IOC Report
product sample requirement.exe

loading gif

Files

File Path
Type
Category
Malicious
product sample requirement.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\product sample requirement.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpA26.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TWmzcmqkuotC.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1yewi1od.ii5.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fcgsw2b.fo1.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cjk12krn.g5p.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cyd2q3f5.c0l.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ir3lksmf.hg3.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l00opidz.oys.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_prteouww.rsg.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qz5z2kog.pcy.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp1AB0.tmp
XML 1.0 document, ASCII text
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\product sample requirement.exe
"C:\Users\user\Desktop\product sample requirement.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\product sample requirement.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TWmzcmqkuotC" /XML "C:\Users\user\AppData\Local\Temp\tmpA26.tmp"
 malicious
C:\Users\user\Desktop\product sample requirement.exe
"C:\Users\user\Desktop\product sample requirement.exe"
 malicious
C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe
C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TWmzcmqkuotC" /XML "C:\Users\user\AppData\Local\Temp\tmp1AB0.tmp"
 malicious
C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe
"C:\Users\user\AppData\Roaming\TWmzcmqkuotC.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
teebro1800.dynamic-dns.net
malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
unknown
http://go.mic
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 19 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
teebro1800.dynamic-dns.net
109.248.151.221
 malicious

IPs

IP
Domain
Country
Malicious
109.248.151.221
teebro1800.dynamic-dns.net
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2A46000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2711000
trusted library allocation
page read and write
 malicious
2D90000
heap
page read and write
354B000
heap
page read and write
B22D000
stack
page read and write
2834000
trusted library allocation
page read and write
3711000
trusted library allocation
page read and write
EE0000
heap
page read and write
5B0E000
stack
page read and write
2D67000
trusted library allocation
page execute and read and write
283E000
trusted library allocation
page read and write
AE9D000
stack
page read and write
70F0000
trusted library allocation
page read and write
15A2000
trusted library allocation
page read and write
2F9A000
heap
page read and write
4C0E000
trusted library allocation
page read and write
53C0000
trusted library allocation
page read and write
2D2E000
stack
page read and write
AE6E000
stack
page read and write
5335000
heap
page read and write
CBF000
heap
page read and write
A80000
heap
page read and write
D27000
heap
page read and write
7A0000
heap
page read and write
B32D000
stack
page read and write
B6AE000
stack
page read and write
4FDE000
stack
page read and write
1100000
heap
page read and write
71BE000
stack
page read and write
C63000
trusted library allocation
page read and write
6EFC000
heap
page read and write
5AD0000
heap
page read and write
A5E000
stack
page read and write
4E6B000
trusted library allocation
page read and write
102F000
stack
page read and write
63CE000
stack
page read and write
3141000
trusted library allocation
page read and write
DD0000
heap
page read and write
618C000
stack
page read and write
F2E000
stack
page read and write
8F5000
heap
page read and write
29F0000
heap
page read and write
1080000
heap
page read and write
39DC000
trusted library allocation
page read and write
1590000
trusted library allocation
page read and write
2600000
heap
page execute and read and write
295F000
stack
page read and write
5060000
trusted library section
page readonly
55FE000
stack
page read and write
7F770000
trusted library allocation
page execute and read and write
50B0000
heap
page read and write
5000000
trusted library allocation
page read and write
29AE000
unkown
page read and write
33A0000
heap
page read and write
4F22000
trusted library allocation
page read and write
5080000
heap
page read and write
D40000
heap
page read and write
24DD000
trusted library allocation
page execute and read and write
1593000
trusted library allocation
page read and write
512C000
heap
page read and write
3989000
trusted library allocation
page read and write
7100000
trusted library allocation
page read and write
BA3C000
stack
page read and write
2840000
trusted library allocation
page read and write
A3B000
stack
page read and write
6CE0000
heap
page read and write
71A0000
trusted library allocation
page execute and read and write
5320000
trusted library allocation
page execute and read and write
6D00000
heap
page read and write
118E000
heap
page read and write
CD0000
heap
page read and write
C70000
trusted library allocation
page read and write
15A0000
trusted library allocation
page read and write
5633000
