Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Iyto7FYCJO.exe
|
PE32+ executable (console) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\driver[1].sys
|
PE32+ executable (native) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Vulnerability[1].exe
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Windows\Vulnerability.exe
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Windows\driver.sys
|
PE32+ executable (native) x86-64, for MS Windows
|
dropped
|
|
|
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Iyto7FYCJO.exe
|
"C:\Users\user\Desktop\Iyto7FYCJO.exe"
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c cd C:\
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c start C:\Windows\Vulnerability.exe C:\Windows\driver.sys
|
|
|
|
C:\Windows\Vulnerability.exe
|
C:\Windows\Vulnerability.exe C:\Windows\driver.sys
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\Iyto7FYCJO.exe" MD5 | find /i /v "md5" | find /i
/v "certutil"
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
|
|
|
|
C:\Windows\System32\cmd.exe
|
cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\certutil.exe
|
certutil -hashfile "C:\Users\user\Desktop\Iyto7FYCJO.exe" MD5
|
||
|
C:\Windows\System32\find.exe
|
find /i /v "md5"
|
||
|
C:\Windows\System32\find.exe
|
find /i /v "certutil"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\timeout.exe
|
timeout /t 5
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 1308 -s 1708
|
There are 5 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://185.101.104.122/driver.sysl
|
unknown
|
||
|
http://185.101.104.122/Vulnerability.exe
|
185.101.104.122
|
||
|
https://keyauth.win/api/1.2/http://185.101.104.122/Vulnerability.exeC:
|
unknown
|
||
|
http://185.101.104.122/Vulnerability.exev
|
unknown
|
||
|
https://www.behance.net/madetypeFree
|
unknown
|
||
|
http://185.101.104.122/driver.sysW
|
unknown
|
||
|
http://185.101.104.122/driver.sysC:
|
unknown
|
||
|
http://185.101.104.122/Vulnerability.exeC:
|
unknown
|
||
|
https://keyauth.win/api/1.2/2(f
|
unknown
|
||
|
http://185.101.104.122/driver.syse
|
unknown
|
||
|
http://185.101.104.122/driver.sys
|
185.101.104.122
|
||
|
https://curl.haxx.se/docs/http-cookies.html
|
unknown
|
||
|
https://keyauth.win/api/1.2/
|
unknown
|
||
|
http://185.101.104.122/Vulnerability.exeC9?
|
unknown
|
There are 4 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
keyauth.win
|
172.67.72.57
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
172.67.72.57
|
keyauth.win
|
United States
|
||
|
185.101.104.122
|
unknown
|
Romania
|
||
|
127.0.0.1
|
unknown
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
|
Name
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1F89D415000
|
heap
|
page read and write
|
||
|
E9DB11E000
|
stack
|
page read and write
|
||
|
7FF7738E0000
|
unkown
|
page readonly
|
||
|
D8D0CFF000
|
stack
|
page read and write
|
||
|
2B69CF50000
|
heap
|
page read and write
|
||
|
22AC022F000
|
heap
|
page read and write
|
||
|
22AC023F000
|
heap
|
page read and write
|
||
|
7FF7738E0000
|
unkown
|
page readonly
|
||
|
1C4AEBE0000
|
heap
|
page read and write
|
||
|
22AC01FF000
|
heap
|
page read and write
|
||
|
2B69EEE0000
|
remote allocation
|
page read and write
|
||
|
9F3D87C000
|
stack
|
page read and write
|
||
|
1E185250000
|
heap
|
page read and write
|
||
|
9F3D97E000
