IOC Report
leg#U00edvel9931-009-140.08372236.exe

loading gif

Files

File Path
Type
Category
Malicious
leg#U00edvel9931-009-140.08372236.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\8pIuMUYQX9q.exe (copy)
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\ClassicIEDLL_64.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\ClassicIE_64.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\FrontendCybersecurity.json
data
dropped
C:\Users\user\Microsoft.NET\netframework4.7\version\ng3DJyCjjqIdyv.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
\Device\Null
ASCII text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\leg#U00edvel9931-009-140.08372236.exe
"C:\Users\user\Desktop\leg#U00edvel9931-009-140.08372236.exe"
 malicious
C:\Windows\System32\shutdown.exe
shutdown /r /t 30
 malicious
C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\8pIuMUYQX9q.exe
"C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\8pIuMUYQX9q.exe"
malicious
C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\8pIuMUYQX9q.exe
"C:\Users\user\Microsoft.NET\netframework4.7\version\acuradas\8pIuMUYQX9q.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://panternol.com/backup/arqREQUEST_METHODpanternol.comiphlpapi.dll
unknown
http://www.winimage.com/zLibDll
unknown
https://GODEBUGhttps://panterno1.1.1.1
unknown
https://panternol.com/backup/arqR
unknown
https://panterno1.1.1.1
unknown
http://www.winimage.com/zLibDll1.3.1rbr
unknown
https://panternol.com/backup/arquivo1.zip
34.95.207.248
https://panternol.com/cacher/https://panternol.com/cacher/panternol.com
unknown
https://panternol.com/cacher/
34.95.207.248

Domains

Name
IP
Malicious
panternol.com
34.95.207.248

IPs

IP
Domain
Country
Malicious
34.95.207.248
panternol.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ng3DJyCjjqIdyv