heap
page read and write
4BA000
stack
page read and write
D83000
heap
page read and write
4F30000
trusted library allocation
page execute and read and write
765000
heap
page read and write
24D3000
trusted library allocation
page read and write
C76000
trusted library allocation
page execute and read and write
BEE000
stack
page read and write
4C1D000
trusted library allocation
page read and write
B49B000
stack
page read and write
25F0000
trusted library allocation
page read and write
2B2F000
trusted library allocation
page read and write
4DD0000
heap
page read and write
DC0000
heap
page read and write
119E000
stack
page read and write
5ECF000
stack
page read and write
111E000
heap
page read and write
15AA000
trusted library allocation
page execute and read and write
B56E000
stack
page read and write
27FC000
stack
page read and write
3719000
trusted library allocation
page read and write
872E000
stack
page read and write
577E000
stack
page read and write
2B1F000
stack
page read and write
B0DE000
stack
page read and write
7270000
trusted library section
page read and write
AD5E000
stack
page read and write
C50000
trusted library allocation
page read and write
B81E000
stack
page read and write
24F0000
trusted library allocation
page read and write
2970000
heap
page execute and read and write
2F90000
heap
page read and write
6FCE000
stack
page read and write
1030000
heap
page read and write
2F0A000
stack
page read and write
6D51000
heap
page read and write
2DDF000
stack
page read and write
B93B000
stack
page read and write
158D000
trusted library allocation
page execute and read and write
24EA000
trusted library allocation
page execute and read and write
B5AD000
stack
page read and write
3540000
heap
page read and write
AE5E000
stack
page read and write
B90000
heap
page read and write
D1D000
trusted library allocation
page execute and read and write
2DCE000
stack
page read and write
C72000
trusted library allocation
page read and write
573D000
stack
page read and write
50F9000
heap
page read and write
5090000
trusted library allocation
page execute and read and write
4E64000
trusted library allocation
page read and write
3360000
heap
page read and write
3100000
trusted library allocation
page read and write
B38000
stack
page read and write
B1DE000
stack
page read and write
70CE000
stack
page read and write
B80000
heap
page read and write
7FE000
stack
page read and write
4EA0000
trusted library allocation
page read and write
C87000
trusted library allocation
page execute and read and write
2840000
trusted library allocation
page read and write
50DE000
stack
page read and write
25F5000
trusted library allocation
page read and write
3B21000
trusted library allocation
page read and write
5C90000
trusted library allocation
page read and write
57BE000
stack
page read and write
2844000
trusted library allocation
page read and write
1073000
trusted library allocation
page execute and read and write
6F27000
heap
page read and write
2870000
trusted library allocation
page read and write
5064000
trusted library section
page readonly
2960000
heap
page read and write
4CB0000
trusted library allocation
page read and write
2ECE000
stack
page read and write
6900000
trusted library allocation
page read and write
4BFB000
trusted library allocation
page read and write
8CF000
heap
page read and write
51CE000
stack
page read and write
E9E000
stack
page read and write
4DA0000
trusted library allocation
page read and write
7150000
trusted library allocation
page execute and read and write
11A7000
heap
page read and write
270E000
stack
page read and write
4E2B000
stack
page read and write
CE3000
heap
page read and write
4718000
trusted library allocation
page read and write
53C2000
trusted library allocation
page read and write
25D0000
trusted library allocation
page read and write
367B000
trusted library allocation
page read and write
4BF4000
trusted library allocation
page read and write
2D50000
heap
page read and write
82E000
heap
page read and write
2820000
trusted library allocation
page read and write
AD1E000
stack
page read and write
6E10000
trusted library allocation
page execute and read and write
4CA0000
heap
page read and write
CD5000
heap
page read and write
330E000
stack
page read and write
2F68000
trusted library allocation
page read and write
11A0000
heap
page read and write
AC1E000
stack
page read and write
3B15000
trusted library allocation
page read and write
5CD0000
heap
page read and write
6EBE000
stack
page read and write
5400000
trusted library allocation
page read and write
255E000
stack
page read and write
30FD000
stack
page read and write
400000
remote allocation
page execute and read and write
AF6E000
stack
page read and write
828000
heap
page read and write
4DB0000
trusted library allocation
page read and write
3B2000
unkown
page readonly
628D000
stack
page read and write
1350000
heap
page read and write
6922000
trusted library allocation
page read and write
D4B000
stack
page read and write
2AAE000
trusted library allocation
page read and write
2ECD000
stack
page read and write
3879000
trusted library allocation
page read and write
2D60000
trusted library allocation
page read and write
5ABD000
stack
page read and write
2960000
trusted library allocation
page execute and read and write
