation
page execute and read and write
7250000
heap
page read and write
68F0000
trusted library allocation
page read and write
1160000
trusted library allocation
page read and write
3E34000
trusted library allocation
page read and write
3E53000
trusted library allocation
page read and write
6930000
trusted library allocation
page read and write
3BE3000
trusted library allocation
page read and write
872000
unkown
page readonly
F06000
trusted library allocation
page execute and read and write
2D11000
trusted library allocation
page read and write
5570000
heap
page read and write
2CA5000
trusted library allocation
page read and write
EC0000
trusted library allocation
page execute and read and write
DE0000
heap
page read and write
A7FE000
stack
page read and write
3054000
trusted library allocation
page read and write
5130000
trusted library allocation
page read and write
2C5E000
trusted library allocation
page read and write
1280000
trusted library allocation
page execute and read and write
2C5E000
trusted library allocation
page read and write
2C72000
trusted library allocation
page read and write
9BA000
stack
page read and write
51A8000
trusted library allocation
page read and write
3BE9000
trusted library allocation
page read and write
53AE000
stack
page read and write
56C0000
heap
page read and write
E0D000
heap
page read and write
2C7B000
trusted library allocation
page read and write
EE3000
trusted library allocation
page execute and read and write
EFD000
trusted library allocation
page execute and read and write
51D0000
heap
page read and write
51A0000
trusted library allocation
page read and write
ED0000
trusted library allocation
page read and write
FC4000
heap
page read and write
11A0000
heap
page read and write
A3BE000
stack
page read and write
3D05000
trusted library allocation
page read and write
5226000
trusted library allocation
page read and write
5224000
trusted library allocation
page read and write
2B5B000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
3E55000
trusted library allocation
page read and write
53B0000
heap
page execute and read and write
52E3000
heap
page read and write
1290000
trusted library allocation
page read and write
2D72000
trusted library allocation
page read and write
5560000
trusted library allocation
page read and write
2D73000
trusted library allocation
page read and write
D50000
trusted library allocation
page read and write
D20000
heap
page read and write
6920000
trusted library allocation
page read and write
3F05000
trusted library allocation
page read and write
3CEF000
trusted library allocation
page read and write
75CE000
stack
page read and write
5180000
trusted library allocation
page read and write
2C72000
trusted library allocation
page read and write
52CB000
stack
page read and write
7480000
trusted library allocation
page read and write
56A0000
trusted library section
page read and write
6900000
trusted library allocation
page execute and read and write
6927000
trusted library allocation
page read and write
63A0000
heap
page read and write
4E0C000
stack
page read and write
3F09000
trusted library allocation
page read and write
D50000
heap
page read and write
2C66000
trusted library allocation
page read and write
3E43000
trusted library allocation
page read and write
4D5E000
stack
page read and write
6820000
trusted library allocation
page read and write
E63000
trusted library allocation
page execute and read and write
3F47000
trusted library allocation
page read and write
There are 339 hidden memdumps, click here to show them.