IOC Report
Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765 .exe

loading gif

Files

File Path
Type
Category
Malicious
Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765 .exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Bactris
data
dropped
C:\Users\user\AppData\Local\Temp\autE51E.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autE5AC.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\ultraradicalism
ASCII text, with very long lines (28724), with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765 .exe
"C:\Users\user\Desktop\Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765 .exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765 .exe"
 malicious

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
bg.microsoft.map.fastly.net
199.232.214.172
198.187.3.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
1C80000
direct allocation
page read and write
 malicious
AB8000
unkown
page readonly
587E000
stack
page read and write
13F8000
heap
page read and write
3DA9000
direct allocation
page read and write
400000
system
page execute and read and write
3C03000
direct allocation
page read and write
3C03000
direct allocation
page read and write
1453000
heap
page read and write
5143000
heap
page read and write
13FF000
heap
page read and write
1400000
heap
page read and write
E03000
trusted library allocation
page execute and read and write
3DA9000
direct allocation
page read and write
13CB000
heap
page read and write
79A000
stack
page read and write
C20000
heap
page read and write
627E000
stack
page read and write
3C03000
direct allocation
page read and write
63D0000
trusted library allocation
page read and write
E65000
heap
page read and write
6490000
heap
page read and write
63F0000
trusted library allocation
page read and write
3C21000
trusted library allocation
page read and write
3C03000
direct allocation
page read and write
63C0000
trusted library allocation
page execute and read and write
2C96000
trusted library allocation
page read and write
E1D000
trusted library allocation
page execute and read and write
3DAD000
direct allocation
page read and write
EB3000
heap
page read and write
2C21000
trusted library allocation
page read and write
4D1D000
stack
page read and write
F4B000
trusted library allocation
page execute and read and write
3C29000
trusted library allocation
page read and write
63D7000
trusted library allocation
page read and write
2D1D000
trusted library allocation
page read and write
F3A000
trusted library allocation
page execute and read and write
9F1000
unkown
page execute read
AA5000
unkown
page readonly
2C1F000
stack
page read and write
13FF000
heap
page read and write
55DE000
stack
page read and write
29F1000
trusted library allocation
page read and write
29EE000
trusted library allocation
page read and write
3AE0000
direct allocation
page read and write
13FF000
heap
page read and write
7EEE0000
trusted library allocation
page execute and read and write
63E7000
trusted library allocation
page read and write
2A58000
trusted library allocation
page read and write
3C80000
direct allocation
page read and write
1B8F000
stack
page read and write
3DAD000
direct allocation
page read and write
EF0000
heap
page read and write
13FF000
heap
page read and write
3DAD000
direct allocation
page read and write
2A10000
trusted library allocation
page read and write
1460000
heap
page read and write
13FF000
heap
page read and write
2D0E000
trusted library allocation
page read and write
2A40000
heap
page read and write
FAE000
stack
page read and write
63BE000
stack
page read and write
3DAD000
direct allocation
page read and write
F32000
trusted library allocation
page read and write
53DC000
stack
page read and write
3AE0000
direct allocation
page read and write
F36000
trusted library allocation
page execute and read and write
3DA9000
direct allocation
page read and write
5150000
heap
page read and write
56DE000
stack
page read and write
1453000
heap
page read and write
9E0000
heap
page read and write
5130000
heap
page read and write
13FF000
heap
page read and write
3C80000
direct allocation
page read and write
1000000
heap
page read and write
5140000
heap
page read and write
9F1000
unkown
page execute read
13D2000
heap
page read and write
29E2000
trusted library allocation
page read and write
29EA000
trusted library allocation
page read and write
3DAD000
direct allocation
page read and write
29D0000
trusted library allocation
page read and write
AA5000
unkown
page readonly
E5A000
heap
page read and write
3C80000
direct allocation
page read and write
1398000
heap
page read and write
149F000
heap
page read and write
6410000
trusted library allocation
page execute and read and write
1480000
heap
page read and write
52D0000
heap
page execute and read and write
2CE0000
trusted library allocation
page read and write
63E0000
trusted library allocation
page read and write
AAF000
unkown
