IOC Report
R4WCgDAfHB.exe

loading gif

Files

File Path
Type
Category
Malicious
R4WCgDAfHB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Program Files (x86)\Microsoft Network\HelpSystem.exe
PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Program Files (x86)\Microsoft Network\Network64.exe
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
dropped
 malicious
C:\Program Files (x86)\Microsoft Network\WinRing0x64.sys
PE32+ executable (native) x86-64, for MS Windows
dropped
 malicious
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\checkip[1].htm
ASCII text, with no line terminators
dropped
 malicious
C:\Windows\SystemNvwmiShell\NvwmiShell.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\SystemNvwmiShell\NvwmiShell.dll
data
dropped
\Device\ConDrv
ASCII text, with CR line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\R4WCgDAfHB.exe
"C:\Users\user\Desktop\R4WCgDAfHB.exe"
 malicious
C:\Windows\SystemNvwmiShell\NvwmiShell.exe
"C:\Windows\SystemNvwmiShell\NvwmiShell.exe"
malicious
C:\Windows\SystemNvwmiShell\NvwmiShell.exe
C:\Windows\SystemNvwmiShell\NvwmiShell.exe
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="CloseSMB"
 malicious
C:\Program Files (x86)\Microsoft Network\HelpSystem.exe
"C:\Program Files (x86)\Microsoft Network\HelpSystem.exe" 1
 malicious
C:\Program Files (x86)\Microsoft Network\Network64.exe
"C:\Program Files (x86)\Microsoft Network\Network64.exe" Yde5fFJFjShqKS+u9okdyvP/pj9kg/bQNXV+USrRGaecQs8AdtikoR9wVLreBlqoPAFr/LRRDydtLzX5YzQgQ1GCivTcd3opL1Xfv4SzrZQOBZVgTwOiPgknymhzPAuX3kaHX0i00NQybzCyaJaj7nJOK0DHJVp09YDF1A==
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://ddns.oray.com/checkip
114.215.199.192
 malicious
http://ddns.oray.com/checkipl
unknown
http://ddns.oray.com/checkip(
unknown
http://ocsp.global
unknown
http://ddns.oray.com/checkip7
unknown
http://www.360.cn
unknown
http://www.symauth.com/cps0(
unknown
http://www.symauth.com/rpa00
unknown
http://appbols.vivoios.com:8587/smb.exeX
unknown
http://appbols.vivoios.com:8587/smb.exe
unknown
http://ddns.oray.com/checkipSystem32
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ddns.oray.com
114.215.199.192
 malicious
contr.netmows.com
45.137.222.18
pool.autocoreb.com
116.202.251.6

IPs

IP
Domain
Country
Malicious
192.168.2.148
unknown
unknown
192.168.4.67
unknown
unknown
192.168.2.149
unknown
unknown
192.168.4.68
unknown
unknown
192.168.2.146
unknown
unknown
192.168.4.65
unknown
unknown
192.168.2.147
unknown
unknown
192.168.4.66
unknown
unknown
192.168.12.127
unknown
unknown
192.168.12.128
unknown
unknown
192.168.4.69
unknown
unknown
192.168.12.129
unknown
unknown
192.168.2.140
unknown
unknown
192.168.12.123
unknown
unknown
192.168.2.141
unknown
unknown
192.168.4.60
unknown
unknown
192.168.12.124
unknown
unknown
192.168.12.125
unknown
unknown
192.168.12.126
unknown
unknown
192.168.2.144
unknown
unknown
192.168.4.63
unknown
unknown
192.168.2.145
unknown
unknown
192.168.4.64
unknown
unknown
192.168.12.120
unknown
unknown
192.168.2.142
unknown
unknown
192.168.4.61
unknown
unknown
192.168.12.121
unknown
unknown
192.168.2.143
unknown
unknown
192.168.4.62
unknown
unknown
192.168.12.122
unknown
unknown
192.168.2.159
unknown
unknown
192.168.4.56
unknown
unknown
192.168.4.57
unknown
unknown
192.168.2.157
unknown
unknown
192.168.4.54
unknown
unknown
192.168.2.158
unknown
unknown
192.168.4.55
unknown
unknown
192.168.12.116
unknown
unknown
192.168.12.117
unknown
unknown
192.168.4.58
unknown
unknown
192.168.12.118
unknown
unknown
192.168.4.59
unknown
unknown
192.168.12.119
unknown
unknown
192.168.2.151
unknown
unknown
192.168.12.112
unknown
unknown
192.168.2.152
unknown
unknown
192.168.12.113
unknown
unknown
192.168.12.114
unknown
unknown
192.168.2.150
unknown
unknown
192.168.12.115
unknown
unknown
192.168.2.155
unknown
unknown
192.168.4.52
unknown
unknown
192.168.2.156
unknown
unknown
192.168.4.53
unknown
unknown
192.168.2.153
unknown
