IOC Report
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XWormUI[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe"
 malicious
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe
C:\Users\user\AppData\Local\Temp\RuntimeBroker.exe
 malicious

URLs

Name
IP
Malicious
https://raw.githubusercontent.com/e.b
unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exeWYL
unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exeA4z
unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe0
unknown
https://github.com/3;C
unknown
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exer
unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exemYj
unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exetXa
unknown
https://raw.githubusercontent.com/a
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exeProgramDownloade
unknown
https://github.com/D;
unknown
https://raw.githubusercontent.com/errias/XWorm-Rat-Remote-Administration-Tool-/main/XWormUI.exe
185.199.111.133
https://raw.githubusercontent.com/
unknown
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-/raw/main/XWormUI.exe
140.82.121.3
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
github.com
140.82.121.3
raw.githubusercontent.com
185.199.111.133

IPs

IP
Domain
Country
Malicious
37.18.62.18
unknown
Netherlands
malicious
140.82.121.3
github.com
United States
185.199.111.133
raw.githubusercontent.com
Netherlands

Memdumps

Base Address
Regiontype
Protect
Malicious
612000
unkown
page readonly
 malicious
2AA1000
trusted library allocation
page read and write
 malicious
A28000
heap
page read and write
EF0000
trusted library allocation
page read and write
1FDB6A0C000
heap
page read and write
7FFD3466D000
trusted library allocation
page execute and read and write
A4B000
heap
page read and write
1FDB6A92000
heap
page read and write
1FDB6AD4000
heap
page read and write
2D96000
trusted library allocation
page read and write
12AA1000
trusted library allocation
page read and write
7FF651799000
unkown
page readonly
610000
unkown
page readonly
1FDB6AA6000
heap
page read and write
A50000
heap
page read and write
1FDB87D0000
heap
page read and write
A88000
heap
page read and write
1C502000
heap
page read and write
1FDB6A8F000
heap
page read and write
2DA0000
trusted library allocation
page read and write
7E0000
heap
page read and write
AAE000
heap
page read and write
62A99FF000
stack
page read and write
A1F000
heap
page read and write
1FDB87C0000
remote allocation
page read and write
1FDB69E0000
heap
page read and write
7FFD3467D000
trusted library allocation
page execute and read and write
7FFD3465D000
trusted library allocation
page execute and read and write
7FFD34700000
trusted library allocation
page read and write
A37000
heap
page read and write
A2D000
heap
page read and write
B02000
heap
page read and write
7FFD34706000
trusted library allocation
page read and write
ADF000
heap
page read and write
1FDB6A41000
heap
page read and write
1FDB6A85000
heap
page read and write
1FDB6A8D000
heap
page read and write
7FF651798000
unkown
page write copy
7FFD34654000
trusted library allocation
page read and write
7FFD346AC000
trusted library allocation
page execute and read and write
1B010000
heap
page read and write
1FDB6AA6000
heap
page read and write
A13000
heap
page read and write
62A96FE000
stack
page read and write
1FDB6A8F000
heap
page read and write
7FF651790000
unkown
page readonly
1C500000
heap
page read and write
1FDB6AA1000
heap
page read and write
7FFD34674000
trusted library allocation
page read and write
F60000
heap
page execute and read and write
62A91FF000
stack
page read and write
1FDB6A5F000
heap
page read and write
A0B000
heap
page read and write
F10000
trusted library allocation
page read and write
2A9F000
stack
page read and write
2D8A000
trusted library allocation
page read and write
1FDB6AD2000
heap
page read and write
A3D000
heap
page read and write
7FFD34800000
trusted library allocation
page execute and read and write
7D0000
heap
page read and write
1FDB6C15000
heap
page read and write
1FDB6A1F000
heap
page read and write
62A92FE000
stack
page read and write
7FF651795000
unkown
page readonly
DCF000
stack
page read and write
1FDB6AD4000
heap
page read and write
1AF1D000
stack
page read and write
1B1A0000
heap
page read and write
7FFD34660000
trusted library allocation
page read and write
7FFD3470C000
trusted library allocation
page execute and read and write
A47000
heap
page read and write
62A90F5000
stack
page read and write
AFE000
heap
page read and write
7FF651791000
unkown
page execute read
7FFD34770000
trusted library allocation
page execute and read and write
1FDB6BD0000
heap
page read and write
1FDB6A79000
heap
page read and write
1C600000
heap
page read and write
1FDB87D1000
heap
page read and write
F43000
trusted library allocation
page read and write
7FFD34736000
trusted library allocation
page execute and read and write
1FDB6AEF000
heap
page read and write
7FFD34710000
trusted library allocation
page execute and read and write
F30000
heap
page execute and read and write
1FDB6AEA000
heap
page read and write
7FF651790000
unkown
page readonly
7FF651798000
unkown
page read and write
1002000
heap
page read and write
610000
unkown
page readonly
1B000000
heap
page read and write
7C0000
heap
page read and write
1FDB69D0000
heap
page read and write
7FF651795000
unkown
page readonly
A45000
heap
page read and write
1FDB6C10000
heap
page read and write
7A0000
heap
page read and write
1FDB6A76000
heap
page read and write
1FDB87C0000
remote allocation
page read and write
764000
stack
page read and write
A26000
heap
page read and write
1FDB6AF0000
heap
page read and write
1C518000
heap
page read and write
1FDB6A97000
heap
page read and write
7FFD34663000
trusted library allocation
page read and write
A00000
heap
page read and write
2D90000
trusted library allocation
page read and write
2DB4000
trusted library allocation
page read and write
1102000
heap
page read and write
7FFD347F0000
trusted library allocation
page read and write
1FDB6A85000
heap
page read and write
1FDB87C0000
remote allocation
page read and write
1C402000
heap
page execute and read and write
1FDB6A8D000
heap
page read and write
1C52D000
heap
page read and write
F40000
trusted library allocation
page read and write
A35000
heap
page read and write
A3F000
heap
page read and write
1FDB6AED000
heap
page read and write
7FF651799000
unkown
page readonly
61E000
unkown
page readonly
A64000
heap
page read and write
1FDB6AD2000
heap
page read and write
1FDB6A00000
heap
page read and write
7FF651791000
unkown
page execute read
1FDB6A97000
heap
page read and write
1FDB6A92000
heap
page read and write
1FDB6A5F000
heap
page read and write
F20000
heap
page read and write
7FF4367D0000
trusted library allocation
page execute and read and write
1C504000
heap
page read and write
7FFD34653000
trusted library allocation
page execute and read and write
1FDB6A42000
heap
page read and write
7FFD34670000
trusted library allocation
page read and write
There are 123 hidden memdumps, click here to show them.