IOC Report
SOA_9828392091.exe

loading gif

Files

File Path
Type
Category
Malicious
SOA_9828392091.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yGbzOMp.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\aut87C6.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\schoolma
data
dropped
C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SOA_9828392091.exe
"C:\Users\user\Desktop\SOA_9828392091.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\SOA_9828392091.exe"
 malicious
C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe
"C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe"
malicious
C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe
"C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://mail.palumalimited.com
unknown
 malicious
http://127.0.0.1:HTTP/1.1
unknown
https://wixxOvts0RfcEfM.org
unknown
http://palumalimited.com
unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi
unknown
http://dEIFpD.com
unknown

Domains

Name
IP
Malicious
palumalimited.com
174.136.29.110
 malicious
mail.palumalimited.com
unknown
 malicious

IPs

IP
Domain
Country
Malicious
174.136.29.110
palumalimited.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
yGbzOMp

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
22C0000
direct allocation
page read and write
 malicious
55F0000
trusted library allocation
page execute and read and write
2B10000
heap
page execute and read and write
2F1A000
trusted library allocation
page read and write
51CE000
stack
page read and write
2570000
trusted library allocation
page read and write
A60000
heap
page read and write
F60000
heap
page read and write
D94000
trusted library allocation
page read and write
6710000
heap
page read and write
3AE1000
trusted library allocation
page read and write
3CA000
stack
page read and write
1E2D000
stack
page read and write
958000
heap
page read and write
4FDE000
trusted library allocation
page read and write
F5E000
stack
page read and write
40A0000
direct allocation
page read and write
1140000
trusted library allocation
page read and write
28E0000
heap
page read and write
6FC000
stack
page read and write
A57000
unkown
page write copy
423E000
direct allocation
page read and write
D90000
trusted library allocation
page read and write
ED7000
trusted library allocation
page execute and read and write
930000
unkown
page readonly
3F40000
direct allocation
page read and write
40E0000
direct allocation
page read and write
4FC0000
trusted library allocation
page read and write
B7E000
stack
page read and write
5043000
heap
page read and write
B14000
trusted library allocation
page read and write
C90000
heap
page read and write
B0D000
trusted library allocation
page execute and read and write
DA5000
heap
page read and write
4ADE000
stack
page read and write
B50000
heap
page read and write
7A0000
heap
page read and write
3F00000
direct allocation
page read and write
51B0000
heap
page read and write
28D0000
trusted library allocation
page read and write
22B0000
heap
page read and write
DD9000
stack
page read and write
5F5E000
stack
page read and write
166C000
heap
page read and write
52CE000
stack
page read and write
242C000
stack
page read and write
53AF000
stack
page read and write
15D4000
heap
page read and write
2AC0000
trusted library allocation
page execute and read and write
660000
unkown
page readonly
3BA2000
trusted library allocation
page read and write
4D9E000
stack
page read and write
8F8000
heap
page read and write
B80000
heap
page read and write
17DB000
heap
page read and write
ED5000
trusted library allocation
page execute and read and write
2B30000
heap
page read and write
F4F000
stack
page read and write
AF0000
trusted library allocation
page read and write
5E11000
trusted library allocation
page read and write
8F0000
heap
page read and write
2A90000
heap
page read and write
D58000
heap
page read and write
166A000
heap
page read and write
D50000
heap
page read and write
4FE6000
trusted library allocation
page read and write
4FC6000
trusted library allocation
page read and write
D88000
heap
page read and write
640E000
stack
page read and write
13BC000
stack
page read and write
4B7C000
stack
page read and write
2F7E000
trusted library allocation
page read and write
B04000
trusted library allocation
page read and write
FC7000
heap
page read and write
1027000
heap
page read and write
9EA000
unkown
page execute and read and write
4023000
direct allocation
page read and write
4FD2000
trusted library allocation
page read and write
956000
heap
page read and write
8AF000
stack
page read and write
D44000
trusted library allocation
page read and write
EB0000
trusted library allocation
page read and write
913000
heap
page read and write
D20000
heap
page read and write
AEF000
stack
page read and write
A02000
unkown
page execute and write copy
FCE000
stack
page read and write
