IOC Report
Loader.exe

loading gif

Files

File Path
Type
Category
Malicious
Loader.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Loader.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\gdi32.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Loader.exe
"C:\Users\user\Desktop\Loader.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
servicedny.site
malicious
https://mafnufacut.cyou/api
104.21.41.158
 malicious
goalyfeastz.site
malicious
contemteny.site
malicious
opposezmny.site
malicious
authorisev.site
malicious
faulteyotk.site
malicious
seallysl.site
malicious
mafnufacut.cyou
malicious
dilemmadu.site
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://mafnufacut.cyou/gra
unknown
https://mafnufacut.cyou/h
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mafnufacut.cyou:443/api
unknown
https://mafnufacut.cyou/pi
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://mafnufacut.cyou/p
unknown
https://mafnufacut.cyou/nkkpib0
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://mafnufacut.cyou/r
unknown
https://www.ecosia.org/newtab/
unknown
https://mafnufacut.cyou/The
unknown
https://mafnufacut.cyou/A
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://mafnufacut.cyou/2U
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://mafnufacut.cyou/apiu
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://mafnufacut.cyou/
unknown
https://mafnufacut.cyou/t7c5
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://www.mozilla.or
unknown
https://mafnufacut.cyou/piE
unknown
https://mafnufacut.cyou/apiZ
unknown
There are 32 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mafnufacut.cyou
104.21.41.158
 malicious

IPs

IP
Domain
Country
Malicious
104.21.41.158
mafnufacut.cyou
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
33D6000
remote allocation
page readonly
 malicious
3677000
heap
page read and write
530D000
stack
page read and write
5B0E000
trusted library allocation
page read and write
5B57000
trusted library allocation
page read and write
5AFA000
trusted library allocation
page read and write
368B000
heap
page read and write
5B15000
trusted library allocation
page read and write
36C4000
heap
page read and write
36C4000
heap
page read and write
368B000
heap
page read and write
36AF000
heap
page read and write
5B52000
trusted library allocation
page read and write
515E000
stack
page read and write
36A3000
heap
page read and write
5B2C000
trusted library allocation
page read and write
C40000
heap
page read and write
5B45000
trusted library allocation
page read and write
5B3D000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B0A000
trusted library allocation
page read and write
E54000
heap
page read and write
E5F000
heap
page read and write
C60000
heap
page read and write
5B57000
trusted library allocation
page read and write
36A9000
heap
page read and write
5B5D000
trusted library allocation
page read and write
5B4B000
trusted library allocation
page read and write
38CF000
stack
page read and write
3688000
heap
page read and write
D44000
trusted library allocation
page read and write
367D000
heap
page read and write
2A8F000
stack
page read and write
5AFA000
trusted library allocation
page read and write
358E000
stack
page read and write
5B09000
trusted library allocation
page read and write
3677000
heap
page read and write
5B27000
trusted library allocation
page read and write
A76D000
stack
page read and write
5100000
heap
page read and write
50ED000
stack
page read and write
5B00000
trusted library allocation
page read and write
5B08000
trusted library allocation
page read and write
5B74000
trusted library allocation
page read and write
5B18000
trusted library allocation
page read and write
5B3C000
trusted library allocation
page read and write
3686000
heap
page read and write
36AF000
heap
page read and write
CF0000
heap
page read and write
5AF4000
trusted library allocation
page read and write
2D10000
heap
page execute and read and write
D50000
trusted library allocation
page read and write
5AFA000
trusted library allocation
page read and write
5AFA000
trusted library allocation
page read and write
5B35000
trusted library allocation
page read and write
36C4000
heap
page read and write
3391000
remote allocation
page execute read
5B4C000
trusted library allocation
page read and write
36B7000
heap
page read and write
5B83000
trusted library allocation
page read and write
3680000
heap
page read and write
590E000
stack
page read and write
5B5D000
trusted library allocation
page read and write
36C4000
heap
