Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
bfWVPQsRO1.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bfWVPQsRO1.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\Payload.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Payload.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
|
MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600,
atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk
|
MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600,
atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\bfWVPQsRO1.exe
|
"C:\Users\user\Desktop\bfWVPQsRO1.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\Payload.exe
|
"C:\Users\user\AppData\Local\Temp\Payload.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\Payload.exe
|
"C:\Users\user\AppData\Local\Temp\Payload.exe"
|
|
|
|
C:\Windows\SysWOW64\attrib.exe
|
attrib +h +r +s "C:\Users\user\AppData\Local\Temp\Payload.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://go.microsoft.
|
unknown
|
||
|
http://go.microsoft.LinkId=42127
|
unknown
|
||
|
https://99.391.161.391
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
193.161.193.99
|
unknown
|
Russian Federation
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
Windows2
|
|
|
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
Windows
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
Windows2
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
|
Windows2
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
|
Windows
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2B81000
|
trusted library allocation
|
page read and write
|
|
|
|
3011000
|
trusted library allocation
|
page read and write
|
|
|
|
56B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1162000
|
trusted library allocation
|
page execute and read and write
|
||
|
5200000
|
trusted library allocation
|
page read and write
|
||
|
AC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
AEB000
|
stack
|
page read and write
|
||
|
578E000
|
stack
|
page read and write
|
||
|
5210000
|
trusted library allocation
|
page execute and read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
5A4F000
|
stack
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
FF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
117B000
|
trusted library allocation
|
page execute and read and write
|
||
|
580E000
|
stack
|
page read and write
|
||
|
BEF000
|
heap
|
page read and write
|
||
|
14F0000
|
heap
|
page read and write
|
||
|
1177000
|
trusted library allocation
|
page execute and read and write
|
||
|
5F50000
|
heap
|
page read and write
|
||
|
8F6000
|
stack
|
page read and write
|
||
|
52A0000
|
heap
|
page read and write
|
||
|
101E000
|
heap
|
page read and write
|
||
|
1210000
|
heap
|
page read and write
|
||
|
C0E000
|
heap
|
page read and write
|
||
|
324F000
|
stack
|
page read and write
|
||
|
4014000
|
trusted library allocation
|
page read and write
|
||
|
2E01000
|
trusted library allocation
|
page read and write
|
||
|
4FCF000
|
stack
|
page read and write
|
||
|
598E000
|
stack
|
page read and write
|
||
|
1080000
|
trusted library allocation
|
page read and write
|
||
|
594E000
|
stack
|
page read and write
|
||
|
2EFD000
|
stack
|
page read and write
|
||
|
A90000
|
trusted library allocation
|
page read and write
|
||
|
D72000
|
trusted library allocation
|
page execute and read and write
|
||
|
D30000
|
heap
|
page execute and read and write
|
||
|
1090000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C29000
|
trusted library allocation
|
page read and write
|
||
|
58B0000
|
heap
|
page read and write
|
||
|
4F9C000
|
stack
|
page read and write
|
||
|
2EBD000
|
stack
|
page read and write
|
||
|
FAF000
|
stack
|
page read and write
|
||
|
114C000
|
trusted library allocation
|
page execute and read and write
|
||
|
CEE000
|
stack
|
page read and write
|
||
|
1010000
|
trusted library allocation
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
