IOC Report
.05.2024.exe

loading gif

Files

File Path
Type
Category
Malicious
.05.2024.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\.05.2024.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xusvxm1.sgs.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hiw2simt.mfn.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hj0k2r1s.ffs.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ombvvhhf.taa.ps1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\.05.2024.exe
"C:\Users\user\Desktop\.05.2024.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\.05.2024.exe"
 malicious
C:\Users\user\Desktop\.05.2024.exe
"C:\Users\user\Desktop\.05.2024.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
https://api.telegram.org/bot6783395654:AAGHZk1wugh441q673h1nDNWiVYW4p6ewXc/sendDocument?chat_id=-4209622687&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake
149.154.167.220
 malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot
unknown
 malicious
https://api.telegram
unknown
 malicious
http://checkip.dyndns.org/
193.122.130.0
https://api.telegram.org/botx
unknown
http://api.telegram.orgx
unknown
https://api.telegram.org/bot6783395654:AAGHZk1wugh441q673h1nDNWiVYW4p6ewXc/sendDocument?chat_id=-420
unknown
http://checkip.dyndns.org/q
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
api.telegram.org
149.154.167.220
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.130.0

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
193.122.130.0
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
357C000
trusted library allocation
page read and write
 malicious
278C000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
26D1000
trusted library allocation
page read and write
 malicious
4D50000
trusted library allocation
page read and write
4974000
trusted library allocation
page read and write
CB0000
trusted library allocation
page read and write
78A000
trusted library allocation
page execute and read and write
4970000
trusted library allocation
page read and write
AE0000
trusted library allocation
page read and write
2768000
trusted library allocation
page read and write
27E6000
trusted library allocation
page read and write
2BE6000
trusted library allocation
page read and write
9DE000
stack
page read and write
B5A000
heap
page read and write
2A06000
trusted library allocation
page read and write
806000
heap
page read and write
2BEE000
trusted library allocation
page read and write
280F000
trusted library allocation
page read and write
4D22000
trusted library allocation
page read and write
27A2000
trusted library allocation
page read and write
B07000
heap
page read and write
5330000
trusted library allocation
page read and write
76D000
trusted library allocation
page execute and read and write
272F000
trusted library allocation
page read and write
486E000
stack
page read and write
2784000
trusted library allocation
page read and write
EC0000
heap
page read and write
422000
remote allocation
page execute and read and write
AC5000
heap
page read and write
50DF000
stack
page read and write
4963000
heap
page read and write
2BBE000
trusted library allocation
page read and write
8B6000
heap
page read and write
9660000
trusted library allocation
page execute and read and write
6510000
trusted library allocation
page read and write
2774000
trusted library allocation
page read and write
27D6000
trusted library allocation
page read and write
CE2000
trusted library allocation
page read and write
6A70000
heap
page read and write
2C0E000
trusted library allocation
page read and write
6A79000
heap
page read and write
4CFB000
trusted library allocation
page read and write
26B0000
trusted library allocation
page read and write
273E000
trusted library allocation
page read and write
9880000
heap
page read and write
241F000
stack
page read and write
9645000
trusted library allocation
page read and write
3489000
trusted library allocation
page read and write
36D1000
trusted library allocation
page read and write
987D000
stack
page read and write
4A30000
trusted library allocation
page execute and read and write
CD0000
trusted library allocation
page read and write
CE7000
trusted library allocation
page execute and read and write
1A2000
unkown
page readonly
6550000
trusted library allocation
page execute and read and write
703E000
stack
page read and write
CF0000
heap
page read and write
2C0A000
trusted library allocation
page read and write
6A60000
heap
page read and write
29E6000
trusted library allocation
page read and write
2A36000
trusted library allocation
page read and write
A3E000
stack
page read and write
27FB000
trusted library allocation
page read and write
4A40000
trusted library allocation
page read and write
282B000
trusted library allocation
page read and write
5100000
trusted library allocation
page read and write
AF0000
heap
page execute and read and write
29D6000
trusted library allocation
page read and write
2A3A000
trusted library allocation
