IOC Report
3lH2EWD4wU.exe

loading gif

Files

File Path
Type
Category
Malicious
3lH2EWD4wU.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf
ASCII text, with very long lines (4175), with CRLF, LF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Stofnd\3lH2EWD4wU.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
 malicious
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Stofnd\3lH2EWD4wU.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kh04k5c3.vap.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvtivhly.ifu.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sj5z0h4u.kez.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uga2spzi.vbw.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Drtrsklers.gje
data
dropped
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Netvrkslsninger.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Stofnd\Revisionistiskes.int
data
dropped
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Stofnd\fortje.kur
data
dropped
C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Zigzaggy.aci
data
dropped
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\3lH2EWD4wU.exe
"C:\Users\user\Desktop\3lH2EWD4wU.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden "$Fervence=Get-Content -raw 'C:\Users\user\AppData\Roaming\mobiliseredes\forbundsbank\Nahani132.Udf';$Tuffen=$Fervence.SubString(71717,3);.$Tuffen($Fervence) "
malicious
C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://www.bookinginfo.asia/R
unknown
http://nsis.sf.net/NSIS_Error
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.bin~Y
unknown
https://www.bookinginfo.asia/mP
unknown
https://www.bookinginfo.asia/.asia:443)
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.binv
unknown
https://www.bookinginfo.asia/rP
unknown
https://www.bookinginfo.asia/www.bookinginfo.asia5
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.bin;
unknown
https://www.bookinginfo.asia/n
unknown
https://www.bookinginfo.asia/Win64;
unknown
https://www.bookinginfo.asia/:P
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.bin1
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://www.bookinginfo.asia/www.bookinginfo.asia
unknown
https://www.bookinginfo.asia/dP
unknown
https://www.bookinginfo.asia/
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.bineYQ
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.bin
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.bin)
unknown
https://www.bookinginfo.asia/pkeZmGiUuTK20.binJ
unknown
There are 11 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www.bookinginfo.asia
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\dissentieringernes\Bilassistenters
soyuz

Memdumps

Base Address
Regiontype
Protect
Malicious
7D74000
remote allocation
page execute and read and write
 malicious
8AC6000
heap
page read and write
8CF0000
direct allocation
page read and write
23A50000
direct allocation
page read and write
223E000
stack
page read and write
2400000
heap
page read and write
53E000
stack
page read and write
23AD0000
direct allocation
page read and write
4B74000
remote allocation
page execute and read and write
4F0000
heap
page read and write
401000
unkown
page execute read
8A50000
direct allocation
page read and write
4E0000
heap
page read and write
5CE000
heap
page read and write
5F74000
remote allocation
page execute and read and write
8A60000
heap
page read and write
23AA0000
direct allocation
page read and write
8AE8000
heap
page read and write
25B4000
heap
page read and write
23A90000
direct allocation
page read and write
430000
unkown
page read and write
8D10000
heap
page read and write
42C000
unkown
page read and write
23A40000
direct allocation
page read and write
408000
unkown
page readonly
4174000
remote allocation
page execute and read and write
23FCD000
stack
page read and write
43E000
unkown
page read and write
440000
unkown
page readonly
2B7A000
stack
page read and write
85F000
stack
page read and write
88B0000
heap
page read and write
5E4000
heap
page read and write
25B0000
heap
page read and write
2530000
heap
page read and write
98000
stack
page read and write
A5F000
stack
page read and write
23A70000
direct allocation
page read and write
23F8D000
stack
page read and write
8AD0000
heap
page read and write
5D2000
heap
page read and write
2404E000
stack
page read and write
240DE000
stack
page read and write
23E30000
heap
page read and write
8774000
remote allocation
page execute and read and write
2BE0000
heap
page read and write
400000
unkown
page readonly
23AC0000
direct allocation
page read and write
5C4000
heap
page read and write
23F4D000
stack
page read and write
49E000
stack
page read and write
4060000
remote allocation
page execute and read and write
8820000
heap
page read and write
2540000
heap
page read and write
440000
unkown
page readonly
23F0D000
stack
page read and write
23E8E000
stack
page read and write
2408F000
stack
page read and write
400000
unkown
page readonly
40A000
unkown
page read and write
2411D000
stack
page read and write
4E5000
heap
page read and write
5574000
remote allocation
page execute and read and write
23A80000
direct allocation
page read and write
88B5000
heap
page read and write
23ECF000
stack
page read and write
7374000
remote allocation
page execute and read and write
8A6A000
heap
page read and write
450000
heap
page read and write
4DE000
stack
page read and write
401000
unkown
page execute read
570000
heap
page read and write
6974000
remote allocation
page execute and read and write
23AB0000
direct allocation
page read and write
250F000
stack
page read and write
590000
heap
page read and write
2BF0000
heap
page readonly
5C1000
heap
page read and write
2270000
heap
page read and write
23BE000
stack
page read and write
95F000
stack
page read and write
19A000
stack
page read and write
408000
unkown
page readonly
8D00000
direct allocation
page read and write
88A0000
direct allocation
page read and write
40A000
unkown
page write copy
2275000
heap
page read and write
23A60000
direct allocation
page read and write
435000
unkown
page read and write
237F000
stack
page read and write
2B3C000
stack
page read and write
598000
heap
page read and write
There are 82 hidden memdumps, click here to show them.