|
stack
|
page read and write
|
||
|
2B0064E0000
|
heap
|
page read and write
|
||
|
2B69E836000
|
heap
|
page read and write
|
||
|
D8D04FE000
|
stack
|
page read and write
|
||
|
22AC0180000
|
trusted library allocation
|
page read and write
|
||
|
743C9FF000
|
stack
|
page read and write
|
||
|
1E1850B0000
|
heap
|
page read and write
|
||
|
2B69CF10000
|
heap
|
page read and write
|
||
|
22AC1C00000
|
remote allocation
|
page read and write
|
||
|
1C4AEC30000
|
heap
|
page read and write
|
||
|
7FF7A2710000
|
unkown
|
page readonly
|
||
|
2B69E7F0000
|
heap
|
page read and write
|
||
|
1C4AEB90000
|
heap
|
page read and write
|
||
|
743C1FE000
|
stack
|
page read and write
|
||
|
2B69EEE0000
|
remote allocation
|
page read and write
|
||
|
339CA7F000
|
stack
|
page read and write
|
||
|
22AC1C00000
|
remote allocation
|
page read and write
|
||
|
7FF7A27CB000
|
unkown
|
page readonly
|
||
|
1E185040000
|
heap
|
page read and write
|
||
|
22AC1C00000
|
remote allocation
|
page read and write
|
||
|
7FF7A27F2000
|
unkown
|
page read and write
|
||
|
2B69EEF0000
|
trusted library allocation
|
page read and write
|
||
|
D8D06FE000
|
stack
|
page read and write
|
||
|
22AC023A000
|
heap
|
page read and write
|
||
|
22AC0205000
|
heap
|
page read and write
|
||
|
22AC023D000
|
heap
|
page read and write
|
||
|
743C5FB000
|
stack
|
page read and write
|
||
|
1F89BA40000
|
heap
|
page read and write
|
||
|
22AC1CC4000
|
heap
|
page read and write
|
||
|
7FF773904000
|
unkown
|
page readonly
|
||
|
22AC0233000
|
heap
|
page read and write
|
||
|
7FF7A2810000
|
unkown
|
page readonly
|
||
|
7FF7738E1000
|
unkown
|
page execute read
|
||
|
7FF7A2825000
|
unkown
|
page execute read
|
||
|
7FF7738E1000
|
unkown
|
page execute read
|
||
|
22AC019C000
|
heap
|
page read and write
|
||
|
BD4BA7C000
|
stack
|
page read and write
|
||
|
7FF7A3165000
|
unkown
|
page readonly
|
||
|
7FF7738F6000
|
unkown
|
page readonly
|
||
|
743C0FF000
|
stack
|
page read and write
|
||
|
2B69E945000
|
heap
|
page read and write
|
||
|
22AC021C000
|
heap
|
page read and write
|
||
|
2B006440000
|
heap
|
page read and write
|
||
|
2B69D030000
|
heap
|
page read and write
|
||
|
22AC0110000
|
heap
|
page read and write
|
||
|
1C4AEBE5000
|
heap
|
page read and write
|
||
|
2B69CF00000
|
heap
|
page read and write
|
||
|
7FF773904000
|
unkown
|
page readonly
|
||
|
2B0081C0000
|
heap
|
page read and write
|
||
|
2B69E7F4000
|
heap
|
page read and write
|
||
|
2B69E8F0000
|
heap
|
page read and write
|
||
|
2B69CDF0000
|
heap
|
page read and write
|
||
|
E9DB19D000
|
stack
|
page read and write
|
||
|
2B006509000
|
heap
|
page read and write
|
||
|
7FF7A281B000
|
unkown
|
page execute read
|
||
|
1E1850B8000
|
heap
|
page read and write
|
||
|
E9DB09C000
|
stack
|
page read and write
|
||
|
D8D0BFE000
|
stack
|
page read and write
|
||
|
7FF7A2711000
|
unkown
|
page execute read
|
||
|
743C8FD000
|
stack
|
page read and write
|
||
|
339C78F000
|
stack
|
page read and write
|
||
|
7FF7A2B9B000
|
unkown
|
page execute read
|
||
|
22AC1B90000
|
heap
|
page read and write
|
||
|
7FF7A2830000
|
unkown
|
page execute read
|
||
|
22AC020A000
|
heap
|
page read and write
|
||
|
2B69D00D000
|
heap
|
page read and write
|
||
|
339C70C000
|
stack
|
page read and write
|
||
|
2B006330000
|
heap
|
page read and write
|
