IOC Report
SecuriteInfo.com.FileRepMalware.16359.15944.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.FileRepMalware.16359.15944.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\jusched32.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nsl5176.tmp\DotNetChecker.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.Core.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\AWSSDK.S3.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\Newtonsoft.Json.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mssched.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KillProcPCTT.exe.log
CSV text
modified
C:\Users\user\AppData\Local\Microsoft\mssched.exe_Url_4gcyhmu3ku50ql3oveaqzgvl21ncnjvy\1.0.0.71\user.config (copy)
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\mssched.exe_Url_4gcyhmu3ku50ql3oveaqzgvl21ncnjvy\1.0.0.71\xonhjdd2.newcfg
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\376483\user_ebteme\1729898892.jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.16359.15944.exe"
 malicious
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe" -f SecuriteInfo.com.FileRepMalware.16359.15944.exe
 malicious
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\mssched.exe"
malicious
C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler\KillProcPCTT.exe
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html
unknown
https://sectigo.com/CPS0
unknown
http://169.254.170.2
unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
unknown
http://ocsp.sectigo.com0
unknown
https://pctattletale.com/app/Authenticationv14.php/AddComputer
unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
unknown
https://www.newtonsoft.com/json
unknown
http://s3.amazonaws.com/doc/2006-03-01/
unknown
http://169.254.170.2aUnable
unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://www.pctattletale.com/members/autologinfirstrun.php?AuthKey=
unknown
https://pctattletale.com/app/Authenticationv14.php/SendKeyStrokes
unknown
https://pctattletale.com/app/Authenticationv14.php/CreateAccount
unknown
http://james.newtonking.com/projects/json
unknown
https://pctattletale.com/app/Authenticationv14.php/AddExclusionAccount
unknown
http://pctattletale.com/amazonfix.php
unknown
https://pctattletale.com/app/Authenticationv14.php/DeleteComputer
unknown
https://pctattletale.com:443/app/Authenticationv14.php
unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
unknown
http://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html)
unknown
http://www.pctattletale.com/members/forgotpassword.php
unknown
https://www.newtonsoft.com/jsonschema
unknown
https://ip-ranges.amazonaws.com/ip-ranges.json
unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson
unknown
http://www.pctattletale.com/removal.php
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://169.254.169.254
unknown
https://pctattletale.com/members/signup.php?source=PCTTSiteWinDownloadqhttp://www.pctattletale.com/m
unknown
https://pctattletale.com/app/Authenticationv14.php/GetComputerStatus
unknown
There are 21 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
scheduler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
HideFastUserSwitching
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Blob

Memdumps

Base Address
Regiontype
Protect
Malicious
125E4BF8000
heap
page read and write
1FC13F20000
heap
page read and write
21DE000
stack
page read and write
40A000
unkown
page read and write
627000
heap
page read and write
1FC2E2B0000
heap
page execute and read and write
7FF848E30000
trusted library allocation
page execute and read and write
2A58FF000
stack
page read and write
1FC2E262000
trusted library section
page read and write
42C000
unkown
page read and write
2500000
trusted library allocation
page execute and read and write
125CA9F5000
heap
page read and write
7FF848F25000
trusted library allocation
page read and write
7FF848F30000
trusted library allocation
page execute and read and write
63E000
heap
page read and write
3C4000
unkown
page readonly
7FF848D53000
trusted library allocation
page execute and read and write
7FF848F60000
trusted library allocation
page execute and read and write
7C0000
heap
page read and write
1FC2E43F000
heap
page read and write
1FC13C70000
unkown
page readonly
2A50FE000
stack
page read and write
7FF848F55000
trusted library allocation
page read and write
1FC15C73000
trusted library allocation
page read and write
