IOC Report
SecuriteInfo.com.Trojan.AutoIt.1377.13566.17753.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Trojan.AutoIt.1377.13566.17753.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut4191.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut41F0.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\conged
ASCII text, with very long lines (29748), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\prophetesses
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.1377.13566.17753.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.1377.13566.17753.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.1377.13566.17753.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
http://www.micrmscorlib.resources09-04-02.crt0
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://mail.gruporequena.com
unknown
http://r3.i.lencr.org/0
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.gruporequena.com
198.59.144.129
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
198.59.144.129
mail.gruporequena.com
United States
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
392000
system
page execute and read and write
 malicious
26A5000
trusted library allocation
page read and write
 malicious
2681000
trusted library allocation
page read and write
 malicious
20A0000
direct allocation
page read and write
 malicious
3FB9000
direct allocation
page read and write
2500000
heap
page read and write
23C2000
trusted library allocation
page read and write
5E9F000
stack
page read and write
12F3000
heap
page read and write
1300000
heap
page read and write
4C6C000
stack
page read and write
1312000
heap
page read and write
406E000
direct allocation
page read and write
4AED000
trusted library allocation
page read and write
3FF9000
direct allocation
page read and write
12E2000
heap
page read and write
2360000
heap
page read and write
12DA000
heap
page read and write
5FAF000
stack
page read and write
1313000
heap
page read and write
3FB9000
direct allocation
page read and write
5EC0000
trusted library allocation
page read and write
3CF0000
direct allocation
page read and write
35A000
stack
page read and write
13B2000
heap
page read and write
7FAB0000
trusted library allocation
page execute and read and write
A91000
heap
page read and write
6680000
heap
page read and write
4ADE000
trusted library allocation
page read and write
3FFD000
direct allocation
page read and write
2666000
trusted library allocation
page read and write
5C5E000
stack
page read and write
3D30000
direct allocation
page read and write
565E000
stack
page read and write
5FF0000
trusted library allocation
page execute and read and write
369C000
trusted library allocation
page read and write
63D0000
trusted library allocation
page execute and read and write
9C8000
heap
page read and write
2631000
trusted library allocation
page read and write
5ED0000
trusted library allocation
page read and write
12E2000
heap
page read and write
808000
unkown
page readonly
13C2000
heap
page read and write
23DB000
trusted library allocation
page execute and read and write
12A0000
heap
page read and write
3FBD000
direct allocation
page read and write
2503000
heap
page read and write
23D7000
trusted library allocation
page execute and read and write
5ED7000
trusted library allocation
page read and write
23CA000
trusted library allocation
page execute and read and write
3E13000
direct allocation
page read and write
1312000
heap
page read and write
26BE000
trusted library allocation
page read and write
3E13000
direct allocation
page read and write
840000
heap
page read and write
23A4000
trusted library allocation
page read and write
4ACE000
trusted library allocation
page read and write
23C0000
trusted library allocation
page read and write
A5F000
heap
page read and write
58D8000
heap
page read and write
3E90000
direct allocation
page read and write
58D6000
heap
page read and write
5D5D000
stack
page read and write
1312000
heap
page read and write
9FC000
heap
page read and write
803000
unkown
page write copy
3FFD000
direct allocation
page read and write
3FF9000
direct allocation
page read and write
B8A000
stack
page read and write
1393000
heap
page read and write
58AC000
heap
page read and write
3D30000
direct allocation
page read and write
4CC0000
heap
page execute and read and write
3CF0000
direct allocation
page read and write
13B2000
heap
page read and write
23A0000
trusted library allocation
page read and write
123E000
stack
page read and write
4AE1000
trusted library allocation
page read and write
4B30000
heap
page read and write
1312000
heap
page read and write
2520000
heap
page read and write
575E000
stack
page read and write
7E0000
heap
page read and write
595E000
heap
page read and write
3ED0000
direct allocation
page read and write
402E000
direct allocation
page read and write
11FC000
stack
page read and write
12F1000
heap
page read and write
24F0000
trusted library allocation
page execute and read and write
1312000
heap
page read and write
12E1000
heap
page read and write
267D000
trusted library allocation
page read and write
3631000
trusted library allocation
page read and write
4AB0000
trusted library allocation
page read and write
1B6E000
stack
page read and write
5D9E000
stack
page read and write
23C6000
trusted library allocation
page execute and read and write
1270000
heap
page read and write
402E000
direct allocation
page read and write
1365000
heap
page read and write
3D30000
direct allocation
page read and write
1312000
heap
page read and write
3659000
trusted library allocation
page read and write
6380000
