Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.98614836123111
Filename:	file.exe
Filesize:	321536
MD5:	f2d385ddbb2edafacd070f103f7f1576
SHA1:	5ee6cb80bc943476067c148e5c16738b7b062029
SHA256:	d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
SHA512:	e6ee00d15483ef29fb7e48ed28833ce5059f7bfada96b92c350246f6032f85d318571950bf6d2ee557e417e87d24d90965aa1523782416792fa7eb7354266df5
SSDEEP:	6144:8KNfu572RY1YNfnlxThJDfeDp7B9wNjudYHpHNHqQtb4qNp28Rrm:82Gt2RhNfz/u1B9wNSd0UQF4t8pm
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,..f............................~.... ........@.. .......................@............`................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains very large array initializations	System Summary	Disable or Modify Tools
.NET source code references suspicious native API functions	HIPS / PFW / Operating System Protection Evasion	Native API
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Binary may include packed or encrypted code	Data Obfuscation
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Contains functionality to modify the execution of threads in other processes
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse usering and debugging	Anti Debugging	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

CSV text

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
Category:	dropped
Dump:	file.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	CSV text
Entropy:	5.353683843266035
Encrypted:	false
Ssdeep:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
Size:	425
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\Public\Desktop\Google Chrome.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:17 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide

dropped

Details

File:	C:\Users\Public\Desktop\Google Chrome.lnk
Category:	dropped
Dump:	Google Chrome.lnk.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:17 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Entropy:	3.4664974039784013
Encrypted:	false
Ssdeep:	48:8SNd5TvGk0lRYrnvPdAKRkdAGdAKRFdAKR6P:8S5bH7
Size:	2104
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Category:	dropped
Dump:	RegAsm.exe.log.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3318368586986695
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
Size:	3274
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\Tmp5C55.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp5C55.tmp
Category:	dropped
Dump:	Tmp5C55.tmp.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\Tmp5C65.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Tmp5C65.tmp
Category:	dropped
Dump:	Tmp5C65.tmp.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Type:	data
Entropy:	7.8230547059446645
Encrypted:	false
Ssdeep:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
Size:	2662
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops certificate files (DER)	E-Banking Fraud

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
Category:	dropped
Dump:	76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Type:	data
Entropy:	0.0
Encrypted:	false
Ssdeep:	3::
Size:	2251
Whitelisted:	true
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	776
Target ID:	0
Parent PID:	4004
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	321536
MD5:	F2D385DDBB2EDAFACD070F103F7F1576
Time:	19:06:07
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x670000
Modulesize:	344064
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5308
Target ID:	3
Parent PID:	776
Name:	RegAsm.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Size:	65440
MD5:	0D5DF43AF2916F47D00C1573797C1A13
Time:	19:06:08
Date:	28/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xb0000
Modulesize:	73728
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2016
Target ID:	4
Parent PID:	776
Name:	RegAsm.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Size:	65440
MD5:	0D5DF43AF2916F47D00C1573797C1A13
Time:	19:06:08
Date:	28/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x4e0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	5716
Target ID:	1
Parent PID:	776
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	19:06:07
Date:	28/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff66e660000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

136.244.88.135:17615

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/Entity/Id8ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust

unknown

There are 90 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

136.244.88.135

unknown

United States

Details

IP:	136.244.88.135
TargetID:	4
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	20473
ASN name:	AS-CHOOPAUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064