unknown
192.168.4.50
unknown
unknown
192.168.12.110
unknown
unknown
192.168.2.154
unknown
unknown
192.168.4.51
unknown
unknown
192.168.12.111
unknown
unknown
192.168.2.126
unknown
unknown
192.168.4.45
unknown
unknown
192.168.12.109
unknown
unknown
192.168.2.127
unknown
unknown
192.168.4.46
unknown
unknown
192.168.2.124
unknown
unknown
192.168.4.43
unknown
unknown
192.168.2.125
unknown
unknown
192.168.4.44
unknown
unknown
192.168.4.49
unknown
unknown
192.168.12.105
unknown
unknown
192.168.12.106
unknown
unknown
192.168.2.128
unknown
unknown
192.168.4.47
unknown
unknown
192.168.12.107
unknown
unknown
192.168.2.129
unknown
unknown
192.168.4.48
unknown
unknown
192.168.12.108
unknown
unknown
192.168.12.101
unknown
unknown
192.168.12.102
unknown
unknown
192.168.12.103
unknown
unknown
192.168.12.104
unknown
unknown
192.168.2.122
unknown
unknown
192.168.4.41
unknown
unknown
192.168.2.123
unknown
unknown
192.168.4.42
unknown
unknown
192.168.2.120
unknown
unknown
192.168.2.121
unknown
unknown
192.168.4.40
unknown
unknown
192.168.12.100
unknown
unknown
192.168.4.29
unknown
unknown
192.168.2.137
unknown
unknown
192.168.4.34
unknown
unknown
192.168.2.138
unknown
unknown
192.168.4.35
unknown
unknown
192.168.2.135
unknown
unknown
192.168.4.32
unknown
unknown
192.168.2.136
unknown
unknown
192.168.4.33
unknown
unknown
192.168.4.38
unknown
unknown
There are 90 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetCellcore NvwmiShells
DeleteFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetCellcore NvwmiShells
KsysnctGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetCellcore NvwmiShells
Description

Memdumps

Base Address
Regiontype
Protect
Malicious
9EA000
unkown
page readonly
 malicious
275E000
heap
page read and write
 malicious
9EA000
unkown
page readonly
 malicious
F68000
heap
page read and write
58F000
stack
page read and write
2DCF000
stack
page read and write
290E000
stack
page read and write
19FE000
stack
page read and write
1D15000
heap
page read and write
1D17000
heap
page read and write
1D5E000
heap
page read and write
2A0F000
stack
page read and write
1C8A000
heap
page read and write
1C8A000
heap
page read and write
8A8000
unkown
page write copy
9BD9000
heap
page read and write
1D75000
heap
page read and write
341F000
stack
page read and write
27CE000
stack
page read and write
1D3E000
heap
page read and write
13FB000
stack
page read and write
8200000
direct allocation
page read and write
253E000
stack
page read and write
1C83000
heap
page read and write
3A9E000
stack
page read and write
2E0E000
stack
page read and write
E7B000
stack
page read and write
1DAF000
heap
page read and write
2DBD000
stack
page read and write
329E000
stack
page read and write
1D56000
heap
page read and write
1C8A000
heap
page read and write
1C89000
heap
page read and write
1E16000
heap
page read and write
7DD9000
heap
page read and write
3EC000
unkown
page readonly
1B81000
heap
page read and write
2A4E000
stack
page read and write
881000
unkown
page execute read
31FF000
heap
page read and write
32F1000
heap
page read and write
19BF000
stack
page read and write
1D36000
heap
page read and write
18EE000
heap
page read and write
401000
unkown
page execute read
28A0000
heap
page read and write
96E000
stack
page read and write
8BC000
unkown
page readonly
E3F000
stack
page read and write
1C8F000
heap
page read and write
1E5D000
heap
page read and write
1D63000
heap
page read and write
1002B000
direct allocation
page execute and read and write
1E34000
heap
page read and write
35CF000
stack
page read and write
1C8C000
heap
page read and write
188D000
heap
page read and write
1C81000
heap
page read and write
2C8F000
stack
page read and write
D3F000
stack
page read and write
359E000
stack
page read and write
41C000
unkown
page execute and write copy
400000
unkown
page readonly
C44000
unkown
page read and write
595000
heap
page read and write
1E1F000
heap
page read and write
