Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.Win32.Evo-gen.3521.549.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.757992948918612
Filename:	SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Filesize:	2680832
MD5:	fada0c33bf7972b910f80e7233a8fd57
SHA1:	6b6ae977d686e446ec8028dbb0c9447c7fdec026
SHA256:	5413944edc2672c6634f665d6c6722cf21220ef49254d8fe42d0d63dc8826988
SHA512:	b41f4296c4b02828bbb1de630ea20bb5c30fb5f61e22bf38ac59303a98c5334fa158cf16a3a1840bc9279614e61d9a40a1b0d488a05cb75d76747c47dc933d39
SSDEEP:	49152:a8TT5mM8Y2gjw13LJhLPT+l5L5W+u88nHq5H51HQjBQrttD7sfoXSMzPQbQ:aAlx1deTXh
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.H.].H.].H.]...^.F.]...X...]...Y.\.]...^.P.]...X...]...Y.S.]...[.I.]...\._.].H.\...]...T...].....I.]..._.I.].RichH.]........

Signature Hits	Behavior Group	Mitre Attack
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Detected unpacking (creates a PE file in dynamic memory)	Compliance, Data Obfuscation	Software Packing Security Software Discovery
Malicious sample detected (through community Yara rule)	System Summary
Contains functionality to detect sleep reduction / modifications	Malware Analysis System Evasion
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation
Drops large PE files	System Summary	Access Token Manipulation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Input Capture
Abnormal high CPU Usage	System Summary	Access Token Manipulation Process Injection System Time Discovery System Information Discovery
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Clipboard Data
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Detected potential crypto function	System Summary	Access Token Manipulation Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion	Security Software Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
May check if the current machine is a sandbox (GetTickCount - Sleep)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample might require command line arguments	System Summary	Access Token Manipulation Security Software Discovery
Sample reads its own file content	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
Category:	dropped
Dump:	json[1].json.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Type:	JSON data
Entropy:	5.013811273052389
Encrypted:	false
Ssdeep:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	moderate

C:\Users\user\AppData\Roaming\Key\logs.dat

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Key\logs.dat
Category:	dropped
Dump:	logs.dat.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Type:	data
Entropy:	3.3208960278181134
Encrypted:	false
Ssdeep:	6:6lul1zb5YcIeeDAlOWAAe5q1gWAAe5q1gWAv:6lEzDec0WFe5BWFe5BW+
Size:	288
Whitelisted:	false
Reputation:	low

C:\Users\user\Pictures\TermianlConsole\TerminalIll.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\Pictures\TermianlConsole\TerminalIll.exe
Category:	dropped
Dump:	TerminalIll.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.03944305888785394
Encrypted:	false
Size:	989587324
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe

"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5532
Target ID:	0
Parent PID:	1028
Name:	SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe"
Size:	2680832
MD5:	FADA0C33BF7972B910F80E7233A8FD57
Time:	12:44:05
Date:	26/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	2703360
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (creates a PE file in dynamic memory)	Compliance, Data Obfuscation	Software Packing
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
PE file has an executable .text section and no other executable section	System Summary
Public key (encryption) found	Cryptography	Archive Collected Data
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe

"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6540
Target ID:	3
Parent PID:	5532
Name:	SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe"
Size:	2680832
MD5:	FADA0C33BF7972B910F80E7233A8FD57
Time:	12:44:23
Date:	26/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	2703360
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (creates a PE file in dynamic memory)	Compliance, Data Obfuscation	Software Packing
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Launches processes in debugging mode, may be used to hinder debugging	Anti Debugging	Disable or Modify Tools
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
PE file has an executable .text section and no other executable section	System Summary
Public key (encryption) found	Cryptography	Archive Collected Data
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

URLs

Name

Malicious

hotsdefender.webredirect.org

Details

Name:	hotsdefender.webredirect.org
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	3
From Memory:	false
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Suricata IDS alerts with low severity for network traffic	Networking
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp%

unknown

Details

Name:	http://geoplugin.net/json.gp%
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Source:	SecuriteInfo.com.Win32.Evo-gen.3521.549.exe, 00000003.00000002.4514898457.00000000049F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.3521.549.exe, 00000003.00000003.2255306822.00000000049F6000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Source:	SecuriteInfo.com.Win32.Evo-gen.3521.549.exe, 00000000.00000002.2275798447.000000000051C000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Evo-gen.3521.549.exe, 00000000.00000002.2276278471.0000000006300000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Evo-gen.3521.549.exe, 00000003.00000002.4514531527.00000000046A0000.00000040.00000400.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpP

unknown

http://geoplugin.net/json.gpSystem32

unknown

Domains

Name

Malicious

hotsdefender.webredirect.org

5.34.182.173

Details

Name:	hotsdefender.webredirect.org
IP:	5.34.182.173
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

5.34.182.173

hotsdefender.webredirect.org

Ukraine

Details

IP:	5.34.182.173
TargetID:	3
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Country:	Ukraine
Countrycode:	UKR
ASN number:	15626
ASN name:	ITLASUA
Private:	false
Domain:	hotsdefender.webredirect.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	3
Current Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.3521.549.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