408000
unkown
page readonly
90E000
stack
page read and write
7FF848E0C000
trusted library allocation
page execute and read and write
1FC2E600000
heap
page read and write
125DC3A8000
trusted library allocation
page read and write
7FF848F50000
trusted library allocation
page read and write
36E1000
trusted library allocation
page read and write
125CC220000
heap
page read and write
3C0000
unkown
page readonly
1FC2FA10000
heap
page execute and read and write
24B0000
trusted library allocation
page read and write
7FF848D7B000
trusted library allocation
page execute and read and write
CB0000
heap
page read and write
1FC2E429000
heap
page read and write
7FF848D94000
trusted library allocation
page read and write
125CA7B8000
heap
page read and write
A50000
heap
page read and write
1FC15C8A000
trusted library allocation
page read and write
1FC15C96000
trusted library allocation
page read and write
1FC1402E000
heap
page read and write
36E4000
trusted library allocation
page read and write
624000
heap
page read and write
213E000
stack
page read and write
A1576FC000
stack
page read and write
1FC1403B000
heap
page read and write
1FC13FB0000
trusted library allocation
page read and write
1FC2E4B0000
heap
page read and write
449000
unkown
page readonly
1FC308F0000
heap
page read and write
125CC3A1000
trusted library allocation
page read and write
5C0000
heap
page read and write
7FF848D9D000
trusted library allocation
page execute and read and write
1FC15BA2000
trusted library allocation
page read and write
1FC15C36000
trusted library allocation
page read and write
1FC15BE7000
trusted library allocation
page read and write
1FC2FAB2000
unkown
page readonly
125CA9F0000
heap
page read and write
450000
heap
page read and write
7FF848F10000
trusted library allocation
page read and write
A4E000
stack
page read and write
7EF000
stack
page read and write
125CA7BD000
heap
page read and write
440000
unkown
page read and write
1FC15B94000
trusted library allocation
page read and write
1FC15BCF000
trusted library allocation
page read and write
125CA9D0000
trusted library allocation
page read and write
1FC2F64B000
heap
page read and write
1FC15BE4000
trusted library allocation
page read and write
910000
heap
page read and write
125CA770000
heap
page read and write
1FC15C69000
trusted library allocation
page read and write
1FC15A14000
trusted library allocation
page read and write
1FC2E110000
trusted library section
page readonly
CA0000
trusted library allocation
page read and write
1FC2E605000
heap
page read and write
1FC14190000
heap
page read and write
125CA790000
heap
page read and write
A156DB4000
stack
page read and write
7FF848E00000
trusted library allocation
page read and write
1FC13EE0000
heap
page read and write
1FC2E406000
heap
page read and write
249B000
trusted library allocation
page execute and read and write
3705000
trusted library allocation
page read and write
1FC15C6E000
trusted library allocation
page read and write
23D0000
heap
page read and write
2464000
trusted library allocation
page read and write
125CA799000
heap
page read and write
638000
heap
page read and write
A1579FE000
stack
page read and write
1FC13FEA000
heap
page read and write
7FF848E06000
trusted library allocation
page read and write
19A000
stack
page read and write
125E4BF6000
heap
page read and write
1FC13FC0000
heap
page read and write
7FF4E1200000
trusted library allocation
page execute and read and write
7FF848E36000
trusted library allocation
page execute and read and write
2490000
trusted library allocation
page read and write
7FF848D74000
trusted library allocation
page read and write
7FF848E26000
trusted library allocation
page read and write
1FC15C5F000
trusted library allocation
page read and write
1FC14000000
heap
page read and write
63F000
heap
page read and write
1FC14110000
heap
page read and write
7FF848D90000
trusted library allocation
page read and write
1FC15BA8000
trusted library allocation
page read and write
7FF848D54000
trusted library allocation
page read and write
627000
heap
page read and write
1FC15CB5000
trusted library allocation
page read and write
1FC25951000
trusted library allocation
page read and write
1FC2E1E0000
heap
page read and write
1FC15BDB000
trusted library allocation
page read and write
2470000
trusted library allocation
page read and write
431000
unkown
page read and write
633000
heap
page read and write