Blob

Details

TargetID:	4
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Value name:	Blob
Value data:	0B 00 00 00 01 00 00 00 48 00 00 00 54 00 69 00 74 00 61 00 6E 00 69 00 75 00 6D 00 20 00 52 00 6F 00 6F 00 74 00 20 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 00 00 02 00 00 00 01 00 00 00 CC 00 00 00 1C 00 00 00 6C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7B 00 34 00 31 00 37 00 34 00 34 00 42 00 45 00 34 00 2D 00 31 00 31 00 43 00 35 00 2D 00 34 00 39 00 34 00 43 00 2D 00 41 00 32 00 31 00 33 00 2D 00 42 00 41 00 30 00 43 00 45 00 39 00 34 00 34 00 39 00 33 00 38 00 45 00 7D 00 00 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 45 00 6E 00 68 00 61 00 6E 00 63 00 65 00 64 00 20 00 43 00 72 00 79 00 70 00 74 00 6F 00 67 00 72 00 61 00 70 00 68 00 69 00 63 00 20 00 50 00 72 00 6F 00 76 00 69 00 64 00 65 00 72 00 20 00 76 00 31 00 2E 00 30 00 00 00 00 00 03 00 00 00 01 00 00 00 14 00 00 00 F1 A5 78 C4 CB 5D E7 9A 37 08 93 98 3F D4 DA 8B 67 B2 B0 64 20 00 00 00 01 00 00 00 0A 03 00 00 30 82 03 06 30 82 01 EE A0 03 02 01 02 02 08 67 F7 BE B9 6A 4C 27 98 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 1E 17 0D 32 33 30 33 31 34 31 30 33 35 32 30 5A 17 0D 32 36 30 36 31 37 31 30 33 35 32 30 5A 30 2E 31 2C 30 2A 06 03 55 04 03 0C 23 54 69 74 61 6E 69 75 6D 20 52 6F 6F 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6F 72 69 74 79 30 82 01 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0F 00 30 82 01 0A 02 82 01 01 00 86 E4 57 7A 58 61 CE 81 91 77 D0 05 FA 51 D5 51 5A 93 6C 61 0C CF CB DE 53 32 CD 15 1D A6 47 EE 88 1A 24 5C 9B 02 83 3B 02 AF 3D 76 FE 20 BD 3B FA F7 A2 09 73 E7 2E BD 94 40 D0 9D 8C 3D 27 13 BD F0 D0 9F EB 95 32 AC D7 A4 2D A2 A9 52 DA A8 6A 2A 88 EE 42 7D 30 95 9D 90 BF BA 05 27 6A A0 29 98 A6 98 6F C0 13 06 62 9B 79 B8 40 5D 1F 1F A6 D9 A4 2F 82 7A FC 75 66 34 0D C2 DE 27 01 2B 94 BB 4A 27 B3 CB 1C 21 9A 3C B2 C1 42 03 F3 44 51 BD 62 65 20 ED D4 DB CC 41 4F 59 3F 2A CB C4 84 79 F7 14 3C BE 13 9C FD 12 9C 91 3E 53 03 DC 20 F9 4C 44 35 89 01 B6 9A 84 8D 7E A0 2E 30 8A 31 15 60 AC 00 AE 00 9A 29 10 9A EE D9 71 3D D8 91 9B 97 ED 59 80 58 E1 7F 07 26 C7 A0 20 F7 10 AB C0 62 91 DF AA F1 81 C6 BE 6A 76 C8 9C B6 8E B0 B0 EC 1C D9 5F 32 6C 7E 55 58 8B FD 76 C5 19 02 03 01 00 01 A3 28 30 26 30 13 06 03 55 1D 25 04 0C 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0F 06 03 55 1D 13 01 01 FF 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 03 82 01 01 00 70 85 12 93 D7 57 E9 82 79 7D C5 F7 F2 7D A8 94 EF 0C DB 32 9F 06 A6 09 6E 0C F6 04 B0 E5 47 11 56 0E F4 0F 52 82 08 2E 21 0F 55 A3 DB 41 F3 12 54 8B 76 11 F5 F0 DA CE A3 C7 8B 13 F6 FC 24 3C 02 B1 06 66 5B E6 9E 18 40 88 41 5B 27 39 99 B8 77 BE E3 53 A2 48 CE C7 EE B5 A0 95 C2 17 4B C9 52 6C AF E3 37 2C 59 DB FB E7 58 13 4E D3 51 E5 14 72 73 FE C6 85 77 AE 45 52 A6 F9 9A C8 0C A8 D0 EE 42 2A F5 28 85 8C 6B E8 1C B0 A8 03 1A B0 AE 83 C0 EB 55 64 F4 E8 7A 5C 06 29 5D 39 03 EE E2 FD F9 2D 62 A7 F4 D4 05 4D EA A7 9B CA EB DA 4E 8B 1A 6E FD 42 AE F9 D0 1C 70 75 72 8C B1 3A A8 55 7C 85 A7 25 32 B5 E2 D6 C3 E5 50 41 C9 86 7C A8 F5 62 BB D2 AB 0C 37 10 D8 31 73 EC 37 81 D1 DC AA C5 C6 E0 7E E7 26 62 4D FD C5 81 4C FF D3 36 E1 79 32 F8 9B EB 9C F7 FD BE E9 BE BF 61

