IOC Report
z81zEuzkJPHHV3KYua.exe

loading gif

Files

File Path
Type
Category
Malicious
z81zEuzkJPHHV3KYua.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z81zEuzkJPHHV3KYua.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d0dbsulo.u3m.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsxq2hny.2fm.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgzowy5q.hul.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y42fq5rc.dbl.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe
"C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
 malicious
C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe
"C:\Users\user\Desktop\z81zEuzkJPHHV3KYua.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://mail.apexrnun.com
unknown
http://r11.o.lencr.org0#
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://r11.i.lencr.org/02
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
mail.apexrnun.com
185.196.9.150

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
185.196.9.150
mail.apexrnun.com
Switzerland

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z81zEuzkJPHHV3KYua_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2E2D000
trusted library allocation
page read and write
 malicious
3999000
trusted library allocation
page read and write
 malicious
2E01000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2E51000
trusted library allocation
page read and write
 malicious
8A1F000
stack
page read and write
FAE000
heap
page read and write
51BE000
trusted library allocation
page read and write
101D000
heap
page read and write
5459000
trusted library allocation
page read and write
5920000
trusted library allocation
page read and write
12A0000
trusted library allocation
page read and write
4DD8000
trusted library allocation
page read and write
643E000
heap
page read and write
B6A000
stack
page read and write
2A0C000
trusted library allocation
page read and write
590000
unkown
page readonly
12A3000
trusted library allocation
page execute and read and write
CE1000
heap
page read and write
FC7000
heap
page read and write
53BD000
heap
page read and write
67DD000
stack
page read and write
2C7B000
trusted library allocation
page read and write
53A0000
heap
page read and write
C10000
heap
page read and write
4DEE000
trusted library allocation
page read and write
51A0000
trusted library allocation
page read and write
4E40000
trusted library allocation
page read and write
6EEF000
stack
page read and write
53FE000
stack
page read and write
2B85000
trusted library allocation
page execute and read and write
273E000
stack
page read and write
12AD000
trusted library allocation
page execute and read and write
BE3000
trusted library allocation
page execute and read and write
C62000
trusted library allocation
page read and write
2780000
heap
page execute and read and write
BC0000
trusted library allocation
page read and write
7120000
trusted library allocation
page execute and read and write
592D000
trusted library allocation
page read and write
879F000
stack
page read and write
CAA000
heap
page read and write
4E30000
trusted library allocation
page read and write
C6B000
trusted library allocation
page execute and read and write
692D000
stack
page read and write
8DDC000
stack
page read and write
539E000
stack
page read and write
2B8B000
trusted library allocation
page execute and read and write
4DFD000
trusted library allocation
page read and write
2B87000
trusted library allocation
page execute and read and write
4EB2000
trusted library allocation
page read and write
2CB4000
trusted library allocation
page read and write
52B0000
trusted library allocation
page read and write
12B0000
trusted library allocation
page read and write
7E7000
stack
page read and write
2B82000
trusted library allocation
page read and write
43E000
remote allocation
page execute and read and write
6930000
heap
page read and write
609E000
stack
page read and write
F60000
heap
page read and write
2BF0000
trusted library allocation
page execute and read and write
2C6C000
stack
page read and write
2BEE000
stack
page read and write
2C91000
trusted library allocation
page read and write
6EF0000
trusted library allocation
page read and write
298F000
stack
page read and write
3E3C000
trusted library allocation
page read and write
50E0000
heap
page read and write
5C6D000
stack
page read and write
BD0000
heap
page read and write
FBA000
heap
page read and write
B30000
heap
page read and write
2870000
trusted library allocation
page read and write
5450000
trusted library allocation
page read and write
6EA000
stack
page read and write
5910000
heap
page read and write
5370000
heap
page read and write
68DD000
stack
page read and write
648E000
heap
page read and write
6487000
heap
page read and write
C1A000
heap
page read and write
50F0000
trusted library allocation
page execute and read and write
2DD1000
trusted library allocation
page read and write
CDF000
heap
page read and write
69EE000
stack
page read and write
665E000
stack
page read and write
3DD1000
trusted library allocation
page read and write
53CB000
heap
page read and write
2C70000
trusted library allocation
page read and write
BE0000
heap
page read and write
529E000
stack
page read and write
6A47000
trusted library allocation
page read and write
891E000
stack
page read and write
530C000
stack
page read and write
BFD000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
6477000
heap
page read and write
BD0000
heap
page read and write
5460000
heap
page execute and read and write
8E00000
trusted library allocation
page read and write
68E7000
trusted library allocation
page read and write
5470000
heap
page read and write
4FC0000
heap
page read and write
4DD4000
trusted library allocation
page read and write
4EB0000
trusted library allocation
page read and write
12D0000
heap
page read and write
592000
unkown
page readonly
6DED000
stack
page read and write
2C9D000
trusted library allocation
page read and write
5C2E000
stack
page read and write