1FC15B9A000
trusted library allocation
page read and write
5F8000
heap
page read and write
1FC14113000
heap
page read and write
1FC2FD12000
trusted library allocation
page read and write
125CA7CC000
heap
page read and write
1FC15C21000
trusted library allocation
page read and write
7FF848D52000
trusted library allocation
page read and write
1FC13FCC000
heap
page read and write
1FC15B7F000
trusted library allocation
page read and write
1FC13F00000
heap
page read and write
1FC2FCF4000
trusted library allocation
page read and write
1FC2E463000
heap
page read and write
1FC13FA0000
trusted library allocation
page read and write
60C000
heap
page read and write
1FC14150000
heap
page read and write
62B000
heap
page read and write
408000
unkown
page readonly
62B000
heap
page read and write
7FF848D5D000
trusted library allocation
page execute and read and write
2310000
heap
page read and write
7FF848D8D000
trusted library allocation
page execute and read and write
3C2000
unkown
page readonly
5F0000
heap
page read and write
23D4000
heap
page read and write
A1574FE000
stack
page read and write
65C000
stack
page read and write
1FC2F654000
heap
page read and write
1FC15BD5000
trusted library allocation
page read and write
7FF848F10000
trusted library allocation
page read and write
5BE000
stack
page read and write
1FC14059000
heap
page read and write
25D0000
heap
page read and write
291F000
stack
page read and write
1FC25941000
trusted library allocation
page read and write
125CC390000
heap
page execute and read and write
4A0000
heap
page read and write
1FC15BC8000
trusted library allocation
page read and write
125CA5B0000
unkown
page readonly
40A000
unkown
page write copy
7FF848D60000
trusted library allocation
page read and write
125E4BC0000
heap
page read and write
1FC14195000
heap
page read and write
91E000
heap
page read and write
759000
stack
page read and write
125CA9B0000
trusted library allocation
page read and write
1FC15C2A000
trusted library allocation
page read and write
C5E000
stack
page read and write
A1572FF000
stack
page read and write
125E4BD0000
heap
page read and write
7FF848F20000
trusted library allocation
page read and write
1FC14120000
heap
page execute and read and write
125DC3AD000
trusted library allocation
page read and write
2A51FE000
stack
page read and write
4B90000
heap
page read and write
1FC14038000
heap
page read and write
24FE000
stack
page read and write
1FC15C64000
trusted library allocation
page read and write
1FC2E4ED000
heap
page read and write
1FC2F710000
trusted library allocation
page read and write
7FF848D50000
trusted library allocation
page read and write
125CC480000
trusted library allocation
page read and write
125CAA00000
heap
page read and write
A1578FE000
stack
page read and write
A1573FC000
stack
page read and write
1FC15C58000
trusted library allocation
page read and write
1FC2E1C0000
trusted library allocation
page read and write
1FC13C72000
unkown
page readonly
7FF848D74000
trusted library allocation
page read and write
400000
unkown
page readonly
7FF848D6D000
trusted library allocation
page execute and read and write
8C5000
heap
page read and write
1FC2F646000
heap
page read and write
7FF848EF0000
trusted library allocation
page read and write
7FF848E90000
trusted library allocation
page execute and read and write
1FC30FF9000
heap
page read and write
7FF848E70000
trusted library allocation
page execute and read and write
1FC2FAB0000
unkown
page readonly
248A000
trusted library allocation
page execute and read and write
1FC15BEE000
trusted library allocation
page read and write
1FC15CB2000
trusted library allocation
page read and write
125CC250000
heap
page read and write
125CA7CA000
heap
page read and write
C60000
heap
page read and write
7FF848D73000
trusted library allocation
page execute and read and write
1FC15C3F000
trusted library allocation
page read and write
1FC2FB28000
unkown
page readonly
638000
heap
page read and write
125CA7BA000
heap
page read and write
125DC3B1000
trusted library allocation
page read and write
1FC1403E000
heap
page read and write
2474000
trusted library allocation
page read and write
25C0000
trusted library allocation
page read and write
49E000
stack
page read and write
98000
stack
page read and write
7FF848E56000
trusted library allocation
page execute and read and write
125CA7FA000
heap
page read and write
2A55FF000
stack