4F9F000
|
stack
|
page read and write
|
||
|
568D000
|
stack
|
page read and write
|
||
|
1170000
|
trusted library allocation
|
page read and write
|
||
|
F9D000
|
stack
|
page read and write
|
||
|
50B0000
|
heap
|
page read and write
|
||
|
4011000
|
trusted library allocation
|
page read and write
|
||
|
113A000
|
trusted library allocation
|
page execute and read and write
|
||
|
B7E000
|
heap
|
page read and write
|
||
|
56A9000
|
stack
|
page read and write
|
||
|
14DE000
|
stack
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
5280000
|
trusted library allocation
|
page read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
ECB000
|
trusted library allocation
|
page execute and read and write
|
||
|
554E000
|
stack
|
page read and write
|
||
|
EB2000
|
trusted library allocation
|
page execute and read and write
|
||
|
56A000
|
stack
|
page read and write
|
||
|
B66000
|
stack
|
page read and write
|
||
|
B4E000
|
heap
|
page read and write
|
||
|
AD2000
|
trusted library allocation
|
page execute and read and write
|
||
|
594E000
|
stack
|
page read and write
|
||
|
4ECE000
|
stack
|
page read and write
|
||
|
102E000
|
stack
|
page read and write
|
||
|
5CDC000
|
stack
|
page read and write
|
||
|
3E01000
|
trusted library allocation
|
page read and write
|
||
|
2C15000
|
trusted library allocation
|
page read and write
|
||
|
985000
|
heap
|
page read and write
|
||
|
105D000
|
heap
|
page read and write
|
||
|
1083000
|
heap
|
page read and write
|
||
|
AB2000
|
trusted library allocation
|
page execute and read and write
|
||
|
1096000
|
heap
|
page read and write
|
||
|
BBC000
|
heap
|
page read and write
|
||
|
115A000
|
trusted library allocation
|
page execute and read and write
|
||
|
590F000
|
stack
|
page read and write
|
||
|
BFF000
|
heap
|
page read and write
|
||
|
E9C000
|
trusted library allocation
|
page execute and read and write
|
||
|
11AF000
|
stack
|
page read and write
|
||
|
FEE000
|
heap
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
311A000
|
heap
|
page read and write
|
||
|
10A0000
|
heap
|
page read and write
|
||
|
5750000
|
trusted library allocation
|
page execute and read and write
|
||
|
AAA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2ABF000
|
stack
|
page read and write
|
||
|
11EC000
|
stack
|
page read and write
|
||
|
105B000
|
heap
|
page read and write
|
||
|
2F40000
|
heap
|
page read and write
|
||
|
EAA000
|
trusted library allocation
|
page execute and read and write
|
||
|
D60000
|
trusted library allocation
|
page read and write
|
||
|
5A90000
|
heap
|
page read and write
|
||
|
E90000
|
trusted library allocation
|
page read and write
|
||
|
1520000
|
heap
|
page execute and read and write
|
||
|
5E4E000
|
stack
|
page read and write
|
||
|
56C0000
|
unclassified section
|
page read and write
|
||
|
3400000
|
heap
|
page read and write
|
||
|
AA2000
|
trusted library allocation
|
page execute and read and write
|
||
|
AE2000
|
trusted library allocation
|
page read and write
|
||
|
8F9000
|
stack
|
page read and write
|
||
|
1006000
|
heap
|
page read and write
|
||
|
129E000
|
stack
|
page read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
BC3000
|
heap
|
page read and write
|
||
|
F58000
|
heap
|
page read and write
|
||
|
584E000
|
stack
|
page read and write
|
||
|
544E000
|
stack
|
page read and write
|
||
|
13DE000
|
stack
|
page read and write
|
||
|
51EF000
|
stack
|
page read and write
|
||
|
2F8E000
|
unkown
|
page read and write
|
||
|
106E000
|
stack
|
page read and write
|
||
|
A6B000
|
stack
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
5F9D000
|
stack
|
page read and write
|
||
|
D90000
|
trusted library allocation
|
page read and write
|
||
|
54B0000
|
trusted library allocation
|
page read and write
|
||
|
E50000
|
heap
|
page read and write
|
||
|
5A8E000
|
stack
|
page read and write
|
||
|
ABA000
|
trusted library allocation
|