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

remote allocation

page execute and read and write

3975000

trusted library allocation

page read and write

53DE000

stack

page read and write

6740000

trusted library allocation

page execute and read and write

D2F000

heap

page read and write

908B000

heap

page read and write

E97000

trusted library allocation

page execute and read and write

64D0000

trusted library allocation

page read and write

2A04000

trusted library allocation

page read and write

8F6F000

heap

page read and write

6AF0000

trusted library allocation

page execute and read and write

528C000

heap

page read and write

CA4000

trusted library allocation

page read and write

6BB5000

trusted library allocation

page read and write

85CE000

stack

page read and write

8FB4000

heap

page read and write

2A1B000

trusted library allocation

page read and write

28FE000

trusted library allocation

page read and write

6B6E000

stack

page read and write

2D07000

trusted library allocation

page read and write

5A2E000

heap

page read and write

6A69000

trusted library allocation

page read and write

1000000

heap

page read and write

61E0000

trusted library allocation

page execute and read and write

2D61000

trusted library allocation

page read and write

2AB0000

trusted library allocation

page read and write

37F2000

trusted library allocation

page read and write

6BB0000

trusted library allocation

page read and write

6B80000

trusted library allocation

page read and write

8FF9000

heap

page read and write

690E000

stack

page read and write

E82000

trusted library allocation

page read and write

8F9B000

heap

page read and write

C94000

heap

page read and write

4CD6000

trusted library allocation

page read and write

6A94000

trusted library allocation

page read and write

6B10000

trusted library allocation

page read and write

8FA6000

heap

page read and write

2D82000

trusted library allocation

page read and write

6671000

trusted library allocation

page read and write

6B90000

trusted library allocation

page execute and read and write

446000

remote allocation

page execute and read and write

51BC000

heap

page read and write

6AC0000

trusted library allocation

page read and write

BF5000

heap

page read and write

9023000

heap

page read and write

53F0000

heap

page read and write

A20000

heap

page read and write

2CF6000

trusted library allocation

page read and write

4D90000

heap

page read and write

6720000

trusted library allocation

page read and write

E9B000

trusted library allocation

page execute and read and write

2D1F000

trusted library allocation

page read and write

9066000

heap

page read and write

670000

unkown

page readonly

2D02000

trusted library allocation

page read and write

539E000

stack

page read and write

7C0000

heap

page read and write

6A7F000

trusted library allocation

page read and write

8F81000

heap

page read and write

8560000

trusted library allocation

page read and write

4FCE000

stack

page read and write

6A3A000

trusted library allocation

page read and write

6200000

trusted library allocation

page execute and read and write

47D8000

trusted library allocation

page read and write

C6E000

stack

page read and write

2A26000

trusted library allocation

page read and write

9060000

heap

page read and write

53E0000

heap

page read and write

2973000

trusted library allocation

page read and write

6BB7000

trusted library allocation

page read and write

D15000

heap

page read and write

907C000

heap

page read and write

4CF0000

trusted library allocation

page read and write

D6B000

heap

page read and write

529E000

heap

page read and write

F3C000

stack

page read and write

5BFE000

stack

page read and write

9088000

heap

page read and write

CB9000

heap

page read and write

6730000

trusted library allocation

page read and write

C40000

heap

page read and write

8F7E000

heap

page read and write

519F000

stack

page read and write

E7D000

trusted library allocation

page execute and read and write

CCB000

trusted library allocation

page execute and read and write

4CB4000

trusted library allocation

page read and write

6C6E000

trusted library allocation

page read and write

8F90000

heap

page read and write

F50000

heap

page execute and read and write

5220000

heap

page read and write

5F3F000

stack

page read and write

67A0000

heap

page execute and read and write

6C70000

trusted library allocation

page read and write

2D53000

trusted library allocation

page read and write

4D15000

trusted library allocation

page read and write

2879000

trusted library allocation

page read and write

4CB0000

trusted library allocation

page read and write

E70000

trusted library allocation

page read and write

4D00000

trusted library allocation

page read and write

4CE2000

trusted library allocation

page read and write

27A0000

trusted library allocation

page read and write

4D20000

trusted library allocation

page read and write

2A00000

trusted library allocation

page read and write

853F000

stack

page read and write

6B70000

trusted library allocation

page read and write

8F79000

heap

page read and write

298C000

trusted library allocation

page read and write

A84000

trusted library allocation

page read and write

4E93000

heap

page read and write