72C8000
trusted library allocation
page read and write
4E81000
trusted library allocation
page read and write
BB7F000
stack
page read and write
54BE000
stack
page read and write
6BC0000
heap
page read and write
C54000
trusted library allocation
page read and write
A10000
heap
page read and write
3981000
trusted library allocation
page read and write
10F7000
stack
page read and write
2B21000
trusted library allocation
page read and write
53B0000
trusted library allocation
page read and write
2F50000
heap
page read and write
4D93000
heap
page read and write
2F0C000
stack
page read and write
7190000
trusted library allocation
page read and write
2830000
trusted library allocation
page read and write
4F9E000
stack
page read and write
B0EE000
stack
page read and write
6EF1000
heap
page read and write
5800000
heap
page execute and read and write
3AE9000
trusted library allocation
page read and write
930000
heap
page read and write
C5D000
trusted library allocation
page execute and read and write
C6D000
trusted library allocation
page execute and read and write
24F7000
trusted library allocation
page execute and read and write
CC8000
heap
page read and write
BF8000
heap
page read and write
28BE000
stack
page read and write
72C0000
trusted library allocation
page read and write
2850000
trusted library allocation
page read and write
600F000
stack
page read and write
2D80000
trusted library allocation
page read and write
2907000
trusted library allocation
page read and write
6D45000
heap
page read and write
C0D000
stack
page read and write
5F8E000
stack
page read and write
4C1E000
stack
page read and write
4C11000
trusted library allocation
page read and write
4E8D000
trusted library allocation
page read and write
B1EE000
stack
page read and write
72A000
stack
page read and write
285B000
trusted library allocation
page execute and read and write
6D24000
heap
page read and write
50C0000
trusted library allocation
page read and write
C53000
trusted library allocation
page execute and read and write
2B77000
trusted library allocation
page read and write
5B10000
heap
page read and write
1136000
heap
page read and write
D14000
trusted library allocation
page read and write
D13000
trusted library allocation
page execute and read and write
63E0000
heap
page read and write
D10000
trusted library allocation
page read and write
2857000
trusted library allocation
page execute and read and write
155E000
stack
page read and write
1060000
trusted library allocation
page read and write
15A6000
trusted library allocation
page execute and read and write
4EA5000
trusted library allocation
page read and write
2F70000
heap
page read and write
EB0000
trusted library allocation
page execute and read and write
D20000
heap
page read and write
5B18000
heap
page read and write
882E000
stack
page read and write
B31E000
stack
page read and write
C13000
heap
page read and write
4CC0000
trusted library allocation
page execute and read and write
5FCE000
stack
page read and write
B330000
heap
page read and write
6EFE000
stack
page read and write
52EE000
stack
page read and write
6FFE000
stack
page read and write
B21E000
stack
page read and write
CAE000
heap
page read and write
24E0000
trusted library allocation
page read and write
CAA000
heap
page read and write
2580000
heap
page read and write
DA5000
heap
page read and write
5070000
heap
page read and write
920000
heap
page read and write
3B62000
trusted library allocation
page read and write
4B1C000
stack
page read and write
5AC0000
heap
page read and write
1583000
trusted library allocation
page execute and read and write
3A7D000
trusted library allocation
page read and write
29EF000
unkown
page read and write
4DE5000
heap
page read and write
3130000
heap
page execute and read and write
851E000
stack
page read and write
5630000
heap
page read and write
B46E000
stack
page read and write
CA0000
heap
page read and write
BA5000
heap
page read and write
D4A000
heap
page read and write
AF7000
stack
page read and write
2A10000
heap
page read and write
3A30000
trusted library allocation
page read and write
4988000
trusted library allocation
page read and write
505B000
stack
page read and write
B8FE000
stack
page read and write
ABDE000
stack
page read and write
4DE0000
heap
page read and write
63D0000
heap
page read and write
B59C000
stack
page read and write
935000
heap
page read and write
B6DF000
stack
page read and write
B0AF000
stack
page read and write
614E000
stack
page read and write
EC0000
heap
page read and write
D00000
trusted library allocation
page read and write
BA0000
heap
page read and write
25E0000
trusted library allocation
page read and write
5010000
trusted library allocation
page read and write
4C30000
trusted library allocation
page read and write
145E000
stack
page read and write
BA7D000
stack
page read and write
73C0000
trusted library allocation
page read and write
1584000
trusted library allocation
page read and write
C82000
trusted library allocation
page read and write
4F10000
heap
page read and write
C40000
trusted library allocation
page read and write
50F0000
heap
page read and write
130E000
stack
page read and write
24FB000
trusted library allocation
page execute and read and write
2960000
trusted library allocation
page read and write
4E86000