page read and write
764000
trusted library allocation
page read and write
4428000
trusted library allocation
page read and write
B29000
heap
page read and write
4A42000
trusted library allocation
page read and write
3755000
trusted library allocation
page read and write
AAD000
heap
page read and write
27FF000
trusted library allocation
page read and write
50AE000
stack
page read and write
73C71000
unkown
page execute read
60AB000
heap
page read and write
2690000
heap
page execute and read and write
4E6D000
stack
page read and write
27DA000
trusted library allocation
page read and write
2827000
trusted library allocation
page read and write
4B50000
heap
page execute and read and write
2C1A000
trusted library allocation
page read and write
2670000
trusted library allocation
page read and write
29EE000
trusted library allocation
page read and write
4F70000
heap
page read and write
5348000
trusted library allocation
page read and write
61BF000
stack
page read and write
49B0000
trusted library allocation
page read and write
2850000
trusted library allocation
page read and write
2310000
heap
page read and write
498E000
trusted library allocation
page read and write
B86000
heap
page read and write
534B000
trusted library allocation
page read and write
9D3E000
stack
page read and write
4D8D000
stack
page read and write
2BF2000
trusted library allocation
page read and write
2BC6000
trusted library allocation
page read and write
96AD000
stack
page read and write
64E0000
trusted library allocation
page read and write
99BE000
stack
page read and write
4D0E000
trusted library allocation
page read and write
2BDA000
trusted library allocation
page read and write
9EBB000
stack
page read and write
64C0000
trusted library allocation
page execute and read and write
6A83000
heap
page read and write
2AB7000
trusted library allocation
page read and write
CD6000
trusted library allocation
page execute and read and write
62FE000
stack
page read and write
4D65000
heap
page read and write
AB9000
heap
page read and write
920000
heap
page read and write
60B5000
heap
page read and write
3421000
trusted library allocation
page read and write
2BE2000
trusted library allocation
page read and write
4D0A000
trusted library allocation
page read and write
CDA000
trusted library allocation
page execute and read and write
80A000
heap
page read and write
22F0000
heap
page read and write
6B0000
heap
page read and write
4996000
trusted library allocation
page read and write
CB4000
trusted library allocation
page read and write
497B000
trusted library allocation
page read and write
27E2000
trusted library allocation
page read and write
120000
unkown
page readonly
50F0000
trusted library section
page read and write
65D0000
heap
page read and write
64F0000
trusted library allocation
page read and write
CE5000
trusted library allocation
page execute and read and write
2A22000
trusted library allocation
page read and write
45FC000
stack
page read and write
A70000
heap
page read and write
2BB2000
trusted library allocation
page read and write
6A87000
heap
page read and write
713E000
stack
page read and write
6BAE000
stack
page read and write
22EE000
stack
page read and write
773000
trusted library allocation
page read and write
763000
trusted library allocation
page execute and read and write
3739000
trusted library allocation
page read and write
63BE000
stack
page read and write
282F000
trusted library allocation
page read and write
29DE000
trusted library allocation
page read and write
60D9000
heap
page read and write
CBD000
trusted library allocation
page execute and read and write
2764000
trusted library allocation
page read and write
2BEA000
trusted library allocation
page read and write
786000
trusted library allocation
page execute and read and write
27EF000
trusted library allocation
page read and write
2864000
trusted library allocation
page read and write
60F6000
heap
page read and write
617D000
stack
page read and write
2421000
trusted library allocation
page read and write
77D000
trusted library allocation
page execute and read and write
2A0E000
trusted library allocation
page read and write
68FE000
stack
page read and write
A0FE000
stack
page read and write
29E2000
trusted library allocation
page read and write
292C000
trusted library allocation
page read and write
81F000
heap
page read and write
5EFE000
stack
page read and write
7E0000
heap
page read and write
6A7B000
heap
page read and write
814000
heap
page read and write
891000
heap
page read and write
60ED000
heap
page read and write
611D000
heap
page read and write
50EE000
stack
page read and write
280B000
trusted library allocation
page read and write
2813000
trusted library allocation
page read and write
2C1E000
trusted library allocation
page read and write
4CFE000
trusted library allocation
page read and write
2BFE000
trusted library allocation
page read and write
A98000
heap
page read and write
64E9000
trusted library allocation
