Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
CNNuVrT9Dm.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\CNNuVrT9Dm.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\09df2bd777d1a884c3a89c8a9ba5e4a2.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\09df2bd777d1a884c3a89c8a9ba5e4a2.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\CNNuVrT9Dm.exe
|
"C:\Users\user\Desktop\CNNuVrT9Dm.exe"
|
|
|
|
C:\Windows\SysWOW64\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\Desktop\CNNuVrT9Dm.exe" "CNNuVrT9Dm.exe" ENABLE
|
|
|
|
C:\Users\user\Desktop\CNNuVrT9Dm.exe
|
"C:\Users\user\Desktop\CNNuVrT9Dm.exe" ..
|
|
|
|
C:\Users\user\Desktop\CNNuVrT9Dm.exe
|
"C:\Users\user\Desktop\CNNuVrT9Dm.exe" ..
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
steam.buy-nitro.ru
|
176.109.107.2
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
176.109.107.2
|
steam.buy-nitro.ru
|
Russian Federation
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
|
|
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
09df2bd777d1a884c3a89c8a9ba5e4a2
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
|
09df2bd777d1a884c3a89c8a9ba5e4a2
|
||
|
HKEY_CURRENT_USER\SOFTWARE\09df2bd777d1a884c3a89c8a9ba5e4a2
|
[kl]
|
||
|
HKEY_CURRENT_USER\SOFTWARE\09df2bd777d1a884c3a89c8a9ba5e4a2
|
[kl]
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3231000
|
trusted library allocation
|
page read and write
|
|
|
|
BE2000
|
unkown
|
page readonly
|
|
|
|
621000
|
heap
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
5D6000
|
heap
|
page read and write
|
||
|
12FF000
|
stack
|
page read and write
|
||
|
5C8000
|
heap
|
page read and write
|
||
|
151B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1120000
|
heap
|
page read and write
|
||
|
6A5000
|
heap
|
page read and write
|
||
|
EC0000
|
heap
|
page read and write
|
||
|
14E0000
|
trusted library allocation
|
page read and write
|
||
|
595000
|
heap
|
page read and write
|
||
|
641000
|
heap
|
page read and write
|
||
|
5AD000
|
heap
|
page read and write
|
||
|
14E7000
|
trusted library allocation
|
page execute and read and write
|
||
|
555F000
|
stack
|
page read and write
|
||
|
594000
|
heap
|
page read and write
|
||
|
599000
|
heap
|
page read and write
|
||
|
11BE000
|
stack
|
page read and write
|
||
|
14C2000
|
trusted library allocation
|
page execute and read and write
|
||
|
59D000
|
heap
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
14D2000
|
trusted library allocation
|
page execute and read and write
|
||
|
5C2000
|
heap
|
page read and write
|
||
|
601000
|
heap
|
page read and write
|
||
|
5DB000
|
heap
|
page read and write
|
||
|
588000
|
heap
|
page read and write
|
||
|
602000
|
heap
|
page read and write
|
||
|
EF9000
|
stack
|
page read and write
|
||
|
51EE000
|
stack
|
page read and write
|
||
|
645000
|
heap
|
page read and write
|
||
|
53CE000
|
stack
|
page read and write
|
||
|
F60000
|
heap
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
1312000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D19000
|
heap
|
page read and write
|
||
|
10D0000
|
trusted library allocation
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
121E000
|
stack
|
page read and write
|
||
|
59A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
624000
|
heap
|
page read and write
|
||
|
132B000
|
trusted library allocation
|
page execute and read and write
|
||
|
FC5000
|
heap
|
page read and write
|
||
|
4D11000
|
heap
|
page read and write
|
||
|
1700000
|
trusted library allocation
|
page read and write
|
||
|
594000
|
heap
|
page read and write
|
||
|
5450000
|
heap
|
page read and write
|
||
|
F60000
|
heap
|
page read and write
|
||
|
DC6000
|
heap
|
page read and write
|
||
|
58E000
|
heap
|
page read and write
|
||
|
348F000
|
trusted library allocation
|
page read and write
|
||
|
595000
|
heap
|
page read and write
|
||
|
621000
|
heap
|
page read and write
|
||
|
5C2000
|
heap
|
page read and write
|
||
|
59C000
|
heap
|
page read and write
|
||
|
17D0000
|
heap
|
page execute and read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
547E000
|
stack
|
page read and write
|
||
|
59E000
|
heap
|
page read and write
|
||
|
5C6000
|
heap
|
page read and write
|
||
|
1142000
|
trusted library allocation
|
page execute and read and write