Memdumps

Base Address
Regiontype
Protect
Malicious
C00007A000
direct allocation
page read and write
180001000
direct allocation
page execute read
578000
heap
page read and write
C000228000
direct allocation
page read and write
D4A000
unkown
page readonly
7FF6B40B3000
unkown
page readonly
261F000
stack
page read and write
7FF6B40B3000
unkown
page readonly
7FF6B40A1000
unkown
page execute read
C00002A000
direct allocation
page read and write
C0000E6000
direct allocation
page read and write
7FF6B40A0000
unkown
page readonly
C0001E0000
direct allocation
page read and write
232E76F3000
direct allocation
page read and write
C00000E000
direct allocation
page read and write
C23000
unkown
page write copy
243D4AC0000
heap
page read and write
720000
unkown
page readonly
C000104000
direct allocation
page read and write
994000
unkown
page readonly
C000198000
direct allocation
page read and write
58A000
heap
page read and write
C00019C000
direct allocation
page read and write
C000262000
direct allocation
page read and write
C0001A0000
direct allocation
page read and write
13B4000
heap
page read and write
C0000D6000
direct allocation
page read and write
21F3000
heap
page read and write
232A23B0000
heap
page read and write
C000200000
direct allocation
page read and write
67B7DFE000
stack
page read and write
243D4AE4000
heap
page read and write
C000274000
direct allocation
page read and write
243D4AE1000
heap
page read and write
C000112000
direct allocation
page read and write
21DD000
heap
page read and write
7FFE1A534000
unkown
page readonly
C0000E0000
direct allocation
page read and write
C00027E000
direct allocation
page read and write
7FF6B40AF000
unkown
page write copy
C5E000
unkown
page read and write
C0000FE000
direct allocation
page read and write
EEE000
unkown
page readonly
587000
heap
page read and write
4B0000
heap
page read and write
243D4E40000
heap
page read and write
C000041000
direct allocation
page read and write
701F47F000
stack
page read and write
7FF6B40AB000
unkown
page readonly
C000082000
direct allocation
page read and write
460000
heap
page read and write
C000094000
direct allocation
page read and write
C000022000
direct allocation
page read and write
C4E000
unkown
page read and write
67B6FFC000
stack
page read and write
C000002000
direct allocation
page read and write
2CAD000
stack
page read and write
C00009A000
direct allocation
page read and write
22CA000
heap
page read and write
C000241000
direct allocation
page read and write
1300000
heap
page read and write
232E76D0000
heap
page read and write
16C000
stack
page read and write
C000008000
direct allocation
page read and write
7FF6B40A0000
unkown
page readonly
232A2407000
heap
page read and write
C00006E000
direct allocation
page read and write
232E7940000
heap
page read and write
180085000
direct allocation
page read and write
721000
unkown
page execute read
243D4E45000
heap
page read and write
463000
heap
page read and write
C00006A000
direct allocation
page read and write
211D000
stack
page read and write
C00000A000
direct allocation
page read and write
C000076000
direct allocation
page read and write
1398000
heap
page read and write
FAC000
stack
page read and write
CA7000
unkown
page read and write
C0000F0000
direct allocation
page read and write
C000046000
direct allocation
page read and write
C000004000
direct allocation
page read and write
21F1000
heap
page read and write
C00002E000
direct allocation
page read and write
232A2405000
heap
page read and write
C0000BC000
direct allocation
page read and write
58E000
heap
page read and write
C000236000
direct allocation
page read and write
180000000
direct allocation
page read and write
C000222000
direct allocation
page read and write
C00002C000
direct allocation
page read and write
C80000
unkown
page read and write
67B71FE000
stack
page read and write
C000280000
direct allocation
page read and write
C0000C2000
direct allocation
page read and write
7FFE1A510000
unkown
page readonly
C000068000
direct allocation
page read and write
18008C000
direct allocation
page readonly
C0000E4000
direct allocation
page read and write
420000
heap
page read and write
2BA0000
heap
page read and write
7FFE1A510000
unkown
page readonly
D31000
unkown
page readonly
C000018000
direct allocation
page read and write
281F000
stack
page read and write
7FF6B40A1000
unkown
page execute read
C00001E000
direct allocation
page read and write
C00005E000
direct allocation
page read and write
D31000
unkown
page readonly
C0001E6000
direct allocation
page read and write
C00003A000
direct allocation
page read and write
C0000AC000
direct allocation
page read and write
304A000
heap
page read and write
21EB000
heap
page read and write
232E77B0000
heap
page read and write
7FFE1A547000
unkown
page readonly
2DAF000
stack
page read and write
C0001B6000
direct allocation
page read and write
C0000CA000
direct allocation
page read and write
1390000
heap
page read and write
C0000CE000
direct allocation
page read and write
C0000E8000
direct allocation
page read and write
232A2260000
heap
page read and write
1B0000
heap
page read and write
67B73FE000
stack
page read and write
7FF6B40AF000
unkown
page read and write
C00001A000
direct allocation
page read and write
4B8000
heap
page read and write
C000194000
direct allocation
page read and write
C0000DA000
direct allocation
page read and write
232E7945000
heap
page read and write
C000180000
direct allocation
page read and write
C0001AC000
direct allocation
page read and write
21ED000
heap
page read and write
87E000
stack
page read and write
7FF6B40B3000
unkown
page readonly
C000086000
direct allocation
page read and write
721000
unkown
page execute read
232A2350000
direct allocation
page read and write
EED000
unkown
page write copy
C000264000
direct allocation
page read and write
7FF6B40AF000
unkown
page write copy
2FA0000
heap
page read and write
C000110000
direct allocation
page read and write
243D4AC8000
heap
page read and write
C00018C000
direct allocation
page read and write
7FFE1A547000
unkown
page readonly
C000051000
direct allocation
page read and write
C00003F000
direct allocation
page read and write
C4B000
unkown
page read and write
C000300000
direct allocation
page read and write
C0001BA000
direct allocation
page read and write
C0001A4000
direct allocation
page read and write
21D9000
heap
page read and write
232A2358000
direct allocation
page read and write
2120000
heap
page read and write
232A235A000
direct allocation
page read and write
2F9D000
stack
page read and write
C00027A000
direct allocation