EB0000

trusted library allocation

page read and write

D0E000

heap

page read and write

6A90000

trusted library allocation

page read and write

66D0000

trusted library allocation

page read and write

6770000

trusted library allocation

page read and write

902A000

heap

page read and write

2A0C000

trusted library allocation

page read and write

4D0E000

trusted library allocation

page read and write

6A8F000

trusted library allocation

page read and write

51A8000

heap

page read and write

962E000

stack

page read and write

CF0000

trusted library allocation

page execute and read and write

2CEC000

trusted library allocation

page read and write

267E000

stack

page read and write

39B8000

trusted library allocation

page read and write

D42000

heap

page read and write

27C0000

heap

page read and write

BF0000

heap

page read and write

A2A000

heap

page read and write

2971000

trusted library allocation

page execute and read and write

E86000

trusted library allocation

page execute and read and write

2DA9000

trusted library allocation

page read and write

6C60000

trusted library allocation

page read and write

C94000

trusted library allocation

page read and write

6A7A000

trusted library allocation

page read and write

4D4E000

trusted library allocation

page read and write

7D0000

heap

page read and write

A90000

heap

page read and write

37D1000

trusted library allocation

page read and write

4CD1000

trusted library allocation

page read and write

C70000

heap

page read and write

6A0C000

stack

page read and write

5093000

heap

page execute and read and write

6790000

trusted library allocation

page read and write

6C50000

trusted library allocation

page read and write

A95000

heap

page read and write

2D99000

trusted library allocation

page read and write

5090000

heap

page execute and read and write

2D55000

trusted library allocation

page read and write

649C000

stack

page read and write

6760000

trusted library allocation

page execute and read and write

9190000

heap

page read and write

6C6A000

trusted library allocation

page read and write

D34000

heap

page read and write

9017000

heap

page read and write

62D0000

trusted library allocation

page read and write

6660000

trusted library allocation

page read and write

972E000

stack

page read and write

6C65000

trusted library allocation

page read and write

7FBA0000

trusted library allocation

page execute and read and write

2D42000

trusted library allocation

page read and write

F40000

trusted library allocation

page execute and read and write

D26000

heap

page read and write

400000

remote allocation

page execute and read and write

2906000

trusted library allocation

page read and write

6A62000

trusted library allocation

page read and write

CA6000

trusted library allocation

page read and write

5230000

heap

page read and write

2940000

heap

page read and write

27EE000

stack

page read and write

8FAC000

heap

page read and write

28F0000

heap

page execute and read and write

D1D000

heap

page read and write

4E90000

heap

page read and write

D00000

heap

page read and write

67C0000

trusted library allocation

page read and write

51F8000

heap

page read and write

CA0000

trusted library allocation

page read and write

2D4B000

trusted library allocation

page read and write

2A14000

trusted library allocation

page read and write

666B000

trusted library allocation

page read and write

6B74000

trusted library allocation

page read and write

64C0000

trusted library allocation

page execute and read and write

2780000

heap

page read and write

4CDD000

trusted library allocation

page read and write

2D7B000

trusted library allocation

page read and write

F60000

heap

page read and write

6B20000

trusted library allocation

page execute and read and write

BE0000

trusted library allocation

page read and write

75C000

stack

page read and write

543E000

stack

page read and write

E80000

trusted library allocation

page read and write

E92000

trusted library allocation

page read and write

EFE000

stack

page read and write

5212000

heap

page read and write

507E000

stack

page read and write

E8A000

trusted library allocation

page execute and read and write

9072000

heap

page read and write

F67000

heap

page read and write

6A8A000

trusted library allocation

page read and write

8F63000

heap

page read and write

E6F000

stack

page read and write

665E000

stack

page read and write

496C000

stack

page read and write

4E50000

trusted library allocation

page execute and read and write

986E000

stack

page read and write

2D94000

trusted library allocation

page read and write

5F0000

heap

page read and write

2A12000

trusted library allocation

page read and write

66B0000

trusted library allocation

page read and write

62E0000

trusted library allocation

page read and write

A6E000

stack

page read and write

D4E000

heap

page read and write

95ED000

stack

page read and write

66A0000

trusted library allocation

page read and write

A70000

trusted library allocation

page read and write

37DF000

trusted library allocation

page read and write

6780000

trusted library allocation

page read and write

68CC000

stack

page read and write

67B0000

trusted library allocation

page execute and read and write

D5E000

heap

page read and write

432000

