Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
loader.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\blockcomwinsavescrt\DKYQpYxB0fjo0It.vbe
|
data
|
dropped
|
|
|
|
C:\blockcomwinsavescrt\containercomponentSaves.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\containercomponentSaves.exe.log
|
CSV text
|
dropped
|
||
|
C:\blockcomwinsavescrt\jwlZX38GInff6rIBqWRHehXwajI.bat
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\loader.exe
|
"C:\Users\user\Desktop\loader.exe"
|
|
|
|
C:\Windows\SysWOW64\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\blockcomwinsavescrt\DKYQpYxB0fjo0It.vbe"
|
|
|
|
C:\blockcomwinsavescrt\containercomponentSaves.exe
|
"C:\blockcomwinsavescrt\containercomponentSaves.exe"
|
|
|
|
C:\Windows\SysWOW64\reg.exe
|
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\blockcomwinsavescrt\jwlZX38GInff6rIBqWRHehXwajI.bat" "
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
|
|
|
fp2e7a.wpc.phicdn.net
|
192.229.221.95
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
|
DisableTaskMgr
|
|
|
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
LangID
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.FriendlyAppName
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.ApplicationCompany
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\containercomponentSaves_RASMANCS
|
FileDirectory
|
There are 8 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
13067000
|
trusted library allocation
|
page read and write
|
|
|
|
2F11000
|
trusted library allocation
|
page read and write
|
|
|
|
2F59000
|
heap
|
page read and write
|
||
|
2EBD000
|
stack
|
page read and write
|
||
|
55FC000
|
stack
|
page read and write
|
||
|
4D30000
|
heap
|
page read and write
|
||
|
5140000
|
heap
|
page read and write
|
||
|
529E000
|
stack
|
page read and write
|
||
|
2AFB000
|
stack
|
page read and write
|
||
|
12F11000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B91C000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F2A000
|
heap
|
page read and write
|
||
|
1C3EE000
|
stack
|
page read and write
|
||
|
2C92000
|
heap
|
page read and write
|
||
|
5247000
|
heap
|
page read and write
|
||
|
53DE000
|
stack
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
7FFD9B8D3000
|
trusted library allocation
|
page read and write
|
||
|
5130000
|
heap
|
page read and write
|
||
|
6900000
|
trusted library allocation
|
page read and write
|
||
|
2F46000
|
heap
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
7FFD9BAF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
71FE000
|
stack
|
page read and write
|
||
|
580B000
|
stack
|
page read and write
|
||
|
56CE000
|
stack
|
page read and write
|
||
|
133000
|
unkown
|
page readonly
|
||
|
30B8000
|
trusted library allocation
|
page read and write
|
||
|
2C80000
|
heap
|
page read and write
|
||
|
314A000
|
heap
|
page read and write
|
||
|
1B49D000
|
stack
|
page read and write
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
2C8F000
|
heap
|
page read and write
|
||
|
2CFC000
|
heap
|
page read and write
|
||
|
2B76000
|
stack
|
page read and write
|
||
|
31BE000
|
stack
|
page read and write
|
||
|
1C4EE000
|
stack
|
page read and write
|
||
|
7FFD9B8E0000
|
trusted library allocation
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
100000
|
unkown
|
page readonly
|
||
|
7FFD9BA6A000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B8C2000
|
trusted library allocation
|
page read and write
|
||
|
2B99000
|
stack
|
page read and write
|
||
|
7FFD9B97C000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
2D50000
|
trusted library allocation
|
page read and write
|
||
|
32D0000
|
heap
|
page read and write
|
||
|
7FFD9B8DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F0F000
|
stack
|
page read and write
|
||
|
2CA1000
|
heap
|
page read and write
|
||
|
2E20000
|
heap
|
page readonly
|
||
|
2CB7000
|
heap
|
page read and write
|
||
|
32BE000
|
stack
|
page read and write
|
||
|
32D8000