page read and write
915000
heap
page read and write
7FF848D63000
trusted library allocation
page read and write
125CA750000
heap
page read and write
7FF848F00000
trusted library allocation
page read and write
21E0000
heap
page read and write
1FC15C14000
trusted library allocation
page read and write
1FC14003000
heap
page read and write
60F000
heap
page read and write
1FC15941000
trusted library allocation
page read and write
2A59FE000
stack
page read and write
8A0000
heap
page read and write
1FC13E00000
heap
page read and write
1FC15BF6000
trusted library allocation
page read and write
7FF848E20000
trusted library allocation
page read and write
26DF000
stack
page read and write
2320000
heap
page read and write
2A56FE000
stack
page read and write
1FC13F75000
heap
page read and write
1FC2E2B6000
heap
page execute and read and write
22EF000
stack
page read and write
1FC15C0F000
trusted library allocation
page read and write
638000
heap
page read and write
125CC240000
heap
page read and write
7FF848F20000
trusted library allocation
page read and write
952000
heap
page read and write
125CAA05000
heap
page read and write
1FC13FB3000
trusted library allocation
page read and write
125CA740000
heap
page read and write
1FC15BB1000
trusted library allocation
page read and write
125DC3A1000
trusted library allocation
page read and write
1FC2E4C0000
heap
page read and write
125CA7CF000
heap
page read and write
400000
unkown
page readonly
A1577FE000
stack
page read and write
1FC2E3D3000
heap
page read and write
93E000
heap
page read and write
1FC15C2F000
trusted library allocation
page read and write
7FF848D83000
trusted library allocation
page read and write
2A54FF000
stack
page read and write
7FF848E10000
trusted library allocation
page execute and read and write
1FC15BB7000
trusted library allocation
page read and write
2A4D34000
stack
page read and write
8C0000
heap
page read and write
125E4C0D000
heap
page read and write
125CC1E0000
heap
page execute and read and write
946000
heap
page read and write
7FF848D80000
trusted library allocation
page read and write
1FC15C27000
trusted library allocation
page read and write
125CA960000
heap
page read and write
1FC13F80000
trusted library allocation
page read and write
281F000
stack
page read and write
B5F000
stack
page read and write
2A52FF000
stack
page read and write
449000
unkown
page readonly
8EF000
stack
page read and write
1FC13D38000
unkown
page readonly
401000
unkown
page execute read
1FC13F70000
heap
page read and write
1FC15C4B000
trusted library allocation
page read and write
1FC2E402000
heap
page read and write
2497000
trusted library allocation
page execute and read and write
1FC15AA7000
trusted library allocation
page read and write
471E000
stack
page read and write
1FC2E481000
heap
page read and write
1FC15C49000
trusted library allocation
page read and write
1FC14030000
heap
page read and write
1FC2E3B0000
heap
page read and write
1FC15BBF000
trusted library allocation
page read and write
26E1000
trusted library allocation
page read and write
7FF848D88000
trusted library allocation
page read and write
20FE000
stack
page read and write
1FC15B9C000
trusted library allocation
page read and write
42F000
unkown
page read and write
2A57FF000
stack
page read and write
91A000
heap
page read and write
910000
heap
page read and write
2463000
trusted library allocation
page execute and read and write
7FF848D7D000
trusted library allocation
page execute and read and write
7FF848DCC000
trusted library allocation
page execute and read and write
2A53FD000
stack
page read and write
1FC2E1A0000
heap
page read and write
401000
unkown
page execute read
125CC243000
heap
page read and write
7FF848F40000
trusted library allocation
page execute and read and write
641000
heap
page read and write
7FF848E2C000
trusted library allocation
page execute and read and write
1FC140E0000
heap
page read and write
632000
heap
page read and write
1FC2F610000
heap
page read and write
481E000
stack
page read and write
2510000
heap
page execute and read and write
1FC2F63F000
heap
page read and write
7FF848DAC000
trusted library allocation
page execute and read and write
7FF848D7D000
trusted library allocation
page execute and read and write
7FF848D70000
trusted library allocation
page read and write
1FC2E44A000
heap
page read and write
There are 301 hidden memdumps, click here to show them.