|
||
|
16C0000
|
trusted library allocation
|
page read and write
|
||
|
5DE000
|
heap
|
page read and write
|
||
|
5DB000
|
heap
|
page read and write
|
||
|
1177000
|
trusted library allocation
|
page execute and read and write
|
||
|
3FC4000
|
trusted library allocation
|
page read and write
|
||
|
59A000
|
heap
|
page read and write
|
||
|
150A000
|
trusted library allocation
|
page execute and read and write
|
||
|
515E000
|
stack
|
page read and write
|
||
|
5D9000
|
heap
|
page read and write
|
||
|
5AD000
|
heap
|
page read and write
|
||
|
64E000
|
heap
|
page read and write
|
||
|
5590000
|
trusted library allocation
|
page read and write
|
||
|
100E000
|
heap
|
page read and write
|
||
|
5BE0000
|
heap
|
page read and write
|
||
|
589E000
|
stack
|
page read and write
|
||
|
170F000
|
trusted library allocation
|
page read and write
|
||
|
920000
|
heap
|
page read and write
|
||
|
1740000
|
trusted library allocation
|
page read and write
|
||
|
4C8F000
|
stack
|
page read and write
|
||
|
54AB000
|
stack
|
page read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
5BF000
|
heap
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
59D0000
|
heap
|
page read and write
|
||
|
D40000
|
heap
|
page read and write
|
||
|
5AD000
|
heap
|
page read and write
|
||
|
649000
|
heap
|
page read and write
|
||
|
1616000
|
heap
|
page read and write
|
||
|
186F000
|
stack
|
page read and write
|
||
|
10F0000
|
trusted library allocation
|
page read and write
|
||
|
601000
|
heap
|
page read and write
|
||
|
53DE000
|
stack
|
page read and write
|
||
|
5BF000
|
heap
|
page read and write
|
||
|
649000
|
heap
|
page read and write
|
||
|
1108000
|
heap
|
page read and write
|
||
|
14F0000
|
heap
|
page read and write
|
||
|
155E000
|
stack
|
page read and write
|
||
|
1570000
|
heap
|
page read and write
|
||
|
5C3000
|
heap
|
page read and write
|
||
|
EC5000
|
heap
|
page read and write
|
||
|
15CC000
|
stack
|
page read and write
|
||
|
624000
|
heap
|
page read and write
|
||
|
645000
|
heap
|
page read and write
|
||
|
F5E000
|
stack
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
5AC000
|
heap
|
page read and write
|
||
|
55C0000
|
unclassified section
|
page read and write
|
||
|
557E000
|
stack
|
page read and write
|
||
|
5C3000
|
heap
|
page read and write
|
||
|
14D0000
|
trusted library allocation
|
page read and write
|
||
|
16FE000
|
stack
|
page read and write
|
||
|
2EEF000
|
stack
|
page read and write
|
||
|
1512000
|
trusted library allocation
|
page read and write
|
||
|
16D0000
|
heap
|
page read and write
|
||
|
4D1A000
|
heap
|
page read and write
|
||
|
17C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
59E000
|
heap
|
page read and write
|
||
|
1510000
|
trusted library allocation
|
page read and write
|
||
|
585000
|
heap
|
page read and write
|
||
|
546C000
|
stack
|
page read and write
|
||
|
5DC000
|
heap
|
page read and write
|
||
|
4D0D000
|
heap
|
page read and write
|
||
|
A06000
|
heap
|
page read and write
|
||
|
5DF000
|
heap
|
page read and write
|
||
|
5CF000
|
heap
|
page read and write
|
||
|
579E000
|
stack
|
page read and write
|
||
|
4D15000
|
heap
|
page read and write
|
||
|
526E000
|
stack
|
page read and write
|
||
|
1136000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
5AD000
|
heap
|
page read and write
|
||
|
D8E000
|
stack
|
page read and write
|
||
|
136E000
|
stack
|
page read and write
|
||
|
87E000
|
unkown
|
page read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
4131000
|
trusted library allocation
|
page read and write
|
||
|
5AD000
|
heap
|
page read and write
|
||
|
59E000
|
heap
|
page read and write
|
||
|
3131000
|
trusted library allocation
|
page read and write
|
||
|
5A9000
|
heap
|
page read and write
|
||
|
1162000
|
trusted library allocation
|
page execute and read and write
|
||
|
14DF000
|
stack
|
page read and write
|
||
|
14E0000
|
heap
|
page read and write
|
||
|
19B000
|
stack
|
page read and write
|
||
|
5CF000
|
heap
|
page read and write
|
||
|
4D18000
|
heap
|
page read and write
|
||
|
1380000
|
heap
|
page execute and read and write
|
||
|
F76000
|
stack
|
page read and write
|
||
|
575E000
|
stack
|
page read and write
|
||
|
2DEF000
|
stack
|
page read and write
|
||
|
14CA000
|