|
heap
|
page read and write
|
||
|
7FFD9B976000
|
trusted library allocation
|
page read and write
|
||
|
3140000
|
heap
|
page read and write
|
||
|
100000
|
unkown
|
page readonly
|
||
|
2CAF000
|
heap
|
page read and write
|
||
|
162000
|
unkown
|
page write copy
|
||
|
7FFD9B8E4000
|
trusted library allocation
|
page read and write
|
||
|
2CA1000
|
heap
|
page read and write
|
||
|
557E000
|
stack
|
page read and write
|
||
|
30AE000
|
trusted library allocation
|
page read and write
|
||
|
2C50000
|
heap
|
page read and write
|
||
|
2E10000
|
heap
|
page read and write
|
||
|
7FFD9BA70000
|
trusted library allocation
|
page read and write
|
||
|
C10000
|
unkown
|
page readonly
|
||
|
2D90000
|
trusted library allocation
|
page read and write
|
||
|
2FAF000
|
heap
|
page read and write
|
||
|
131D3000
|
trusted library allocation
|
page read and write
|
||
|
11D4000
|
heap
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
1A7000
|
unkown
|
page readonly
|
||
|
2CB6000
|
heap
|
page read and write
|
||
|
7FFD9B8ED000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FAF000
|
heap
|
page read and write
|
||
|
2DB0000
|
heap
|
page execute and read and write
|
||
|
7FFD9B8EB000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B840000
|
trusted library section
|
page read and write
|
||
|
32DB000
|
heap
|
page read and write
|
||
|
2C97000
|
heap
|
page read and write
|
||
|
1BD83000
|
stack
|
page read and write
|
||
|
2C9D000
|
heap
|
page read and write
|
||
|
2E9D000
|
stack
|
page read and write
|
||
|
1175000
|
heap
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
11A1000
|
heap
|
page read and write
|
||
|
162000
|
unkown
|
page readonly
|
||
|
2B93000
|
stack
|
page read and write
|
||
|
1B883000
|
heap
|
page execute and read and write
|
||
|
72FE000
|
stack
|
page read and write
|
||
|
1201000
|
heap
|
page read and write
|
||
|
2F26000
|
heap
|
page read and write
|
||
|
7FFD9B8C3000
|
trusted library allocation
|
page execute and read and write
|
||
|
10F6000
|
stack
|
page read and write
|
||
|
2E30000
|
heap
|
page read and write
|
||
|
1BA8F000
|
stack
|
page read and write
|
||
|
2F29000
|
heap
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
7FFD9B980000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FFA000
|
trusted library allocation
|
page read and write
|
||
|
6903000
|
heap
|
page read and write
|
||
|
2B9E000
|
stack
|
page read and write
|
||
|
2CC1000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
1B98E000
|
stack
|
page read and write
|
||
|
2B86000
|
stack
|
page read and write
|
||
|
4FEF000
|
stack
|
page read and write
|
||
|
12F21000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9BA63000
|
trusted library allocation
|
page read and write
|
||
|
5246000
|
heap
|
page read and write
|
||
|
1BC8A000
|
stack
|
page read and write
|
||
|
1C0AF000
|
stack
|
page read and write
|
||
|
1360000
|
heap
|
page read and write
|
||
|
55BE000
|
stack
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
2F16000
|
heap
|
page read and write
|
||
|
4FB0000
|
heap
|
page read and write
|
||
|
2F2D000
|
heap
|
page read and write
|
||
|
2CAA000
|
heap
|
page read and write
|
||
|
2F81000
|
heap
|
page read and write
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
30BE000
|
trusted library allocation
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
2C94000
|
heap
|
page read and write
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
1BF90000
|
heap
|
page execute and read and write
|
||
|
2C78000
|
heap
|
page read and write
|
||
|
2CA0000
|
heap
|
page read and write
|
||
|
2CC0000
|
heap
|
page read and write
|
||
|
2CAE000
|
heap
|
page read and write
|
||
|
2F1D000
|
heap
|
page read and write
|
||
|
7FFD9B9A6000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B8CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FB4000
|
heap
|
page read and write
|
||
|
2EDE000
|
stack
|
page read and write
|
||
|
3370000
|
heap
|
