IOC Report
eFvQTTtxej.exe

loading gif

Files

File Path
Type
Category
Malicious
eFvQTTtxej.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\eFvQTTtxej.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Client.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\eFvQTTtxej.exe
"C:\Users\user\Desktop\eFvQTTtxej.exe"
 malicious
C:\Users\user\AppData\Local\Temp\Client.exe
"C:\Users\user\AppData\Local\Temp\Client.exe"
malicious

URLs

Name
IP
Malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown
https://www.youtube.com/watch?v=Ji9IwPId5UkPThis
unknown

Domains

Name
IP
Malicious
22.ip.gl.ply.gg
147.185.221.22
 malicious

IPs

IP
Domain
Country
Malicious
147.185.221.22
22.ip.gl.ply.gg
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
 malicious
HKEY_CURRENT_USER\SOFTWARE\Client.exe
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
2D31000
trusted library allocation
page read and write
 malicious
2C01000
trusted library allocation
page read and write
 malicious
E6A000
trusted library allocation
page execute and read and write
564E000
stack
page read and write
A4F000
heap
page read and write
E40000
trusted library allocation
page read and write
C10000
heap
page read and write
E52000
trusted library allocation
page execute and read and write
9BE000
stack
page read and write
4E4C000
stack
page read and write
702000
unkown
page readonly
4E80000
heap
page read and write
AF6000
stack
page read and write
E5A000
trusted library allocation
page execute and read and write
AB8000
heap
page read and write
D40000
trusted library allocation
page read and write
F3C000
stack
page read and write
D10000
heap
page read and write
50A0000
heap
page read and write
4DCC000
stack
page read and write
F78000
trusted library allocation
page read and write
950000
heap
page read and write
D82000
trusted library allocation
page execute and read and write
D97000
trusted library allocation
page execute and read and write
F40000
trusted library allocation
page read and write
5A0E000
stack
page read and write
D8A000
trusted library allocation
page execute and read and write
1090000
trusted library allocation
page read and write
10DE000
stack
page read and write
1140000
heap
page read and write
112E000
stack
page read and write
970000
heap
page read and write
72C000
unkown
page readonly
D5A000
trusted library allocation
page execute and read and write
4E60000
trusted library allocation
page read and write
54A0000
heap
page read and write
E62000
trusted library allocation
page execute and read and write
EEF000
heap
page read and write
DB6000
heap
page read and write
53CE000
stack
page read and write
ACC000
heap
page read and write
3C30000
trusted library allocation
page read and write
28BE000
stack
page read and write
EFE000
stack
page read and write
4EA0000
trusted library allocation
page execute and read and write
590E000
stack
page read and write
550F000
stack
page read and write
568E000
stack
page read and write
DF0000
heap
page read and write
5570000
heap
page read and write
4EF0000
trusted library allocation
page read and write
A9E000
heap
page read and write
702000
unkown
page readonly
29EE000
stack
page read and write
D77000
trusted library allocation
page execute and read and write
4E50000
trusted library allocation
page execute and read and write
4CFE000
stack
page read and write
57CC000
stack
page read and write
72E000
unkown
page readonly
8F9000
stack
page read and write
4D20000
trusted library allocation
page execute and read and write
D7A000
trusted library allocation
page execute and read and write
2C5E000
trusted library allocation
page read and write
4F50000
unclassified section
page read and write
E6C000
trusted library allocation
page execute and read and write
975000
heap
page read and write
4E83000
heap
page read and write
A81000
heap
page read and write
528E000
stack
page read and write
D62000
trusted library allocation
page execute and read and write
4D10000
trusted library allocation
page read and write
E8A000
heap
page read and write
DEF000
stack
page read and write
D92000
trusted library allocation
page read and write
5490000
heap
page read and write
4F00000
trusted library allocation
page execute and read and write
CB0000
heap
page read and write
1097000
trusted library allocation
page execute and read and write
5EA000
stack
page read and write
960000
heap
page read and write
1082000
trusted library allocation
page execute and read and write
1010000
heap
page execute and read and write
DB0000
heap
page read and write
4FAE000
stack
page read and write
554E000
stack
page read and write
D9B000
trusted library allocation
page execute and read and write
E80000
heap
page read and write
CDE000
stack
page read and write
F32000
heap
page read and write
E60000
trusted library allocation
page read and write
CA0000
heap
page execute and read and write
CF0000
heap
page read and write
E67000
trusted library allocation
page execute and read and write
EA6000
heap
page read and write
8F6000
stack
page read and write
CE5000
heap
page read and write
700000
unkown
page readonly
3D31000
trusted library allocation
page read and write
5070000
trusted library allocation
page execute and read and write
578E000
stack
page read and write
A18000
heap
page read and write
706000
unkown
page readonly
CE0000
heap
page read and write
F1B000
heap
page read and write
518E000
stack
page read and write
C9D000
stack
page read and write
A10000
heap
page read and write
D52000
trusted library allocation
page execute and read and write
50AF000
stack
page read and write
4EE9000
stack
page read and write
4ECF000
stack
page read and write
71B000
unkown
page readonly
109B000
trusted library allocation
page execute and read and write
7CB000
stack
page read and write
C5E000
stack
page read and write
540E000
stack
page read and write
E20000
heap
page read and write
EBE000
heap
page read and write
E8E000
heap
page read and write
4E90000
trusted library allocation
page execute and read and write
D60000
trusted library allocation
page read and write
1130000
trusted library allocation
page read and write
52CE000
stack
page read and write
3C01000
trusted library allocation
page read and write
F60000
heap
page read and write
7F2F0000
trusted library allocation
page execute and read and write
A1E000
heap
page read and write
107E000
stack
page read and write
58CC000
stack
page read and write
B30000
heap
page read and write
4E0B000
stack
page read and write
There are 121 hidden memdumps, click here to show them.