2C20000
heap
page execute and read and write
536E000
stack
page read and write
B7E000
stack
page read and write
2CC0000
heap
page read and write
2798000
trusted library allocation
page read and write
4EA0000
heap
page read and write
D42000
heap
page read and write
6F70000
heap
page read and write
2880000
heap
page read and write
1014000
heap
page read and write
C06000
trusted library allocation
page execute and read and write
BF5000
heap
page read and write
CBF000
heap
page read and write
FC5000
heap
page read and write
12A4000
trusted library allocation
page read and write
4F6D000
stack
page read and write
5373000
heap
page read and write
53B5000
heap
page read and write
641E000
stack
page read and write
C90000
trusted library allocation
page execute and read and write
669E000
stack
page read and write
679E000
stack
page read and write
51B0000
trusted library allocation
page read and write
53C6000
heap
page read and write
BE0000
trusted library allocation
page read and write
2DCE000
stack
page read and write
6F30000
heap
page read and write
6940000
trusted library allocation
page execute and read and write
8CDC000
stack
page read and write
4A8C000
stack
page read and write
6468000
heap
page read and write
BF3000
trusted library allocation
page read and write
4E02000
trusted library allocation
page read and write
60DE000
stack
page read and write
2C96000
trusted library allocation
page read and write
EF8000
stack
page read and write
2A0E000
trusted library allocation
page read and write
53CD000
heap
page read and write
54DB000
stack
page read and write
4E20000
trusted library allocation
page read and write
1054000
heap
page read and write
631E000
unkown
page read and write
8B5E000
stack
page read and write
12C2000
trusted library allocation
page read and write
12CA000
trusted library allocation
page execute and read and write
68E0000
trusted library allocation
page read and write
2C00000
trusted library allocation
page read and write
7FB20000
trusted library allocation
page execute and read and write
8C9E000
stack
page read and write
2CB0000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
53D0000
heap
page read and write
4E10000
trusted library allocation
page read and write
D65000
heap
page read and write
557E000
stack
page read and write
2E60000
trusted library allocation
page read and write
2C7E000
trusted library allocation
page read and write
6A40000
trusted library allocation
page read and write
655E000
stack
page read and write
2C10000
trusted library allocation
page read and write
5500000
trusted library allocation
page execute and read and write
4DF1000
trusted library allocation
page read and write
855E000
stack
page read and write
CAE000
heap
page read and write
4FB0000
trusted library section
page read and write
2B80000
trusted library allocation
page read and write
2C8A000
trusted library allocation
page read and write
C67000
trusted library allocation
page execute and read and write
4E35000
trusted library allocation
page read and write
5CBE000
stack
page read and write
B90000
heap
page read and write
F90000
heap
page read and write
277E000
stack
page read and write
869E000
stack
page read and write
54E0000
trusted library allocation
page execute and read and write
102E000
heap
page read and write
53BE000
stack
page read and write
2E3F000
trusted library allocation
page read and write
4EC0000
trusted library allocation
page execute and read and write
3991000
trusted library allocation
page read and write
8A5E000
stack
page read and write
5F20000
trusted library section
page read and write
12C0000
trusted library allocation
page read and write
4F90000
trusted library allocation
page read and write
C00000
trusted library allocation
page read and write
58AE000
stack
page read and write
4FC3000
heap
page read and write
2E2B000
trusted library allocation
page read and write
12C6000
trusted library allocation
page execute and read and write
BF0000
heap
page read and write
4DF6000
trusted library allocation
page read and write
5110000
heap
page execute and read and write
5100000
trusted library allocation
page read and write
E9F000
stack
page read and write
2A03000
trusted library allocation
page read and write
2E59000
trusted library allocation
page read and write
F98000
heap
page read and write
2BA0000
trusted library allocation
page read and write
64E000
unkown
page readonly
6420000
heap
page read and write
3DF9000
trusted library allocation
page read and write
2C8E000
trusted library allocation
page read and write
F67000
heap
page read and write
2991000
trusted library allocation
page read and write
C0A000
trusted library allocation
page execute and read and write
1060000
heap
page read and write
6A30000
trusted library allocation
page read and write
57AC000
stack
page read and write
4E2F000
trusted library allocation
page read and write
8B9E000
stack
page read and write
CC7000
heap
page read and write
286B000
stack
page read and write
C80000
trusted library allocation
page read and write
5CE0000
heap
page read and write
C5E000
stack
page read and write
5FDE000
stack
page read and write
4DDB000
trusted library allocation
page read and write
4F70000
trusted library allocation
page read and write
BE4000
trusted library allocation
page read and write
8DE0000
heap
page read and write
2C82000
trusted library allocation
page read and write
BF0000
trusted library allocation
page read and write
865E000
stack
page read and write
4E60000
trusted library allocation
page read and write
4DD0000
trusted library allocation
page read and write
12BD000
trusted library allocation
page execute and read and write
A50000
heap
page read and write
2E4D000
trusted library allocation
page read and write
6F00000
trusted library allocation
page read and write
CA0000
heap
page read and write
BED000
trusted library allocation
page execute and read and write
6950000
trusted library allocation
page execute and read and write
There are 231 hidden memdumps, click here to show them.