trusted library allocation
page read and write
1108000
heap
page read and write
5909000
stack
page read and write
3350000
heap
page read and write
B5DD000
stack
page read and write
2846000
trusted library allocation
page read and write
6EB0000
heap
page read and write
4E40000
heap
page read and write
6D4F000
heap
page read and write
2F10000
trusted library allocation
page execute and read and write
2FFE000
unkown
page read and write
4C16000
trusted library allocation
page read and write
54FC000
stack
page read and write
2850000
heap
page read and write
C19000
heap
page read and write
2833000
heap
page read and write
284A000
trusted library allocation
page execute and read and write
6DD0000
trusted library allocation
page execute and read and write
2570000
trusted library allocation
page read and write
532E000
stack
page read and write
5620000
heap
page read and write
24D0000
trusted library allocation
page read and write
B8F000
stack
page read and write
48AC000
stack
page read and write
51E0000
heap
page execute and read and write
50D0000
heap
page execute and read and write
D12000
heap
page read and write
856000
heap
page read and write
C26000
heap
page read and write
6D1E000
heap
page read and write
2830000
heap
page read and write
C60000
trusted library allocation
page read and write
50C0000
heap
page read and write
5330000
heap
page read and write
AFA0000
heap
page read and write
28BD000
stack
page read and write
B7FE000
stack
page read and write
2510000
trusted library allocation
page read and write
4CB2000
trusted library allocation
page read and write
AFAE000
stack
page read and write
25CB000
stack
page read and write
3AC9000
trusted library allocation
page read and write
542E000
stack
page read and write
6D55000
heap
page read and write
4141000
trusted library allocation
page read and write
4BF0000
trusted library allocation
page read and write
112A000
heap
page read and write
4E30000
heap
page read and write
4E60000
trusted library allocation
page read and write
24E2000
trusted library allocation
page read and write
8BD000
heap
page read and write
15B6000
heap
page read and write
3A1D000
trusted library allocation
page read and write
70E0000
trusted library allocation
page execute and read and write
AF9D000
stack
page read and write
4EB0000
trusted library allocation
page read and write
4E92000
trusted library allocation
page read and write
2FBE000
unkown
page read and write
EBF000
stack
page read and write
4D90000
heap
page read and write
4DC0000
trusted library section
page readonly
24E6000
trusted library allocation
page execute and read and write
5340000
trusted library allocation
page execute and read and write
2846000
trusted library allocation
page execute and read and write
28FA000
stack
page read and write
FCE000
stack
page read and write
29C0000
trusted library allocation
page read and write
334E000
stack
page read and write
DA0000
heap
page read and write
4E7E000
trusted library allocation
page read and write
7B0000
heap
page read and write
62CC000
stack
page read and write
134C000
stack
page read and write
11EF000
heap
page read and write
29BE000
stack
page read and write
1580000
trusted library allocation
page read and write
1074000
trusted library allocation
page read and write
24F2000
trusted library allocation
page read and write
604C000
stack
page read and write
CE7000
heap
page read and write
420000
unkown
page readonly
B71E000
stack
page read and write
57D0000
heap
page read and write
11D3000
heap
page read and write
15B0000
heap
page read and write
2970000
heap
page execute and read and write
5A0E000
stack
page read and write
820000
heap
page read and write
1570000
trusted library allocation
page read and write
29D0000
trusted library allocation
page read and write
BCE000
stack
page read and write
2F40000
trusted library allocation
page read and write
37AC000
trusted library allocation
page read and write
4C50000
trusted library allocation
page read and write
4F20000
trusted library allocation
page read and write
2981000
trusted library allocation
page read and write
50E0000
heap
page read and write
4C22000
trusted library allocation
page read and write
6E70000
trusted library allocation
page read and write
29D5000
trusted library allocation
page read and write
C7A000
trusted library allocation
page execute and read and write
863000
heap
page read and write
2800000
heap
page read and write
C8B000
trusted library allocation
page execute and read and write
4C80000
heap
page execute and read and write
D15000
heap
page read and write
5130000
heap
page read and write
70D0000
trusted library section
page read and write
5B7000
stack
page read and write
511E000
heap
page read and write
4ED0000
trusted library allocation
page read and write
2F20000
heap
page read and write
1134000
heap
page read and write
EA0000
trusted library allocation
page read and write
5F4D000
stack
page read and write
CCF000
stack
page read and write
2D6B000
trusted library allocation
page execute and read and write
760000
heap
page read and write
BF0000
heap
page read and write
2560000
trusted library allocation
page execute and read and write
3B0000
unkown
page readonly
2840000
trusted library allocation
page read and write
There are 431 hidden memdumps, click here to show them.