trusted library allocation
|
page execute and read and write
|
||
|
1123000
|
heap
|
page read and write
|
||
|
522E000
|
stack
|
page read and write
|
||
|
5A7000
|
heap
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
541E000
|
stack
|
page read and write
|
||
|
152E000
|
stack
|
page read and write
|
||
|
595000
|
heap
|
page read and write
|
||
|
4D15000
|
heap
|
page read and write
|
||
|
597000
|
heap
|
page read and write
|
||
|
602000
|
heap
|
page read and write
|
||
|
116E000
|
stack
|
page read and write
|
||
|
4D19000
|
heap
|
page read and write
|
||
|
4D00000
|
heap
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
5DC000
|
heap
|
page read and write
|
||
|
FAE000
|
stack
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
5CB000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
11A0000
|
heap
|
page read and write
|
||
|
99D000
|
stack
|
page read and write
|
||
|
10DE000
|
stack
|
page read and write
|
||
|
4EE000
|
stack
|
page read and write
|
||
|
1610000
|
heap
|
page read and write
|
||
|
52D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
14EE000
|
stack
|
page read and write
|
||
|
10FC000
|
trusted library allocation
|
page execute and read and write
|
||
|
EF6000
|
stack
|
page read and write
|
||
|
13CE000
|
stack
|
page read and write
|
||
|
1510000
|
heap
|
page read and write
|
||
|
55A000
|
heap
|
page read and write
|
||
|
DAE000
|
heap
|
page read and write
|
||
|
64E000
|
heap
|
page read and write
|
||
|
1130000
|
heap
|
page read and write
|
||
|
5C2000
|
heap
|
page read and write
|
||
|
648000
|
heap
|
page read and write
|
||
|
5DB000
|
heap
|
page read and write
|
||
|
10F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
5CA000
|
heap
|
page read and write
|
||
|
565E000
|
stack
|
page read and write
|
||
|
5CB000
|
heap
|
page read and write
|
||
|
5CE0000
|
heap
|
page read and write
|
||
|
1517000
|
trusted library allocation
|
page execute and read and write
|
||
|
5BD0000
|
heap
|
page read and write
|
||
|
5B20000
|
heap
|
page read and write
|
||
|
56BE000
|
stack
|
page read and write
|
||
|
55B0000
|
heap
|
page read and write
|
||
|
562000
|
heap
|
page read and write
|
||
|
4D17000
|
heap
|
page read and write
|
||
|
BAB000
|
stack
|
page read and write
|
||
|
649000
|
heap
|
page read and write
|
||
|
4257000
|
trusted library allocation
|
page read and write
|
||
|
4CE1000
|
heap
|
page read and write
|
||
|
D98000
|
heap
|
page read and write
|
||
|
1502000
|
trusted library allocation
|
page execute and read and write
|
||
|
5DB000
|
heap
|
page read and write
|
||
|
CF6000
|
stack
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
5AE000
|
heap
|
page read and write
|
||
|
5529000
|
stack
|
page read and write
|
||
|
10F2000
|
trusted library allocation
|
page execute and read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
59A000
|
heap
|
page read and write
|
||
|
594000
|
heap
|
page read and write
|
||
|
64A000
|
heap
|
page read and write
|
||
|
5350000
|
trusted library allocation
|
page read and write
|
||
|
5A4000
|
heap
|
page read and write
|
||
|
A00000
|
heap
|
page read and write
|
||
|
5DE000
|
heap
|
page read and write
|
||
|
565000
|
heap
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
59A000
|
heap
|
page read and write
|
||
|
643000
|
heap
|
page read and write
|
||
|
595000
|
heap
|
page read and write
|
||
|
4A8E000
|
stack
|
page read and write
|
||
|
E7A000
|
stack
|
page read and write
|
||
|
1320000
|
trusted library allocation
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
642000
|
heap
|
page read and write
|
||
|
5CF000
|
heap
|
page read and write
|
||
|
624000
|
heap
|
page read and write
|
||
|
5BF000
|
heap
|
page read and write
|
||
|
4CE0000
|
heap
|
page read and write
|
||
|
5D8000
|
heap
|
page read and write
|
||
|
550000
|
heap
|
page read and write
|
||
|
D90000
|
heap
|
page read and write
|
||
|
2FC1000
|
trusted library allocation
|
page read and write
|
||
|
7F9C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5A9000
|
heap
|
page read and write
|
||
|
10AA000
|
heap
|
page read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
1078000
|
heap
|
page read and write
|
||
|
4FB000
|
stack
|
page read and write
|
||
|
117B000
|
trusted library allocation
|