page read and write
4D60000
heap
page read and write
4B20000
trusted library section
page readonly
29F6000
trusted library allocation
page read and write
537000
stack
page read and write
29FE000
trusted library allocation
page read and write
9C3E000
stack
page read and write
6CB0000
trusted library section
page read and write
499D000
trusted library allocation
page read and write
C8E000
stack
page read and write
A110000
trusted library allocation
page read and write
CA0000
trusted library allocation
page read and write
2680000
trusted library allocation
page read and write
29CE000
trusted library allocation
page read and write
2C12000
trusted library allocation
page read and write
4991000
trusted library allocation
page read and write
2C02000
trusted library allocation
page read and write
2BD6000
trusted library allocation
page read and write
2A1E000
trusted library allocation
page read and write
EA0000
trusted library allocation
page read and write
603F000
stack
page read and write
49A2000
trusted library allocation
page read and write
2BC2000
trusted library allocation
page read and write
61FE000
stack
page read and write
4D90000
heap
page read and write
4D1D000
trusted library allocation
page read and write
2729000
trusted library allocation
page read and write
2A02000
trusted library allocation
page read and write
27F7000
trusted library allocation
page read and write
770000
trusted library allocation
page read and write
797000
trusted library allocation
page execute and read and write
49C0000
trusted library allocation
page read and write
67BE000
stack
page read and write
9FFE000
stack
page read and write
612D000
heap
page read and write
863000
heap
page read and write
73E000
stack
page read and write
9640000
trusted library allocation
page read and write
9AFE000
stack
page read and write
6FE000
stack
page read and write
261F000
stack
page read and write
400000
remote allocation
page execute and read and write
6500000
trusted library allocation
page execute and read and write
2760000
trusted library allocation
page read and write
3449000
trusted library allocation
page read and write
5A0000
heap
page read and write
2BAE000
trusted library allocation
page read and write
60CA000
heap
page read and write
A90000
heap
page read and write
2919000
trusted library allocation
page read and write
79B000
trusted library allocation
page execute and read and write
2C22000
trusted library allocation
page read and write
6B5000
heap
page read and write
2A12000
trusted library allocation
page read and write
CCD000
trusted library allocation
page execute and read and write
7EE000
heap
page read and write
29CA000
trusted library allocation
page read and write
276C000
trusted library allocation
page read and write
2BCE000
trusted library allocation
page read and write
2BBA000
trusted library allocation
page read and write
73C86000
unkown
page readonly
281F000
trusted library allocation
page read and write
2823000
trusted library allocation
page read and write
271F000
trusted library allocation
page read and write
CC0000
trusted library allocation
page read and write
2A1A000
trusted library allocation
page read and write
4EE0000
heap
page read and write
73C70000
unkown
page readonly
4F90000
heap
page read and write
439000
stack
page read and write
2A26000
trusted library allocation
page read and write
4950000
trusted library allocation
page read and write
2BB6000
trusted library allocation
page read and write
B80000
heap
page read and write
680000
heap
page read and write
2BF6000
trusted library allocation
page read and write
2931000
trusted library allocation
page read and write
4C90000
trusted library allocation
page execute and read and write
251E000
stack
page read and write
9FBC000
stack
page read and write
49E0000
trusted library allocation
page read and write
3429000
trusted library allocation
page read and write
285A000
trusted library allocation
page read and write
64BE000
stack
page read and write
29D2000
trusted library allocation
page read and write
6CAE000
stack
page read and write
2D08000
trusted library allocation
page read and write
7C0000
trusted library allocation
page read and write
B00000
heap
page read and write
6A90000
heap
page read and write
5345000
trusted library allocation
page read and write
4C8C000
stack
page read and write
44FC000
stack
page read and write
284B000
trusted library allocation
page read and write
7D0000
trusted library allocation
page execute and read and write
9BFE000
stack
page read and write
281B000
trusted library allocation
page read and write
2A2A000
trusted library allocation
page read and write
4CB1000
trusted library allocation
page read and write
376A000
trusted library allocation
page read and write
6640000
heap
page read and write
2770000
trusted library allocation
page read and write
6070000
heap
page read and write
2817000
trusted library allocation
page read and write
275C000
trusted library allocation
page read and write