page read and write
5AF1000
trusted library allocation
page read and write
35D0000
heap
page read and write
5B0E000
trusted library allocation
page read and write
5AF6000
trusted library allocation
page read and write
36B5000
heap
page read and write
2D28000
trusted library allocation
page read and write
D43000
trusted library allocation
page execute and read and write
36AF000
heap
page read and write
2D36000
trusted library allocation
page read and write
36AF000
heap
page read and write
36C4000
heap
page read and write
3420000
heap
page read and write
5B5B000
trusted library allocation
page read and write
368B000
heap
page read and write
3D21000
trusted library allocation
page read and write
369E000
heap
page read and write
5B53000
trusted library allocation
page read and write
DB8000
heap
page read and write
5B29000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B18000
trusted library allocation
page read and write
368B000
heap
page read and write
5CD1000
trusted library allocation
page read and write
2D32000
trusted library allocation
page read and write
5B2C000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B43000
trusted library allocation
page read and write
5B24000
trusted library allocation
page read and write
367B000
heap
page read and write
5B28000
trusted library allocation
page read and write
5B2B000
trusted library allocation
page read and write
E18000
heap
page read and write
5B3B000
trusted library allocation
page read and write
5B53000
trusted library allocation
page read and write
325B000
stack
page read and write
5B15000
trusted library allocation
page read and write
5AF1000
trusted library allocation
page read and write
3692000
heap
page read and write
5B6D000
trusted library allocation
page read and write
5320000
remote allocation
page read and write
5B2B000
trusted library allocation
page read and write
6E4F1000
unkown
page execute read
5B44000
trusted library allocation
page read and write
5B1A000
trusted library allocation
page read and write
33E9000
remote allocation
page readonly
5B05000
trusted library allocation
page read and write
5B3D000
trusted library allocation
page read and write
3604000
heap
page read and write
368B000
heap
page read and write
36AF000
heap
page read and write
5B00000
trusted library allocation
page read and write
335A000
stack
page read and write
36C4000
heap
page read and write
3590000
heap
page read and write
5B2C000
trusted library allocation
page read and write
5B1A000
trusted library allocation
page read and write
36C4000
heap
page read and write
3505000
heap
page read and write
5B53000
trusted library allocation
page read and write
134E000
stack
page read and write
36C4000
heap
page read and write
1370000
heap
page read and write
36C4000
heap
page read and write
5B2C000
trusted library allocation
page read and write
5AF1000
trusted library allocation
page read and write
DD6000
heap
page read and write
5B0F000
trusted library allocation
page read and write
35B0000
heap
page read and write
36C4000
heap
page read and write
36AF000
heap
page read and write
36C4000
heap
page read and write
2ACE000
stack
page read and write
5B18000
trusted library allocation
page read and write
5B2B000
trusted library allocation
page read and write
5B85000
trusted library allocation
page read and write
36AF000
heap
page read and write
57CF000
stack
page read and write
5AF2000
trusted library allocation
page read and write
36AF000
heap
page read and write
5B00000
trusted library allocation
page read and write
5C99000
trusted library allocation
page read and write
5B05000
trusted library allocation
page read and write
5B24000
trusted library allocation
page read and write
5B4D000
trusted library allocation
page read and write
35D8000
heap
page read and write
2CBD000
stack
page read and write
5160000
heap
page execute and read and write
36C4000
heap
page read and write
5C11000
trusted library allocation
page read and write
5B18000
trusted library allocation
page read and write
1350000
heap
page read and write
36C4000
heap
page read and write
D77000
trusted library allocation
page execute and read and write
369E000
heap
page read and write
9DB000
stack
page read and write
5B3D000
trusted library allocation
page read and write
5B31000
trusted library allocation
page read and write
5AFF000
trusted library allocation
page read and write
5B4E000
trusted library allocation
page read and write
DBE000
heap
page read and write
6E50B000
unkown
page read and write
36B7000
heap
page read and write
5AF6000
trusted library allocation