remote allocation

page execute and read and write

27B0000

trusted library allocation

page read and write

2912000

trusted library allocation

page read and write

FFF000

stack

page read and write

C93000

trusted library allocation

page execute and read and write

EFF000

stack

page read and write

6140000

trusted library allocation

page read and write

2902000

trusted library allocation

page read and write

92CB000

stack

page read and write

4D10000

trusted library allocation

page read and write

C7B000

heap

page read and write

5440000

trusted library allocation

page read and write

6750000

trusted library allocation

page execute and read and write

603E000

stack

page read and write

6AA8000

trusted library allocation

page read and write

8F99000

heap

page read and write

5A26000

heap

page read and write

8FCC000

heap

page read and write

28EE000

stack

page read and write

6A65000

trusted library allocation

page read and write

6AB0000

trusted library allocation

page read and write

918E000

stack

page read and write

8F8D000

heap

page read and write

8F50000

heap

page read and write

668E000

trusted library allocation

page read and write

2D9E000

trusted library allocation

page read and write

4CBB000

trusted library allocation

page read and write

2DB5000

trusted library allocation

page read and write

2CFD000

trusted library allocation

page read and write

51E2000

heap

page read and write

62E5000

trusted library allocation

page read and write

A25000

heap

page read and write

2D8D000

trusted library allocation

page read and write

4B0D000

stack

page read and write

8F7000

stack

page read and write

613E000

stack

page read and write

6676000

trusted library allocation

page read and write

51B0000

heap

page read and write

8F53000

heap

page read and write

A8D000

trusted library allocation

page execute and read and write

27D1000

trusted library allocation

page read and write

9300000

heap

page read and write

66C0000

trusted library allocation

page execute and read and write

8540000

trusted library allocation

page read and write

62EA000

trusted library allocation

page read and write

A83000

trusted library allocation

page execute and read and write

C8E000

stack

page read and write

6150000

trusted library allocation

page read and write

58A000

stack

page read and write

64A0000

trusted library allocation

page read and write

2D6E000

trusted library allocation

page read and write

D2C000

heap

page read and write

3971000

trusted library allocation

page read and write

3913000

trusted library allocation

page read and write

A80000

trusted library allocation

page read and write

E95000

trusted library allocation

page execute and read and write

4E50000

trusted library allocation

page read and write

8F77000

heap

page read and write

4D80000

heap

page read and write

E90000

trusted library allocation

page read and write

6682000

trusted library allocation

page read and write

6A60000

trusted library allocation

page read and write

2A08000

trusted library allocation

page read and write

639A000

stack

page read and write

5A12000

heap

page read and write

5448000

trusted library allocation

page read and write

6B00000

trusted library allocation

page execute and read and write

4DA2000

trusted library allocation

page read and write

6A85000

trusted library allocation

page read and write

6B1D000

trusted library allocation

page read and write

6BB9000

trusted library allocation

page read and write

5C3E000

stack

page read and write

2A34000

trusted library allocation

page read and write

3950000

trusted library allocation

page read and write

2A0E000

trusted library allocation

page read and write

277E000

stack

page read and write

9050000

heap

page read and write

2DE4000

trusted library allocation

page read and write

655E000

stack

page read and write

5C7E000

stack

page read and write

29F8000

trusted library allocation

page read and write

D51000

heap

page read and write

5269000

heap

page read and write

C3E000

stack

page read and write

672000

unkown

page readonly

2D12000

trusted library allocation

page read and write

8F59000

heap

page read and write

2A32000

trusted library allocation

page read and write

91A0000

heap

page read and write

8750000

trusted library allocation

page read and write

976E000

stack

page read and write

4CCE000

trusted library allocation

page read and write

2A23000

trusted library allocation

page read and write

6AA0000

trusted library allocation

page read and write

9D0000

heap

page read and write

6A30000

trusted library allocation

page read and write

AF8000

stack

page read and write

4DA0000

trusted library allocation

page read and write

293D000

stack

page read and write

51A0000

heap

page read and write

2960000

heap

page read and write

4D40000

trusted library allocation

page read and write

437000

remote allocation

page execute and read and write

6A37000

trusted library allocation

page read and write

62E8000

trusted library allocation

page read and write

CA8000

heap

page read and write

D08000

heap

page read and write

6A78000

trusted library allocation

page read and write

651C000

stack

page read and write

There are 320 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

IPs

Registry

Memdumps

IOC Report
file.exe