trusted library allocation
page read and write
1393000
heap
page read and write
406E000
direct allocation
page read and write
700000
heap
page read and write
406E000
direct allocation
page read and write
3FBD000
direct allocation
page read and write
5959000
heap
page read and write
7F5000
unkown
page readonly
5EA0000
trusted library allocation
page read and write
12F1000
heap
page read and write
1312000
heap
page read and write
3FB9000
direct allocation
page read and write
2110000
heap
page read and write
9FA000
heap
page read and write
9DE000
heap
page read and write
26C6000
trusted library allocation
page read and write
1312000
heap
page read and write
4E0E000
stack
page read and write
8B5000
heap
page read and write
1365000
heap
page read and write
3CF0000
direct allocation
page read and write
830000
heap
page read and write
12F2000
heap
page read and write
6377000
trusted library allocation
page read and write
1312000
heap
page read and write
58A8000
heap
page read and write
7CF000
unkown
page readonly
4ACB000
trusted library allocation
page read and write
7FF000
unkown
page write copy
3ED0000
direct allocation
page read and write
1365000
heap
page read and write
5C1F000
stack
page read and write
7CF000
unkown
page readonly
12D2000
heap
page read and write
1FF0000
direct allocation
page execute and read and write
13C2000
heap
page read and write
13B2000
heap
page read and write
23D5000
trusted library allocation
page execute and read and write
4F4E000
stack
page read and write
23AD000
trusted library allocation
page execute and read and write
2510000
trusted library allocation
page read and write
1FD0000
heap
page read and write
3E13000
direct allocation
page read and write
4B00000
trusted library allocation
page read and write
3ED0000
direct allocation
page read and write
23BD000
trusted library allocation
page execute and read and write
5F1D000
stack
page read and write
3FBD000
direct allocation
page read and write
1FAF000
stack
page read and write
3E53000
direct allocation
page read and write
1307000
heap
page read and write
466C000
stack
page read and write
2010000
heap
page read and write
3E53000
direct allocation
page read and write
3FFD000
direct allocation
page read and write
2014000
heap
page read and write
5EB0000
trusted library allocation
page execute and read and write
23D2000
trusted library allocation
page read and write
402E000
direct allocation
page read and write
3FBD000
direct allocation
page read and write
12D3000
heap
page read and write
11CE000
stack
page read and write
11DB000
stack
page read and write
6390000
trusted library allocation
page read and write
1300000
heap
page read and write
596C000
heap
page read and write
11BE000
stack
page read and write
740000
unkown
page readonly
23D0000
trusted library allocation
page read and write
4AE6000
trusted library allocation
page read and write
3FF9000
direct allocation
page read and write
1312000
heap
page read and write
6F8000
stack
page read and write
5913000
heap
page read and write
740000
unkown
page readonly
4AD2000
trusted library allocation
page read and write
262E000
stack
page read and write
741000
unkown
page execute read
266F000
trusted library allocation
page read and write
4F0E000
stack
page read and write
9C0000
heap
page read and write
504F000
stack
page read and write
5050000
heap
page read and write
3E13000
direct allocation
page read and write
3E90000
direct allocation
page read and write
402E000
direct allocation
page read and write
9EA000
heap
page read and write
58A0000
heap
page read and write
A95000
heap
page read and write
23A3000
trusted library allocation
page execute and read and write
63C0000
heap
page read and write
4AC0000
trusted library allocation
page read and write
5942000
heap
page read and write
12F1000
heap
page read and write
7FF000
unkown
page read and write
12A8000
heap
page read and write
1312000
heap
page read and write
4AC6000
trusted library allocation
page read and write
12F3000
heap
page read and write
2448000
trusted library allocation
page read and write
58C0000
heap
page read and write
23B0000
trusted library allocation
page read and write
BF0000
heap
page read and write
5ECD000
trusted library allocation
page read and write
1240000
heap
page read and write
808000
unkown
page readonly
6000000
trusted library allocation
page read and write
243E000
stack
page read and write
1365000
heap
page read and write
2390000
trusted library allocation
page read and write
3E90000
direct allocation
page read and write
5B1D000
stack
page read and write
7F5000
unkown
page readonly
390000
system
page execute and read and write
6370000
trusted library allocation
page read and write
13C2000
heap
page read and write
8B0000
heap
page read and write
3FB9000
direct allocation
page read and write
4ADA000
trusted library allocation
page read and write
3CF0000
direct allocation
page read and write
3E90000
direct allocation
page read and write
1BAD000
stack
page read and write
4B10000
trusted library allocation
page read and write
1312000
heap
page read and write
1301000
heap
page read and write
741000
unkown
page execute read
846000
heap
page read and write
476E000
stack
page read and write
5EA8000
trusted library allocation
page read and write
24E0000
heap
page execute and read and write
23F0000
trusted library allocation
page read and write
1312000
heap
page read and write
4AF2000
trusted library allocation
page read and write
4DCC000
stack
page read and write
13C2000
heap
page read and write
3E53000
direct allocation
page read and write
There are 229 hidden memdumps, click here to show them.