page read and write
3507000
heap
page read and write
369E000
heap
page read and write
37CE000
stack
page read and write
5B3D000
trusted library allocation
page read and write
5CC9000
trusted library allocation
page read and write
107F000
stack
page read and write
5AF6000
trusted library allocation
page read and write
5B61000
trusted library allocation
page read and write
368B000
heap
page read and write
CEE000
stack
page read and write
5B81000
trusted library allocation
page read and write
DA0000
trusted library allocation
page execute and read and write
2CFE000
stack
page read and write
5B5B000
trusted library allocation
page read and write
3688000
heap
page read and write
36AE000
heap
page read and write
56CE000
stack
page read and write
35FE000
heap
page read and write
5AF1000
trusted library allocation
page read and write
5B2B000
trusted library allocation
page read and write
3613000
heap
page read and write
36C4000
heap
page read and write
5B55000
trusted library allocation
page read and write
5B5C000
trusted library allocation
page read and write
5B63000
trusted library allocation
page read and write
5B44000
trusted library allocation
page read and write
5B2B000
trusted library allocation
page read and write
369E000
heap
page read and write
6E55E000
unkown
page readonly
520D000
stack
page read and write
5B0E000
trusted library allocation
page read and write
5AFF000
trusted library allocation
page read and write
5B25000
trusted library allocation
page read and write
5B24000
trusted library allocation
page read and write
5A7F000
stack
page read and write
5B1C000
trusted library allocation
page read and write
36C3000
heap
page read and write
CAE000
stack
page read and write
36AE000
heap
page read and write
5B1C000
trusted library allocation
page read and write
36C4000
heap
page read and write
36AF000
heap
page read and write
369E000
heap
page read and write
2AE0000
trusted library allocation
page read and write
36C4000
heap
page read and write
3699000
heap
page read and write
3694000
heap
page read and write
36C4000
heap
page read and write
36AE000
heap
page read and write
3500000
heap
page read and write
5BF8000
trusted library allocation
page read and write
5AFA000
trusted library allocation
page read and write
369E000
heap
page read and write
A66E000
stack
page read and write
5B18000
trusted library allocation
page read and write
36AF000
heap
page read and write
5B9D000
trusted library allocation
page read and write
5B0F000
trusted library allocation
page read and write
5B75000
trusted library allocation
page read and write
5AF1000
trusted library allocation
page read and write
5B1C000
trusted library allocation
page read and write
36AE000
heap
page read and write
36C4000
heap
page read and write
36AE000
heap
page read and write
5B27000
trusted library allocation
page read and write
36AF000
heap
page read and write
5B24000
trusted library allocation
page read and write
752E000
stack
page read and write
36C4000
heap
page read and write
5B5C000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B2B000
trusted library allocation
page read and write
5BF2000
trusted library allocation
page read and write
5BA5000
trusted library allocation
page read and write
580E000
stack
page read and write
5CC1000
trusted library allocation
page read and write
5D61000
trusted library allocation
page read and write
A7AE000
stack
page read and write
5AF6000
trusted library allocation
page read and write
36C4000
heap
page read and write
5AFA000
trusted library allocation
page read and write
368D000
heap
page read and write
DE4000
heap
page read and write
A8AE000
stack
page read and write
5B5D000
trusted library allocation
page read and write
5B2E000
trusted library allocation
page read and write
E4D000
heap
page read and write
369E000
heap
page read and write
5B24000
trusted library allocation
page read and write
5B4F000
trusted library allocation
page read and write
3688000
heap
page read and write
36AE000
heap
page read and write
5B15000
trusted library allocation
page read and write
5B5C000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B3B000
trusted library allocation
page read and write
369D000
heap
page read and write
DDB000
heap
page read and write
36C4000
heap
page read and write
36C4000
heap
page read and write
5B2E000
trusted library allocation
page read and write
5BF0000
heap
page read and write
800000
unkown
page readonly
5B14000
trusted library allocation
page read and write
5AFA000
trusted library allocation
page read and write