||
|
D8D08FE000
|
stack
|
page read and write
|
||
|
2B69CED0000
|
heap
|
page read and write
|
||
|
2B006410000
|
heap
|
page read and write
|
||
|
1C4AEB60000
|
heap
|
page read and write
|
||
|
2B69CF05000
|
heap
|
page read and write
|
||
|
D8D05FE000
|
stack
|
page read and write
|
||
|
743C4FF000
|
stack
|
page read and write
|
||
|
1F89BA78000
|
heap
|
page read and write
|
||
|
2B69E867000
|
heap
|
page read and write
|
||
|
743BFFE000
|
stack
|
page read and write
|
||
|
D8D09FF000
|
stack
|
page read and write
|
||
|
7FF7A3165000
|
unkown
|
page readonly
|
||
|
1F89D410000
|
heap
|
page read and write
|
||
|
7FF7A282C000
|
unkown
|
page execute read
|
||
|
1C4AEC3A000
|
heap
|
page read and write
|
||
|
BD4BAFF000
|
stack
|
page read and write
|
||
|
7FF7738F6000
|
unkown
|
page readonly
|
||
|
1F89BA70000
|
heap
|
page read and write
|
||
|
22AC021C000
|
heap
|
page read and write
|
||
|
D8D07FE000
|
stack
|
page read and write
|
||
|
2B006500000
|
heap
|
page read and write
|
||
|
22AC1B20000
|
trusted library allocation
|
page read and write
|
||
|
743BEF6000
|
stack
|
page read and write
|
||
|
22AC0170000
|
heap
|
page read and write
|
||
|
2B69E83F000
|
heap
|
page read and write
|
||
|
E9DB47E000
|
stack
|
page read and write
|
||
|
22AC01BC000
|
heap
|
page read and write
|
||
|
22AC1B00000
|
heap
|
page read and write
|
||
|
D8D0AFB000
|
stack
|
page read and write
|
||
|
7FF7A2819000
|
unkown
|
page execute read
|
||
|
22AC0150000
|
heap
|
page read and write
|
||
|
1E184F40000
|
heap
|
page read and write
|
||
|
2B0064E5000
|
heap
|
page read and write
|
||
|
22AC1C00000
|
remote allocation
|
page read and write
|
||
|
7FF7A2821000
|
unkown
|
page execute read
|
||
|
22AC0175000
|
heap
|
page read and write
|
||
|
1E1850BB000
|
heap
|
page read and write
|
||
|
2B69EF30000
|
heap
|
page read and write
|
||
|
2B69E957000
|
heap
|
page read and write
|
||
|
1F89BA50000
|
heap
|
page read and write
|
||
|
1E185020000
|
heap
|
page read and write
|
||
|
1C4AEB70000
|
heap
|
page read and write
|
||
|
22AC1CC0000
|
heap
|
page read and write
|
||
|
22AC0190000
|
heap
|
page read and write
|
||
|
743C7FD000
|
stack
|
page read and write
|
||
|
22AC0224000
|
heap
|
page read and write
|
||
|
1E185255000
|
heap
|
page read and write
|
||
|
7FF7A2849000
|
unkown
|
page read and write
|
||
|
743C3FE000
|
stack
|
page read and write
|
||
|
9F3D8FF000
|
stack
|
page read and write
|
||
|
7FF773903000
|
unkown
|
page write copy
|
||
|
22AC0224000
|
heap
|
page read and write
|
||
|
2B69CF5C000
|
heap
|
page read and write
|
||
|
7FF773903000
|
unkown
|
page read and write
|
||
|
2B008350000
|
heap
|
page read and write
|
||
|
1F89D420000
|
heap
|
page read and write
|
||
|
7FF7A284F000
|
unkown
|
page execute read
|
||
|
7FF7A2710000
|
unkown
|
page readonly
|
||
|
743C2FE000
|
stack
|
page read and write
|
||
|
1C4AEC38000
|
heap
|
page read and write
|
||
|
D8D0176000
|
stack
|
page read and write
|
||
|
22AC0120000
|
heap
|
page read and write
|
||
|
2B69CFC9000
|
heap
|
page read and write
|
||
|
743C6FE000
|
stack
|
page read and write
|
||
|
2B69EEE0000
|
remote allocation
|
page read and write
|
||
|
2B69EEF0000
|
trusted library allocation
|
page read and write
|
||
|
BD4BB7F000
|
stack
|
page read and write
|
There are 138 hidden memdumps, click here to show them.