page read and write
|
||
|
1C5ED000
|
stack
|
page read and write
|
||
|
2C8E000
|
heap
|
page read and write
|
||
|
7FFD9B9E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2B5E000
|
stack
|
page read and write
|
||
|
2CB4000
|
heap
|
page read and write
|
||
|
2FAF000
|
heap
|
page read and write
|
||
|
5000000
|
heap
|
page read and write
|
||
|
2F2E000
|
heap
|
page read and write
|
||
|
2C71000
|
heap
|
page read and write
|
||
|
2F1E000
|
heap
|
page read and write
|
||
|
6904000
|
heap
|
page read and write
|
||
|
2F46000
|
heap
|
page read and write
|
||
|
2CBE000
|
heap
|
page read and write
|
||
|
7FFD9BA8B000
|
trusted library allocation
|
page read and write
|
||
|
2E00000
|
heap
|
page read and write
|
||
|
7FFD9BA90000
|
trusted library allocation
|
page read and write
|
||
|
52C7000
|
heap
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
7FF434ED0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1110000
|
heap
|
page read and write
|
||
|
2F5D000
|
heap
|
page read and write
|
||
|
2C9B000
|
heap
|
page read and write
|
||
|
7FFD9BAB0000
|
trusted library allocation
|
page read and write
|
||
|
7300000
|
heap
|
page read and write
|
||
|
75FC000
|
stack
|
page read and write
|
||
|
2CA2000
|
heap
|
page read and write
|
||
|
2B7C000
|
stack
|
page read and write
|
||
|
2C98000
|
heap
|
page read and write
|
||
|
3580000
|
heap
|
page read and write
|
||
|
12F1D000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B8C4000
|
trusted library allocation
|
page read and write
|
||
|
159E000
|
stack
|
page read and write
|
||
|
1AF40000
|
trusted library allocation
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
1390000
|
heap
|
page read and write
|
||
|
E1D000
|
stack
|
page read and write
|
||
|
27AB000
|
stack
|
page read and write
|
||
|
2BA0000
|
heap
|
page read and write
|
||
|
5245000
|
heap
|
page read and write
|
||
|
2EF8000
|
heap
|
page read and write
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
1160000
|
heap
|
page read and write
|
||
|
2E50000
|
heap
|
page read and write
|
||
|
2C78000
|
heap
|
page read and write
|
||
|
7FFD9BA6C000
|
trusted library allocation
|
page read and write
|
||
|
5680000
|
heap
|
page read and write
|
||
|
2C9E000
|
heap
|
page read and write
|
||
|
2C70000
|
heap
|
page read and write
|
||
|
2B10000
|
heap
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
1394000
|
heap
|
page read and write
|
||
|
7FFD9BA83000
|
trusted library allocation
|
page read and write
|
||
|
1BEA7000
|
heap
|
page read and write
|
||
|
1375D000
|
trusted library allocation
|
page read and write
|
||
|
2CC0000
|
heap
|
page read and write
|
||
|
7FFD9BAA0000
|
trusted library allocation
|
page read and write
|
||
|
2CAD000
|
heap
|
page read and write
|
||
|
2F1F000
|
heap
|
page read and write
|
||
|
2CB9000
|
heap
|
page read and write
|
||
|
7FFD9BAE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CB0000
|
heap
|
page read and write
|
||
|
D7C000
|
unkown
|
page readonly
|
||
|
2F5D000
|
heap
|
page read and write
|
||
|
7FFD9B8D7000
|
trusted library allocation
|
page read and write
|
||
|
1130000
|
heap
|
page read and write
|
||
|
2F46000
|
heap
|
page read and write
|
||
|
1BE8E000
|
stack
|
page read and write
|
||
|
4F90000
|
heap
|
page read and write
|
||
|
161000
|
unkown
|
page read and write
|
||
|
2F81000
|
trusted library allocation
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
11A3000
|
heap
|
page read and write
|
||
|
2F6E000
|
stack
|
page read and write
|
||
|
2CB9000
|
heap
|
page read and write
|
||
|
2F2D000
|
heap
|
page read and write
|
||
|
133000
|
unkown
|
page readonly
|
||
|
2CB9000
|
heap
|
page read and write
|
||
|
2C93000
|
heap
|
page read and write
|
||
|
2B6C000
|
stack
|
page read and write
|
||
|
7FFD9B970000
|
trusted library allocation
|
page read and write
|
||
|
13E000
|
unkown
|
page read and write
|
||
|
52DE000
|
stack
|
page read and write
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