2AD0000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B31000
trusted library allocation
page read and write
5BF1000
heap
page read and write
3390000
remote allocation
page execute and read and write
5AF1000
trusted library allocation
page read and write
5B2C000
trusted library allocation
page read and write
369E000
heap
page read and write
5B24000
trusted library allocation
page read and write
2D21000
trusted library allocation
page read and write
5B17000
trusted library allocation
page read and write
D30000
trusted library allocation
page read and write
5B0C000
trusted library allocation
page read and write
5AF1000
trusted library allocation
page read and write
3690000
heap
page read and write
5AFA000
trusted library allocation
page read and write
5B64000
trusted library allocation
page read and write
5B05000
trusted library allocation
page read and write
5AE0000
heap
page read and write
5320000
remote allocation
page read and write
2B10000
heap
page read and write
354E000
stack
page read and write
5AFA000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B1C000
trusted library allocation
page read and write
4A55000
trusted library allocation
page read and write
5320000
remote allocation
page read and write
5B55000
trusted library allocation
page read and write
5B1C000
trusted library allocation
page read and write
5C29000
trusted library allocation
page read and write
36C4000
heap
page read and write
D7B000
trusted library allocation
page execute and read and write
DF0000
heap
page read and write
5B09000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B5D000
trusted library allocation
page read and write
36AF000
heap
page read and write
5B25000
trusted library allocation
page read and write
36C4000
heap
page read and write
50AD000
stack
page read and write
5B41000
trusted library allocation
page read and write
5B5A000
trusted library allocation
page read and write
5B50000
trusted library allocation
page read and write
5AF6000
trusted library allocation
page read and write
8DC000
stack
page read and write
5B13000
trusted library allocation
page read and write
5B47000
trusted library allocation
page read and write
5B2B000
trusted library allocation
page read and write
5B0D000
trusted library allocation
page read and write
5AF6000
trusted library allocation
page read and write
CF5000
heap
page read and write
5B5D000
trusted library allocation
page read and write
3692000
heap
page read and write
36C4000
heap
page read and write
36C4000
heap
page read and write
DB0000
heap
page read and write
36C4000
heap
page read and write
5B18000
trusted library allocation
page read and write
5B49000
trusted library allocation
page read and write
369F000
heap
page read and write
762F000
stack
page read and write
36C4000
heap
page read and write
D54000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B1A000
trusted library allocation
page read and write
6E4F0000
unkown
page readonly
5AF0000
trusted library allocation
page read and write
3681000
heap
page read and write
5B18000
trusted library allocation
page read and write
36AE000
heap
page read and write
4525000
trusted library allocation
page read and write
5B63000
trusted library allocation
page read and write
35EC000
heap
page read and write
5B5A000
trusted library allocation
page read and write
3620000
heap
page read and write
5B1C000
trusted library allocation
page read and write
36C4000
heap
page read and write
5B3D000
trusted library allocation
page read and write
6E504000
unkown
page readonly
5AFA000
trusted library allocation
page read and write
5B63000
trusted library allocation
page read and write
3681000
heap
page read and write
5B75000
trusted library allocation
page read and write
3616000
heap
page read and write
597E000
stack
page read and write
5B57000
trusted library allocation
page read and write
802000
unkown
page readonly
36C4000
heap
page read and write
5B17000
trusted library allocation
page read and write
33D9000
remote allocation
page execute and read and write
5B0F000
trusted library allocation
page read and write
36C4000
heap
page read and write
2B00000
trusted library section
page read and write
5B58000
trusted library allocation
page read and write
5B38000
trusted library allocation
page read and write
C50000
heap
page read and write
36C4000
heap
page read and write
117F000
stack
page read and write
5B3B000
trusted library allocation
page read and write
36C4000
heap
page read and write
36C3000
heap
page read and write
There are 363 hidden memdumps, click here to show them.