F98000
heap
page read and write
662000
unkown
page readonly
DCF000
heap
page read and write
F6B000
trusted library allocation
page execute and read and write
2A8D000
stack
page read and write
B37000
trusted library allocation
page execute and read and write
41CD000
direct allocation
page read and write
423E000
direct allocation
page read and write
D4E000
stack
page read and write
234E000
stack
page read and write
2CC000
stack
page read and write
EC0000
trusted library allocation
page read and write
1738000
heap
page read and write
D34000
trusted library allocation
page read and write
423E000
direct allocation
page read and write
A04000
unkown
page execute and read and write
4FE1000
trusted library allocation
page read and write
5080000
heap
page execute and read and write
8EE000
stack
page read and write
F80000
trusted library allocation
page read and write
13CE000
stack
page read and write
6120000
trusted library allocation
page execute and read and write
180C000
heap
page read and write
427E000
direct allocation
page read and write
5CF0000
heap
page read and write
750000
heap
page read and write
D9D000
trusted library allocation
page execute and read and write
1675000
heap
page read and write
40E0000
direct allocation
page read and write
A57000
unkown
page read and write
FBA000
heap
page read and write
E2E000
stack
page read and write
6720000
trusted library allocation
page read and write
420D000
direct allocation
page read and write
9DE000
unkown
page execute and read and write
106D000
heap
page read and write
7FA000
stack
page read and write
C8F000
stack
page read and write
15CE000
stack
page read and write
4E9F000
stack
page read and write
F67000
trusted library allocation
page execute and read and write
1860000
heap
page read and write
50E0000
heap
page read and write
5E18000
trusted library allocation
page read and write
D10000
trusted library allocation
page read and write
3F00000
direct allocation
page read and write
B79000
stack
page read and write
D33000
trusted library allocation
page execute and read and write
EC2000
trusted library allocation
page read and write
628E000
stack
page read and write
4209000
direct allocation
page read and write
1059000
heap
page read and write
17F9000
heap
page read and write
2B41000
trusted library allocation
page read and write
CFE000
stack
page read and write
DA0000
heap
page read and write
4023000
direct allocation
page read and write
13FD000
stack
page read and write
4C10000
heap
page execute and read and write
74E000
stack
page read and write
2AD0000
heap
page execute and read and write
6100000
trusted library allocation
page read and write
46CE000
stack
page read and write
926000
heap
page read and write
501E000
stack
page read and write
4C7E000
stack
page read and write
222E000
stack
page read and write
EC6000
trusted library allocation
page execute and read and write
163E000
heap
page read and write
F00000
trusted library allocation
page execute and read and write
2F66000
trusted library allocation
page read and write
1630000
heap
page read and write
B85000
heap
page read and write
40A0000
direct allocation
page read and write
4FCB000
trusted library allocation
page read and write
7A5000
heap
page read and write
D40000
trusted library allocation
page read and write
D4D000
trusted library allocation
page execute and read and write
25C0000
heap
page execute and read and write
1130000
trusted library allocation
page read and write
D80000
trusted library allocation
page read and write
2300000
trusted library allocation
page read and write
4209000
direct allocation
page read and write
400000
system
page execute and read and write
A4F000
unkown
page execute and read and write
2F14000
trusted library allocation
page read and write
6730000
trusted library allocation
page execute and read and write
2F8C000
trusted library allocation
page read and write
2F98000
trusted library allocation
page read and write
930000
unkown
page readonly
41C9000
direct allocation
page read and write
4BDF000
stack
page read and write
40A0000
direct allocation
page read and write
B1D000
trusted library allocation
page execute and read and write
4FDA000
trusted library allocation
page read and write
40E0000
direct allocation
page read and write
16A8000
heap
page read and write
518E000
stack
page read and write
41CD000
direct allocation
page read and write
D3D000
trusted library allocation
page execute and read and write
101B000
heap
page read and write
6110000
trusted library allocation
page execute and read and write
1160000
heap
page read and write
2580000
trusted library allocation
page read and write
60A0000
trusted library allocation
page read and write
126E000
stack
page read and write
6130000
trusted library allocation
page execute and read and write
2430000
heap
page read and write
61B0000
trusted library allocation
page read and write