1B880000
|
heap
|
page execute and read and write
|
||
|
149E000
|
stack
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
4D9E000
|
stack
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
2FEE000
|
stack
|
page read and write
|
||
|
D80000
|
unkown
|
page readonly
|
||
|
2F46000
|
heap
|
page read and write
|
||
|
2FAF000
|
heap
|
page read and write
|
||
|
301E000
|
stack
|
page read and write
|
||
|
524B000
|
heap
|
page read and write
|
||
|
4FE1000
|
trusted library allocation
|
page read and write
|
||
|
57CF000
|
stack
|
page read and write
|
||
|
558D000
|
stack
|
page read and write
|
||
|
1217000
|
heap
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
2C99000
|
heap
|
page read and write
|
||
|
2BA2000
|
stack
|
page read and write
|
||
|
4EEE000
|
stack
|
page read and write
|
||
|
2EF0000
|
heap
|
page read and write
|
||
|
1A7000
|
unkown
|
page readonly
|
||
|
3378000
|
heap
|
page read and write
|
||
|
7FFD9B8DC000
|
trusted library allocation
|
page read and write
|
||
|
11CD000
|
heap
|
page read and write
|
||
|
2F1F000
|
stack
|
page read and write
|
||
|
101000
|
unkown
|
page execute read
|
||
|
2CB7000
|
heap
|
page read and write
|
||
|
2CC0000
|
heap
|
page read and write
|
||
|
2FAF000
|
stack
|
page read and write
|
||
|
2BD5000
|
heap
|
page read and write
|
||
|
4E9F000
|
stack
|
page read and write
|
||
|
13E000
|
unkown
|
page write copy
|
||
|
1380000
|
trusted library allocation
|
page read and write
|
||
|
2C95000
|
heap
|
page read and write
|
||
|
2D70000
|
heap
|
page read and write
|
||
|
5247000
|
heap
|
page read and write
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
2C58000
|
heap
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
7FFD9BAC0000
|
trusted library allocation
|
page read and write
|
||
|
553E000
|
stack
|
page read and write
|
||
|
2F29000
|
heap
|
page read and write
|
||
|
101000
|
unkown
|
page execute read
|
||
|
5120000
|
heap
|
page read and write
|
||
|
7FFD9BA80000
|
trusted library allocation
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
2F5D000
|
heap
|
page read and write
|
||
|
144000
|
unkown
|
page read and write
|
||
|
11CB000
|
heap
|
page read and write
|
||
|
2F20000
|
heap
|
page read and write
|
||
|
2B97000
|
stack
|
page read and write
|
||
|
1364000
|
heap
|
page read and write
|
||
|
163000
|
unkown
|
page readonly
|
||
|
2CA0000
|
heap
|
page read and write
|
||
|
136E3000
|
trusted library allocation
|
page read and write
|
||
|
2BAA000
|
stack
|
page read and write
|
||
|
2F29000
|
heap
|
page read and write
|
||
|
568E000
|
stack
|
page read and write
|
||
|
2CB9000
|
heap
|
page read and write
|
||
|
7FFD9BAD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FAF000
|
heap
|
page read and write
|
||
|
1100000
|
heap
|
page read and write
|
||
|
2F29000
|
heap
|
page read and write
|
||
|
2F19000
|
heap
|
page read and write
|
||
|
7FFD9BA60000
|
trusted library allocation
|
page read and write
|
||
|
6984000
|
heap
|
page read and write
|
||
|
C12000
|
unkown
|
page readonly
|
||
|
2CD7000
|
heap
|
page read and write
|
||
|
74FF000
|
stack
|
page read and write
|
||
|
2E55000
|
heap
|
page read and write
|
||
|
3092000
|
trusted library allocation
|
page read and write
|
||
|
1C1AD000
|
stack
|
page read and write
|
||
|
1BB8E000
|
stack
|
page read and write
|
||
|
1BEEF000
|
heap
|
page read and write
|
||
|
1330000
|
heap
|
page read and write
|
||
|
2AA6000
|
stack
|
page read and write
|
||
|
330F000
|
stack
|
page read and write
|
||
|
2C95000
|
heap
|
page read and write
|
||
|
2B80000
|
stack
|
page read and write
|
||
|
5130000
|
trusted library allocation
|
page read and write
|
||
|
590C000
|
stack
|
page read and write
|
||
|
C10000
|
unkown
|
page readonly
|
||
|
7FFD9B8C0000
|
trusted library allocation
|
page read and write
|
||
|
519E000
|
stack
|
page read and write
|
||
|
1BE90000
|
heap
|
page read and write
|
There are 298 hidden memdumps, click here to show them.