1D64000
heap
page read and write
F1A0000
trusted library allocation
page read and write
1C81000
heap
page read and write
421E000
stack
page read and write
C99000
heap
page read and write
1D6F000
heap
page read and write
3B1000
unkown
page execute read
3CDF000
stack
page read and write
40C000
unkown
page execute and read and write
1E09000
heap
page read and write
8A0000
unkown
page readonly
1C84000
heap
page read and write
1D3C000
heap
page read and write
1D21000
heap
page read and write
1625000
heap
page read and write
90000
heap
page read and write
8C00000
direct allocation
page read and write
1C8E000
heap
page read and write
46DF000
stack
page read and write
6E2000
heap
page read and write
1D37000
heap
page read and write
6400000
direct allocation
page read and write
206C000
stack
page read and write
43E000
unkown
page read and write
880000
unkown
page readonly
1C83000
heap
page read and write
18D1000
heap
page read and write
1EBF000
stack
page read and write
355F000
stack
page read and write
1D65000
heap
page read and write
216F000
heap
page read and write
5A62000
heap
page read and write
28CF000
stack
page read and write
1D4F000
heap
page read and write
1C84000
heap
page read and write
BAD000
unkown
page read and write
1C87000
heap
page read and write
1C81000
heap
page read and write
F60000
heap
page read and write
1C84000
heap
page read and write
91D9000
heap
page read and write
43E000
unkown
page write copy
1C83000
heap
page read and write
8AA000
unkown
page write copy
1D31000
heap
page read and write
5062000
heap
page read and write
880000
unkown
page readonly
1D71000
heap
page read and write
1C87000
heap
page read and write
1D1A000
heap
page read and write
1C8B000
heap
page read and write
1D4B000
heap
page read and write
1AFF000
stack
page read and write
381E000
stack
page read and write
1D16000
heap
page read and write
2780000
heap
page read and write
431F000
stack
page read and write
1D21000
heap
page read and write
1C82000
heap
page read and write
C9E000
heap
page read and write
1891000
heap
page read and write
10000000
direct allocation
page read and write
9DA000
unkown
page read and write
2995000
heap
page read and write
1C84000
heap
page read and write
459F000
stack
page read and write
227F000
stack
page read and write
590000
heap
page read and write
9600000
direct allocation
page read and write
23BF000
stack
page read and write
163E000
stack
page read and write
10001000
direct allocation
page execute and read and write
14FF000
stack
page read and write
740000
heap
page read and write
1026000
heap
page read and write
1C8F000
heap
page read and write
3B0000
unkown
page readonly
1D4E000
heap
page read and write
34CF000
unkown
page read and write
C4D000
unkown
page write copy
700000
heap
page read and write
9C000
stack
page read and write
3200000
direct allocation
page read and write
105F000
stack
page read and write
8B7000
unkown
page read and write
1891000
heap
page read and write
F9F000
heap
page read and write
1889000
heap
page read and write
409F000
stack
page read and write
1D24000
heap
page read and write
170000
heap
page read and write
880000
unkown
page readonly
445F000
stack
page read and write
43C000
unkown
page execute and read and write
331E000
stack
page read and write
1D76000
heap
page read and write
18F6000
heap
page read and write
266F000
stack
page read and write
305F000
stack
page read and write
316E000
unkown
page read and write
32F4000
heap
page read and write
226F000
stack
page read and write
7800000
direct allocation
page read and write
2F5E000
stack
page read and write
1D5E000
heap
page read and write
26C1000
direct allocation
page execute and read and write
391F000
stack
page read and write
187C000
heap
page read and write
1C88000
heap
page read and write
5000000
direct allocation
page read and write
970000
heap
page read and write
1C8C000
heap
page read and write
18D1000
heap
page read and write