page execute and read and write
|
||
|
5CA000
|
heap
|
page read and write
|
||
|
59A000
|
heap
|
page read and write
|
||
|
4A90000
|
heap
|
page read and write
|
||
|
5AB000
|
heap
|
page read and write
|
||
|
5238000
|
trusted library allocation
|
page read and write
|
||
|
1260000
|
heap
|
page execute and read and write
|
||
|
1710000
|
trusted library allocation
|
page execute and read and write
|
||
|
601000
|
heap
|
page read and write
|
||
|
4D0D000
|
heap
|
page read and write
|
||
|
537E000
|
stack
|
page read and write
|
||
|
1170000
|
trusted library allocation
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
111D000
|
heap
|
page read and write
|
||
|
4D13000
|
heap
|
page read and write
|
||
|
4F4000
|
stack
|
page read and write
|
||
|
52CF000
|
stack
|
page read and write
|
||
|
5DB000
|
heap
|
page read and write
|
||
|
59D000
|
heap
|
page read and write
|
||
|
5D2000
|
heap
|
page read and write
|
||
|
660000
|
heap
|
page read and write
|
||
|
E9F000
|
stack
|
page read and write
|
||
|
116F000
|
heap
|
page read and write
|
||
|
1190000
|
trusted library allocation
|
page read and write
|
||
|
64C000
|
heap
|
page read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
F10000
|
heap
|
page read and write
|
||
|
5420000
|
trusted library allocation
|
page read and write
|
||
|
103F000
|
heap
|
page read and write
|
||
|
4D01000
|
heap
|
page read and write
|
||
|
5AC000
|
heap
|
page read and write
|
||
|
1120000
|
heap
|
page read and write
|
||
|
5C8000
|
heap
|
page read and write
|
||
|
649000
|
heap
|
page read and write
|
||
|
643000
|
heap
|
page read and write
|
||
|
1100000
|
trusted library allocation
|
page read and write
|
||
|
5CB000
|
heap
|
page read and write
|
||
|
4D11000
|
heap
|
page read and write
|
||
|
54E000
|
unkown
|
page read and write
|
||
|
1600000
|
trusted library allocation
|
page execute and read and write
|
||
|
1008000
|
heap
|
page read and write
|
||
|
4D0E000
|
heap
|
page read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
11A5000
|
heap
|
page read and write
|
||
|
4D07000
|
heap
|
page read and write
|
||
|
1146000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
54EC000
|
stack
|
page read and write
|
||
|
4D0C000
|
heap
|
page read and write
|
||
|
58F000
|
heap
|
page read and write
|
||
|
3FC1000
|
trusted library allocation
|
page read and write
|
||
|
14DA000
|
trusted library allocation
|
page execute and read and write
|
||
|
6A0000
|
heap
|
page read and write
|
||
|
1327000
|
trusted library allocation
|
page execute and read and write
|
||
|
5270000
|
heap
|
page read and write
|
||
|
55B3000
|
heap
|
page read and write
|
||
|
14EA000
|
trusted library allocation
|
page execute and read and write
|
||
|
137E000
|
stack
|
page read and write
|
||
|
15F0000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
heap
|
page read and write
|
||
|
109F000
|
stack
|
page read and write
|
||
|
10E2000
|
trusted library allocation
|
page execute and read and write
|
||
|
114C000
|
trusted library allocation
|
page execute and read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
59C000
|
heap
|
page read and write
|
||
|
BE0000
|
unkown
|
page readonly
|
||
|
1100000
|
heap
|
page read and write
|
||
|
641000
|
heap
|
page read and write
|
||
|
10EA000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FE000
|
stack
|
page read and write
|
||
|
5A9000
|
heap
|
page read and write
|
||
|
4231000
|
trusted library allocation
|
page read and write
|
||
|
4D02000
|
heap
|
page read and write
|
||
|
16CF000
|
trusted library allocation
|
page read and write
|
||
|
5A7000
|
heap
|
page read and write
|
||
|
5D8000
|
heap
|
page read and write
|
||
|
4134000
|
trusted library allocation
|
page read and write
|
||
|
55BE000
|
stack
|
page read and write
|
||
|
59A000
|
heap
|
page read and write
|
||
|
9DB000
|
stack
|
page read and write
|
||
|
643000
|
heap
|
page read and write
|
||
|
111A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1112000
|
trusted library allocation
|
page execute and read and write
|
||
|
539E000
|
stack
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
500000
|
heap
|
page read and write
|
||
|
1140000
|
trusted library allocation
|
page read and write
|
There are 325 hidden memdumps, click here to show them.