page read and write
C00025E000
direct allocation
page read and write
291B000
stack
page read and write
180064000
direct allocation
page readonly
67B79FC000
stack
page read and write
67B7BFF000
stack
page read and write
2B1E000
stack
page read and write
7FF6B40A1000
unkown
page execute read
C000100000
direct allocation
page read and write
C0001B4000
direct allocation
page read and write
C000189000
direct allocation
page read and write
C0000A6000
direct allocation
page read and write
C0000C0000
direct allocation
page read and write
C00006C000
direct allocation
page read and write
C0000FC000
direct allocation
page read and write
C00009E000
direct allocation
page read and write
440000
heap
page read and write
C000108000
direct allocation
page read and write
232A23BC000
heap
page read and write
C0000F2000
direct allocation
page read and write
701F11F000
stack
page read and write
232A2354000
direct allocation
page read and write
22DC000
heap
page read and write
251F000
stack
page read and write
232E76B0000
direct allocation
page read and write
C0001E2000
direct allocation
page read and write
C000096000
direct allocation
page read and write
180085000
direct allocation
page read and write
56C000
heap
page read and write
1330000
heap
page read and write
C0001D5000
direct allocation
page read and write
C0000D2000
direct allocation
page read and write
C00004A000
direct allocation
page read and write
C000092000
direct allocation
page read and write
243D4AA0000
heap
page read and write
C00004F000
direct allocation
page read and write
271A000
stack
page read and write
C26000
unkown
page write copy
13C2000
heap
page read and write
C000266000
direct allocation
page read and write
591000
heap
page read and write
C000090000
direct allocation
page read and write
77E000
stack
page read and write
67B77FE000
stack
page read and write
C0001E8000
direct allocation
page read and write
180094000
direct allocation
page read and write
C00000C000
direct allocation
page read and write
C0001CF000
direct allocation
page read and write
C0000A8000
direct allocation
page read and write
C000302000
direct allocation
page read and write
C000060000
direct allocation
page read and write
CAF000
unkown
page readonly
410000
heap
page read and write
2220000
heap
page read and write
7FFE1A511000
unkown
page execute read
21A4000
heap
page read and write
C000304000
direct allocation
page read and write
C27000
unkown
page read and write
232A23C2000
heap
page read and write
C000000000
direct allocation
page read and write
C000056000
direct allocation
page read and write
1380000
heap
page read and write
FF0000
heap
page read and write
EEE000
unkown
page readonly
232E7730000
direct allocation
page read and write
C000098000
direct allocation
page read and write
C000080000
direct allocation
page read and write
C5C000
unkown
page write copy
7FF6B40AB000
unkown
page readonly
1785000
heap
page read and write
CAF000
unkown
page readonly
701F09C000
stack
page read and write
7FF6B40B3000
unkown
page readonly
C00019E000
direct allocation
page read and write
C00022A000
direct allocation
page read and write
C000010000
direct allocation
page read and write
1C0000
heap
page read and write
C23000
unkown
page read and write
C00010A000
direct allocation
page read and write
C000252000
direct allocation
page read and write
C00026C000
direct allocation
page read and write
232E7770000
direct allocation
page read and write
C000116000
direct allocation
page read and write
232A23B9000
heap
page read and write
7FF6B40AB000
unkown
page readonly
180094000
direct allocation
page read and write
5A0000
heap
page read and write
C0000BA000
direct allocation
page read and write
C0001BE000
direct allocation
page read and write
C000054000
direct allocation
page read and write
C000278000
direct allocation
page read and write
2205000
heap
page read and write
12D0000
heap
page read and write
232A2430000
heap
page read and write
7FF6B40A0000
unkown
page readonly
573000
heap
page read and write
C00007E000
direct allocation
page read and write
C000246000
direct allocation
page read and write
7FFE1A534000
unkown
page readonly
7FFE1A544000
unkown
page read and write
C0000F6000
direct allocation
page read and write
243D4A80000
heap
page read and write
C000254000
direct allocation
page read and write
7FF6B40A1000
unkown
page execute read
C000031000
direct allocation
page read and write
7FFE1A544000
unkown
page read and write
C0000A2000
direct allocation
page read and write
2A1E000
stack
page read and write
D4A000
unkown
page readonly
C00020E000
direct allocation
page read and write
2B70000
heap
page read and write
C0001EA000
direct allocation
page read and write
C000306000
direct allocation
page read and write
C0000C8000
direct allocation
page read and write
7FF6B40AF000
unkown
page read and write
C0001A8000
direct allocation
page read and write
5AE000
heap
page read and write
232A2403000
heap
page read and write
2158000
heap
page read and write
C000016000
direct allocation
page read and write
C0001A6000
direct allocation
page read and write
720000
unkown
page readonly
701F19F000
stack
page read and write
C4C000
unkown
page write copy
7FFE1A511000
unkown
page execute read
C00008E000
direct allocation
page read and write
415000
heap
page read and write
C0001E4000
direct allocation
page read and write
232E7733000
direct allocation
page read and write
13C3000
heap
page read and write
C28000
unkown
page write copy
243D4A70000
heap
page read and write
13B4000
heap
page read and write
C000006000
direct allocation
page read and write
C000256000
direct allocation
page read and write
994000
unkown
page readonly
419000
heap
page read and write
21EF000
heap
page read and write
67B75FE000
stack
page read and write
7FF6B40A0000
unkown
page readonly
7FF6B40AB000
unkown
page readonly
1383000
heap
page read and write
C00008A000
direct allocation
page read and write
C000062000
direct allocation
page read and write
180001000
direct allocation
page execute read
18008C000
direct allocation
page readonly
C00024F000
direct allocation
page read and write
C000084000
direct allocation
page read and write
C000078000
direct allocation
page read and write
232E773C000
direct allocation
page read and write
EED000
unkown
page write copy
180000000
direct allocation
page read and write
180064000
direct allocation
page readonly
C000190000
direct allocation
page read and write
1780000
heap
page read and write
C0001F0000
direct allocation
page read and write
C000064000
direct allocation
page read and write
There are 305 hidden memdumps, click here to show them.