3180000
heap
page read and write
2F10000
heap
page read and write
840000
heap
page read and write
94B0000
trusted library allocation
page read and write
5A00000
direct allocation
page read and write
A5D9000
heap
page read and write
177E000
stack
page read and write
3E71000
heap
page read and write
481F000
stack
page read and write
246F000
stack
page read and write
C90000
heap
page read and write
1D73000
heap
page read and write
400000
unkown
page readonly
40DE000
stack
page read and write
3F70000
trusted library allocation
page read and write
277F000
stack
page read and write
345E000
stack
page read and write
10001000
direct allocation
page execute and read and write
1D47000
heap
page read and write
1C84000
heap
page read and write
23FE000
stack
page read and write
87D9000
heap
page read and write
1D54000
heap
page read and write
2B90000
heap
page read and write
190E000
heap
page read and write
1B2D000
stack
page read and write
41DF000
stack
page read and write
3F5F000
stack
page read and write
8A8000
unkown
page write copy
5EA0000
heap
page read and write
1C3F000
stack
page read and write
217E000
stack
page read and write
173E000
stack
page read and write
3BDE000
stack
page read and write
1D44000
heap
page read and write
1D2F000
heap
page read and write
AFD9000
heap
page read and write
5DE000
stack
page read and write
8A0000
unkown
page readonly
43D000
unkown
page execute and write copy
1DF8000
heap
page read and write
540000
heap
page read and write
203E000
stack
page read and write
8B9000
unkown
page read and write
1002D000
direct allocation
page read and write
1C80000
heap
page read and write
1DBE000
stack
page read and write
1C86000
heap
page read and write
D87000
heap
page read and write
3F70000
heap
page read and write
1C86000
heap
page read and write
1D59000
heap
page read and write
10020000
direct allocation
page execute and read and write
8F0000
heap
page read and write
69A000
heap
page read and write
1C83000
heap
page read and write
1C8B000
heap
page read and write
435E000
stack
page read and write
2940000
heap
page read and write
485E000
stack
page read and write
186E000
heap
page read and write
881000
unkown
page execute read
1E3C000
heap
page read and write
1C0000
direct allocation
page execute read
495F000
stack
page read and write
19C000
stack
page read and write
8A0000
unkown
page readonly
C46000
unkown
page write copy
6C5000
heap
page read and write
1D36000
heap
page read and write
471E000
stack
page read and write
401000
unkown
page execute read
1D7F000
stack
page read and write
3D8000
unkown
page write copy
213F000
stack
page read and write
D87000
heap
page read and write
3C00000
direct allocation
page read and write
68D000
stack
page read and write
1DB8000
heap
page read and write
10013000
direct allocation
page execute and read and write
1C89000
heap
page read and write
690000
heap
page read and write
449E000
stack
page read and write
32D0000
heap
page read and write
1C83000
heap
page read and write
401000
unkown
page execute and read and write
32DC000
heap
page read and write
100E000
stack
page read and write
1FFF000
stack
page read and write
1DCF000
heap
page read and write
3D1E000
stack
page read and write
C48000
unkown
page write copy
3262000
heap
page read and write
4600000
direct allocation
page read and write
369F000
stack
page read and write
1EFE000
stack
page read and write
726000
heap
page read and write
3E1F000
stack
page read and write
2B4F000
stack
page read and write
319F000
stack
page read and write
15FF000
stack
page read and write
32DF000
stack
page read and write
1D78000
heap
page read and write
45DE000
stack
page read and write
1916000
heap
page read and write
2F0F000
stack
page read and write
2999000
direct allocation
page read and write
1600000
direct allocation
page execute and read and write
2CCE000
stack
page read and write
2800000
direct allocation
page read and write
29B1000
heap
