IOC Report
injector V2.4.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\injector V2.4.exe
"C:\Users\user\Desktop\injector V2.4.exe"
 malicious
C:\Users\user\Desktop\injector V2.4.exe
"C:\Users\user\Desktop\injector V2.4.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://farewellnzu.icu/api
104.21.44.93
 malicious
farewellnzu.icu
malicious
https://farewellnzu.icu/apis
unknown
https://farewellnzu.icu/
unknown
https://farewellnzu.icu/apiw
unknown
https://farewellnzu.icu/sion
unknown

Domains

Name
IP
Malicious
farewellnzu.icu
104.21.44.93

IPs

IP
Domain
Country
Malicious
104.21.44.93
farewellnzu.icu
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
71E000
heap
page read and write
 malicious
C11000
unkown
page write copy
C0F000
unkown
page readonly
4D9D000
stack
page read and write
32DC000
heap
page read and write
570000
heap
page read and write
56DF000
stack
page read and write
C11000
unkown
page write copy
31B0000
heap
page read and write
A0F000
stack
page read and write
32C0000
heap
page read and write
32B0000
remote allocation
page read and write
C0B000
unkown
page write copy
5830000
heap
page read and write
BE1000
unkown
page execute read
C0B000
unkown
page write copy
BE0000
unkown
page readonly
34BE000
stack
page read and write
598F000
stack
page read and write
330B000
heap
page read and write
C03000
unkown
page readonly
43C000
stack
page read and write
30FB000
stack
page read and write
571E000
stack
page read and write
32C8000
heap
page read and write
330E000
heap
page read and write
BE0000
unkown
page readonly
C11000
unkown
page write copy
32DC000
heap
page read and write
4DD0000
heap
page read and write
2DE0000
heap
page read and write
53D000
stack
page read and write
313E000
stack
page read and write
BE1000
unkown
page execute read
535E000
stack
page read and write
3315000
heap
page read and write
3315000
heap
page read and write
BE0000
unkown
page readonly
BDD000
stack
page read and write
32B0000
remote allocation
page read and write
32D8000
heap
page read and write
C03000
unkown
page readonly
580000
heap
page read and write
3363000
heap
page read and write
549E000
stack
page read and write
32B0000
remote allocation
page read and write
31AE000
stack
page read and write
531D000
stack
page read and write
C0B000
unkown
page execute and read and write
BE0000
unkown
page readonly
545F000
stack
page read and write
335A000
heap
page read and write
336E000
heap
page read and write
31B5000
heap
page read and write
521D000
stack
page read and write
581E000
stack
page read and write
70E000
stack
page read and write
3309000
heap
page read and write
90F000
stack
page read and write
436D000
stack
page read and write
C03000
unkown
page readonly
3150000
heap
page read and write
71A000
heap
page read and write
C0B000
unkown
page write copy
35BE000
stack
page read and write
588E000
stack
page read and write
C03000
unkown
page readonly
BE1000
unkown
page execute read
C0C000
unkown
page read and write
2D3B000
stack
page read and write
3309000
heap
page read and write
C11000
unkown
page write copy
5CE000
stack
page read and write
3315000
heap
page read and write
55DE000
stack
page read and write
C0F000
unkown
page readonly
5F0000
heap
page read and write
559F000
stack
page read and write
2D90000
heap
page read and write
710000
heap
page read and write
44D0000
heap
page read and write
BE1000
unkown
page execute read
3375000
heap
page read and write
2DDE000
stack
page read and write
3362000
heap
page read and write
C0F000
unkown
page readonly
3371000
heap
page read and write
457000
remote allocation
page execute and read and write
C0F000
unkown
page readonly
There are 80 hidden memdumps, click here to show them.