36F9000
trusted library allocation
page read and write
277C000
trusted library allocation
page read and write
4C2E000
stack
page read and write
4BEE000
stack
page read and write
2660000
trusted library allocation
page read and write
5F0000
heap
page read and write
2BCA000
trusted library allocation
page read and write
4F7E000
heap
page read and write
EB0000
trusted library allocation
page execute and read and write
64D0000
trusted library allocation
page execute and read and write
2DF1000
trusted library allocation
page read and write
7B0000
heap
page read and write
6530000
trusted library allocation
page execute and read and write
27EB000
trusted library allocation
page read and write
4940000
trusted library allocation
page read and write
6083000
heap
page read and write
652E000
trusted library allocation
page read and write
4E80000
heap
page read and write
2BDE000
trusted library allocation
page read and write
8F7000
stack
page read and write
73C8F000
unkown
page readonly
122000
unkown
page readonly
6540000
trusted library allocation
page read and write
60E5000
heap
page read and write
6135000
heap
page read and write
609E000
heap
page read and write
4D16000
trusted library allocation
page read and write
2803000
trusted library allocation
page read and write
2780000
trusted library allocation
page read and write
6A69000
heap
page read and write
A120000
trusted library allocation
page read and write
2A0A000
trusted library allocation
page read and write
CB3000
trusted library allocation
page execute and read and write
60D0000
heap
page read and write
29F2000
trusted library allocation
page read and write
2471000
trusted library allocation
page read and write
4CF0000
trusted library allocation
page read and write
2A32000
trusted library allocation
page read and write
4AF0000
trusted library allocation
page read and write
2A2E000
trusted library allocation
page read and write
2BD2000
trusted library allocation
page read and write
2AC4000
trusted library allocation
page read and write
750000
trusted library allocation
page read and write
26C0000
heap
page read and write
283D000
trusted library allocation
page read and write
4B30000
heap
page read and write
49B5000
trusted library allocation
page read and write
2C06000
trusted library allocation
page read and write
5F3E000
stack
page read and write
27D2000
trusted library allocation
page read and write
4960000
heap
page read and write
60FF000
heap
page read and write
782000
trusted library allocation
page read and write
375E000
trusted library allocation
page read and write
2807000
trusted library allocation
page read and write
6520000
trusted library allocation
page read and write
9ABE000
stack
page read and write
CEB000
trusted library allocation
page execute and read and write
821000
heap
page read and write
6A94000
heap
page read and write
60AF000
heap
page read and write
2A16000
trusted library allocation
page read and write
5340000
trusted library allocation
page read and write
4D11000
trusted library allocation
page read and write
29EA000
trusted library allocation
page read and write
5A9000
stack
page read and write
73C8D000
unkown
page read and write
6A8B000
heap
page read and write
69FF000
stack
page read and write
60CD000
heap
page read and write
6F90000
trusted library section
page read and write
27DE000
trusted library allocation
page read and write
2CFC000
trusted library allocation
page read and write
760000
trusted library allocation
page read and write
273A000
trusted library allocation
page read and write
CD2000
trusted library allocation
page read and write
7FF000
heap
page read and write
68BF000
stack
page read and write
4B40000
heap
page read and write
6040000
heap
page read and write
46D8000
trusted library allocation
page read and write
2855000
trusted library allocation
page read and write
2BFA000
trusted library allocation
page read and write
50E0000
heap
page execute and read and write
5F5000
heap
page read and write
29FA000
trusted library allocation
page read and write
2C16000
trusted library allocation
page read and write
5DFE000
stack
page read and write
4A20000
heap
page read and write
2674000
trusted library allocation
page read and write
29DA000
trusted library allocation
page read and write
2742000
trusted library allocation
page read and write
27F3000
trusted library allocation
page read and write
7F410000
trusted library allocation
page execute and read and write
2A3E000
trusted library allocation
page read and write
49A0000
trusted library allocation
page read and write
4D93000
heap
page read and write
265C000
stack
page read and write
4CF6000
trusted library allocation
page read and write
2B5F000
trusted library allocation
page read and write
A40000
heap
page read and write
2778000
trusted library allocation
page read and write
4E70000
heap
page read and write
ADF000
stack
page read and write
4CC0000
heap
page read and write
There are 377 hidden memdumps, click here to show them.