page execute and read and write
|
||
|
114A000
|
trusted library allocation
|
page execute and read and write
|
||
|
553F000
|
stack
|
page read and write
|
||
|
1094000
|
heap
|
page read and write
|
||
|
568F000
|
stack
|
page read and write
|
||
|
A5A000
|
unkown
|
page readonly
|
||
|
56CE000
|
stack
|
page read and write
|
||
|
2C2B000
|
trusted library allocation
|
page read and write
|
||
|
F50000
|
heap
|
page read and write
|
||
|
AE7000
|
trusted library allocation
|
page execute and read and write
|
||
|
57CE000
|
stack
|
page read and write
|
||
|
2FCF000
|
unkown
|
page read and write
|
||
|
1080000
|
heap
|
page read and write
|
||
|
5F4F000
|
stack
|
page read and write
|
||
|
1200000
|
trusted library allocation
|
page read and write
|
||
|
5DDC000
|
stack
|
page read and write
|
||
|
3E04000
|
trusted library allocation
|
page read and write
|
||
|
B20000
|
heap
|
page execute and read and write
|
||
|
A52000
|
unkown
|
page readonly
|
||
|
4B88000
|
trusted library allocation
|
page read and write
|
||
|
1500000
|
heap
|
page read and write
|
||
|
B69000
|
stack
|
page read and write
|
||
|
EF8000
|
heap
|
page read and write
|
||
|
EF0000
|
heap
|
page read and write
|
||
|
AB0000
|
trusted library allocation
|
page read and write
|
||
|
93E000
|
stack
|
page read and write
|
||
|
F55000
|
heap
|
page read and write
|
||
|
B40000
|
heap
|
page read and write
|
||
|
ADA000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D1E000
|
stack
|
page read and write
|
||
|
F26000
|
heap
|
page read and write
|
||
|
FDD000
|
stack
|
page read and write
|
||
|
139E000
|
stack
|
page read and write
|
||
|
B48000
|
heap
|
page read and write
|
||
|
50EC000
|
stack
|
page read and write
|
||
|
509E000
|
stack
|
page read and write
|
||
|
1083000
|
heap
|
page read and write
|
||
|
609E000
|
stack
|
page read and write
|
||
|
F60000
|
heap
|
page read and write
|
||
|
FEC000
|
stack
|
page read and write
|
||
|
558E000
|
stack
|
page read and write
|
||
|
AF0000
|
heap
|
page read and write
|
||
|
EC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
3117000
|
heap
|
page read and write
|
||
|
E8F000
|
stack
|
page read and write
|
||
|
53FE000
|
stack
|
page read and write
|
||
|
1120000
|
trusted library allocation
|
page read and write
|
||
|
CF0000
|
heap
|
page read and write
|
||
|
505E000
|
stack
|
page read and write
|
||
|
1090000
|
heap
|
page read and write
|
||
|
566C000
|
stack
|
page read and write
|
||
|
2FD0000
|
heap
|
page read and write
|
||
|
BE6000
|
stack
|
page read and write
|
||
|
A50000
|
unkown
|
page readonly
|
||
|
F0D000
|
heap
|
page read and write
|
||
|
58C0000
|
heap
|
page read and write
|
||
|
7FCD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
FEA000
|
heap
|
page read and write
|
||
|
3110000
|
heap
|
page read and write
|
||
|
ACA000
|
trusted library allocation
|
page execute and read and write
|
||
|
D7A000
|
trusted library allocation
|
page execute and read and write
|
||
|
58A0000
|
heap
|
page read and write
|
||
|
310E000
|
stack
|
page read and write
|
||
|
D7E000
|
stack
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
AEB000
|
trusted library allocation
|
page execute and read and write
|
||
|
3B81000
|
trusted library allocation
|
page read and write
|
||
|
EAE000
|
stack
|
page read and write
|
||
|
543E000
|
stack
|
page read and write
|
||
|
51ED000
|
stack
|
page read and write
|
||
|
1140000
|
trusted library allocation
|
page read and write
|
||
|
E92000
|
trusted library allocation
|
page execute and read and write
|
||
|
52FE000
|
stack
|
page read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
F69000
|
heap
|
page read and write
|
||
|
1142000
|
trusted library allocation
|
page execute and read and write
|
||
|
1132000
|
trusted library allocation
|
page execute and read and write
|
||
|
F40000
|
heap
|
page read and write
|
There are 194 hidden memdumps, click here to show them.