AdvancedUpdater

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	AdvancedUpdater
Value data:	C:\Users\user\Pictures\TermianlConsole\TerminalIll.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\Ag0s70JwbdycP5ikGBT/VhjSeXFA==-S28M8P

exepath

HKEY_CURRENT_USER\SOFTWARE\Ag0s70JwbdycP5ikGBT/VhjSeXFA==-S28M8P

licence

HKEY_CURRENT_USER\SOFTWARE\Ag0s70JwbdycP5ikGBT/VhjSeXFA==-S28M8P

time

Memdumps

Base Address

Regiontype

Protect

Malicious

46A0000

remote allocation

page execute and read and write

51C000

unkown

page execute and read and write

49A7000

heap

page read and write

6300000

direct allocation

page execute and read and write

515000

unkown

page write copy

401000

unkown

page execute read

4A2C000

heap

page read and write

664C000

stack

page read and write

616000

unkown

page readonly

401000

unkown

page execute read

519000

unkown

page write copy

9C000

stack

page read and write

621000

unkown

page execute and read and write

476C000

stack

page read and write

4870000

heap

page read and write

51A000

unkown

page readonly

686000

unkown

page readonly

4A2F000

stack

page read and write

400000

unkown

page readonly

60A000

unkown

page readonly

4A26000

heap

page read and write

48D0000

heap

page read and write

60A000

unkown

page execute and write copy

4D6F000

stack

page read and write

4780000

heap

page read and write

61E000

unkown

page readonly

4A05000

heap

page read and write

60A000

unkown

page readonly

66C3000

direct allocation

page read and write

4A26000

heap

page read and write

400000

unkown

page readonly

62F0000

heap

page read and write

64F0000

direct allocation

page read and write

5D8000

unkown

page readonly

5D8000

unkown

page readonly

4A2C000

heap

page read and write

5E7000

unkown

page readonly

51A000

unkown

page readonly

627000

unkown

page readonly

4E2000

unkown

page readonly

486C000

stack

page read and write

60A000

unkown

page readonly

49E8000

heap

page read and write

4A26000

heap

page read and write

659000

unkown

page readonly

4B2F000

stack

page read and write

616000

unkown

page readonly

5E7000

unkown

page readonly

619000

unkown

page execute and read and write

61E000

unkown

page execute and write copy

4980000

heap

page read and write

47CE000

stack

page read and write

59B000

unkown

page readonly

74EF000

stack

page read and write

4A15000

heap

page read and write

198000

stack

page read and write

48E0000

heap

page read and write

627000

unkown

page readonly

62B000

unkown

page execute and read and write

5D5000

unkown

page readonly

5E7000

unkown

page readonly

6378000

direct allocation

page execute and read and write

48CE000

stack

page read and write

65D000

unkown

page execute and read and write

49F6000

heap

page read and write

4E2000

unkown

page readonly

4E2000

unkown

page readonly

627000

unkown

page execute and write copy

73EE000

stack

page read and write

6A2E000

stack

page read and write

481E000

stack

page read and write

59B000

unkown

page readonly

4A1C000

heap

page read and write

497E000

stack

page read and write

660F000

stack

page read and write

4714000

remote allocation

page execute and read and write

4837000

heap

page read and write

59B000

unkown

page readonly

401000

unkown

page execute read

4A1C000

heap

page read and write

5D5000

unkown

page readonly

5E7000

unkown

page readonly

46A0000

heap

page read and write

49A0000

heap

page read and write

5D8000

unkown

page readonly

4880000

heap

page readonly

4A16000

heap

page read and write

48E5000

heap

page read and write

519000

unkown

page readonly

4B70000

heap

page read and write

674F000

stack

page read and write

68CE000

stack

page read and write

66C0000

direct allocation

page read and write

66F6000

direct allocation

page read and write

64E0000

heap

page read and write

6709000

direct allocation

page read and write

59B000

unkown

page readonly

5D8000

unkown

page readonly

66D2000

direct allocation

page read and write

4A2C000

heap

page read and write

400000

unkown

page readonly

659000

unkown

page execute and write copy

4A05000

heap

page read and write

515000

unkown

page write copy

515000

unkown

page read and write

6686000

direct allocation

page read and write

4A1C000

heap

page read and write

678C000

stack

page read and write

6745000

direct allocation

page read and write

688F000

stack

page read and write

60E000

unkown

page execute and read and write

616000

unkown

page execute and write copy

69D0000

heap

page read and write

4E2000

unkown

page readonly

49E8000

heap

page read and write

4718000

remote allocation

page execute and read and write

47D0000

heap

page read and write

6B2F000

stack

page read and write

66DC000

direct allocation

page read and write

4830000

heap

page read and write

659000

unkown

page readonly

49D9000

heap

page read and write

61E000

unkown

page readonly

69CF000

stack

page read and write

5D5000

unkown

page readonly

607000

unkown

page execute and write copy

49F6000

heap

page read and write

519000

unkown

page write copy

516000

unkown

page write copy

515000

unkown

page write copy

401000

unkown

page execute read

5D5000

unkown

page readonly

51A000

unkown

page readonly

627000

unkown

page readonly

659000

unkown

page readonly

616000

unkown

page readonly

400000

unkown

page readonly

61E000

unkown

page readonly

519000

unkown

page write copy

There are 129 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SecuriteInfo.com.Win32.Evo-gen.3521.549.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSecuriteInfo.com.Win32.Evo-gen.3521.549.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
SecuriteInfo.com.Win32.Evo-gen.3521.549.exe