page read and write
509C000
stack
page read and write
11CE000
stack
page read and write
F42000
trusted library allocation
page read and write
3C03000
direct allocation
page read and write
2D0A000
trusted library allocation
page read and write
BD0000
heap
page read and write
E00000
trusted library allocation
page read and write
A7F000
unkown
page readonly
800000
heap
page read and write
2CE6000
trusted library allocation
page read and write
F47000
trusted library allocation
page execute and read and write
9B9000
stack
page read and write
98E000
stack
page read and write
3C80000
direct allocation
page read and write
67B0000
heap
page read and write
DF0000
trusted library allocation
page read and write
BD4000
heap
page read and write
FF0000
trusted library allocation
page execute and read and write
3C87000
trusted library allocation
page read and write
13FF000
heap
page read and write
1453000
heap
page read and write
FEC000
stack
page read and write
13E3000
heap
page read and write
2D10000
trusted library allocation
page read and write
62BE000
stack
page read and write
AAF000
unkown
page write copy
64A0000
trusted library allocation
page read and write
3AE0000
direct allocation
page read and write
2D36000
trusted library allocation
page read and write
29F6000
trusted library allocation
page read and write
E0D000
trusted library allocation
page execute and read and write
29DE000
trusted library allocation
page read and write
3E1E000
direct allocation
page read and write
13CA000
heap
page read and write
2C55000
trusted library allocation
page read and write
E10000
trusted library allocation
page read and write
54DE000
stack
page read and write
1390000
heap
page read and write
6400000
trusted library allocation
page read and write
B90000
direct allocation
page execute and read and write
13FF000
heap
page read and write
29C0000
trusted library allocation
page read and write
1D80000
heap
page read and write
810000
heap
page read and write
13E3000
heap
page read and write
3AE0000
direct allocation
page read and write
820000
heap
page read and write
3DA9000
direct allocation
page read and write
1453000
heap
page read and write
3C49000
trusted library allocation
page read and write
3C80000
direct allocation
page read and write
13EF000
heap
page read and write
29FD000
trusted library allocation
page read and write
13D2000
heap
page read and write
14AF000
heap
page read and write
E26000
heap
page read and write
E04000
trusted library allocation
page read and write
3E1E000
direct allocation
page read and write
29DB000
trusted library allocation
page read and write
C90000
heap
page read and write
2D30000
trusted library allocation
page read and write
3E1E000
direct allocation
page read and write
E30000
heap
page read and write
149F000
heap
page read and write
3E1E000
direct allocation
page read and write
A7F000
unkown
page readonly
149F000
heap
page read and write
11BF000
stack
page read and write
9F0000
unkown
page readonly
2A20000
trusted library allocation
page read and write
13FF000
heap
page read and write
29B0000
trusted library allocation
page read and write
F60000
trusted library allocation
page read and write
3E1E000
direct allocation
page read and write
3C80000
direct allocation
page read and write
5F6E000
heap
page read and write
511D000
stack
page read and write
50DE000
stack
page read and write
F0A000
heap
page read and write
DB0000
heap
page read and write
1480000
heap
page read and write
13C3000
heap
page read and write
2B10000
heap
page execute and read and write
528E000
stack
page read and write
5F40000
heap
page read and write
9F0000
unkown
page readonly
13E1000
heap
page read and write
F25000
heap
page read and write
AB8000
unkown
page readonly
13C2000
heap
page read and write
11FC000
stack
page read and write
3C03000
direct allocation
page read and write
3DA9000
direct allocation
page read and write
13FF000
heap
page read and write
2D00000
trusted library allocation
page read and write
E38000
heap
page read and write
E20000
heap
page read and write
11DB000
stack
page read and write
C70000
heap
page read and write
F30000
trusted library allocation
page read and write
3AE0000
direct allocation
page read and write
2CF8000
trusted library allocation
page read and write
238E000
stack
page read and write
13E1000
heap
page read and write
2D22000
trusted library allocation
page read and write
5880000
trusted library allocation
page read and write
93E000
stack
page read and write
8B9000
stack
page read and write
13F0000
heap
page read and write
E68000
heap
page read and write
3AE0000
direct allocation
page read and write
3DAD000
direct allocation
page read and write
AB3000
unkown
page write copy
C95000
heap
page read and write
13F0000
heap
page read and write
3DA9000
direct allocation
page read and write
13E1000
heap
page read and write
3E1E000
direct allocation
page read and write
There are 203 hidden memdumps, click here to show them.