page read and write
4662000
heap
page read and write
1D49000
heap
page read and write
1B3E000
stack
page read and write
10000000
direct allocation
page read and write
1D3A000
heap
page read and write
1C8A000
heap
page read and write
1C81000
heap
page read and write
190000
heap
page read and write
9DA000
unkown
page write copy
8CE000
stack
page read and write
6462000
heap
page read and write
267E000
stack
page read and write
730000
heap
page read and write
C4D000
unkown
page write copy
1020000
heap
page read and write
850000
heap
page read and write
8A8000
unkown
page read and write
8BC000
unkown
page readonly
184B000
heap
page read and write
1D43000
heap
page read and write
401000
unkown
page execute read
8BC000
unkown
page readonly
7862000
heap
page read and write
2B8E000
stack
page read and write
2163000
heap
page read and write
7DC000
stack
page read and write
1906000
heap
page read and write
1C81000
heap
page read and write
9DB000
unkown
page write copy
2950000
heap
page read and write
F5F000
stack
page read and write
460000
heap
page read and write
1D50000
heap
page read and write
D87000
heap
page read and write
1842000
heap
page read and write
24FF000
stack
page read and write
3E71000
heap
page read and write
3170000
heap
page read and write
1C86000
heap
page read and write
3E71000
heap
page read and write
1D50000
heap
page read and write
4970000
heap
page read and write
1889000
heap
page read and write
9E7000
unkown
page write copy
188D000
heap
page read and write
3D0000
unkown
page readonly
1C83000
heap
page read and write
10016000
direct allocation
page execute and read and write
36C0000
heap
page read and write
5D70000
heap
page read and write
1C83000
heap
page read and write
3A5F000
stack
page read and write
790000
heap
page read and write
1D27000
heap
page read and write
409000
unkown
page execute and read and write
400000
unkown
page readonly
1891000
heap
page read and write
18FE000
heap
page read and write
3F9E000
stack
page read and write
1C88000
heap
page read and write
2670000
direct allocation
page execute and read and write
1D48000
heap
page read and write
9DF000
unkown
page read and write
703000
heap
page read and write
92E000
stack
page read and write
1C86000
heap
page read and write
31DE000
stack
page read and write
188D000
heap
page read and write
309E000
stack
page read and write
298D000
heap
page read and write
5370000
heap
page read and write
647000
heap
page read and write
6DB000
stack
page read and write
1889000
heap
page read and write
36DE000
stack
page read and write
1D1B000
heap
page read and write
18D1000
heap
page read and write
1C89000
heap
page read and write
18BE000
stack
page read and write
881000
unkown
page execute read
30FD000
stack
page read and write
3C62000
heap
page read and write
37DF000
stack
page read and write
5E0000
heap
page read and write
7D76000
heap
page read and write
3120000
heap
page read and write
395E000
stack
page read and write
1DCE000
heap
page read and write
1DCE000
heap
page read and write
1C85000
heap
page read and write
1D25000
heap
page read and write
6E00000
direct allocation
page read and write
6E62000
heap
page read and write
1C88000
heap
page read and write
3E5E000
stack
page read and write
1C7E000
stack
page read and write
1C89000
heap
page read and write
1D4C000
heap
page read and write
1620000
heap
page read and write
32F3000
heap
page read and write
22BE000
stack
page read and write
187F000
stack
page read and write
1E3D000
heap
page read and write
400000
unkown
page readonly
15F0000
direct allocation
page execute and read and write
185B000
heap
page read and write
640000
heap
page read and write
BBF000
unkown
page read and write
26B1000
direct allocation
page execute and read and write
1B8E000
heap
page read and write
3B9F000
stack
page read and write
263F000
stack
page read and write
2AB0000
heap
page read and write
There are 393 hidden memdumps, click here to show them.