4D5E000
stack
page read and write
B10000
trusted library allocation
page read and write
1003000
heap
page read and write
2AE1000
trusted library allocation
page read and write
107F000
heap
page read and write
D93000
trusted library allocation
page execute and read and write
28C0000
trusted library allocation
page execute and read and write
1098000
trusted library allocation
page read and write
1673000
heap
page read and write
15D0000
heap
page read and write
100C000
stack
page read and write
2AB0000
trusted library allocation
page read and write
1150000
trusted library allocation
page read and write
66A000
unkown
page readonly
1757000
heap
page read and write
2F76000
trusted library allocation
page read and write
1674000
heap
page read and write
16C2000
heap
page read and write
35D1000
trusted library allocation
page read and write
60F0000
trusted library allocation
page read and write
1470000
heap
page read and write
1725000
heap
page read and write
931000
unkown
page execute and read and write
61D0000
trusted library allocation
page read and write
427E000
direct allocation
page read and write
253E000
stack
page read and write
4FF2000
trusted library allocation
page read and write
630E000
unkown
page read and write
50F0000
trusted library allocation
page read and write
4023000
direct allocation
page read and write
1440000
heap
page read and write
25D1000
trusted library allocation
page read and write
5100000
heap
page execute and read and write
5040000
heap
page read and write
3F40000
direct allocation
page read and write
654E000
stack
page read and write
7F870000
trusted library allocation
page execute and read and write
28BE000
stack
page read and write
FC5000
heap
page read and write
62CF000
unkown
page read and write
4063000
direct allocation
page read and write
4063000
direct allocation
page read and write
6750000
heap
page read and write
3B69000
trusted library allocation
page read and write
41CD000
direct allocation
page read and write
106B000
heap
page read and write
4A70000
trusted library allocation
page execute and read and write
1724000
heap
page read and write
B03000
trusted library allocation
page execute and read and write
5D5C000
heap
page read and write
DEE000
stack
page read and write
ED2000
trusted library allocation
page read and write
60E0000
trusted library allocation
page read and write
3B41000
trusted library allocation
page read and write
420D000
direct allocation
page read and write
4209000
direct allocation
page read and write
2550000
heap
page read and write
505E000
stack
page read and write
630000
heap
page read and write
EBD000
trusted library allocation
page execute and read and write
1450000
heap
page read and write
60D0000
trusted library allocation
page execute and read and write
644E000
stack
page read and write
3F40000
direct allocation
page read and write
EF0000
trusted library allocation
page read and write
61C0000
trusted library allocation
page execute and read and write
4063000
direct allocation
page read and write
EDB000
trusted library allocation
page execute and read and write
3F00000
direct allocation
page read and write
D73000
heap
page read and write
6109000
trusted library allocation
page read and write
660D000
stack
page read and write
5E5C000
stack
page read and write
158E000
stack
page read and write
1724000
heap
page read and write
2540000
trusted library allocation
page execute and read and write
965000
heap
page read and write
4FCE000
trusted library allocation
page read and write
ECA000
trusted library allocation
page execute and read and write
D8F000
heap
page read and write
A55000
unkown
page execute and write copy
CEE000
stack
page read and write
427E000
direct allocation
page read and write
4F1E000
stack
page read and write
41C9000
direct allocation
page read and write
D00000
heap
page read and write
4FED000
trusted library allocation
page read and write
18B7000
heap
page execute and read and write
F90000
heap
page read and write
918000
heap
page read and write
F10000
heap
page read and write
780000
heap
page read and write
670C000
stack
page read and write
1010000
heap
page read and write
2B0E000
stack
page read and write
41C9000
direct allocation
page read and write
B3B000
trusted library allocation
page execute and read and write
420D000
direct allocation
page read and write
16F1000
heap
page read and write
BE0000
heap
page read and write
13DC000
stack
page read and write
A7A000
stack
page read and write
D7A000
heap
page read and write
4C5E000
stack
page read and write
2F94000
trusted library allocation
page read and write
5D63000
heap
page read and write
2F74000
trusted library allocation
page read and write
5010000
trusted library allocation
page read and write
2320000
heap
page read and write
163A000
heap
page read and write
There are 297 hidden memdumps, click here to show them.