IOC Report
Shipping Documents inv. 523435300XX.exe

loading gif

Files

File Path
Type
Category
Malicious
Shipping Documents inv. 523435300XX.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jBpFfg.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\Mazatl
data
dropped
C:\Users\user\AppData\Local\Temp\Wauseon
ASCII text, with very long lines (28734), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\autAB36.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autAB85.tmp
data
dropped
C:\Users\user\AppData\Roaming\jBpFfg\jBpFfg.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Shipping Documents inv. 523435300XX.exe
"C:\Users\user\Desktop\Shipping Documents inv. 523435300XX.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Shipping Documents inv. 523435300XX.exe"
 malicious
C:\Users\user\AppData\Roaming\jBpFfg\jBpFfg.exe
"C:\Users\user\AppData\Roaming\jBpFfg\jBpFfg.exe"
malicious
C:\Users\user\AppData\Roaming\jBpFfg\jBpFfg.exe
"C:\Users\user\AppData\Roaming\jBpFfg\jBpFfg.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
http://crl.pki.goog/gsr1/gsr1.crl0;
unknown
https://account.dyn.com/
unknown
http://crl.pki.goog/gtsr1/gtsr1.crl0W
unknown
http://pki.goog/gsr1/gsr1.crt02
unknown
https://api.ipify.org/t
unknown
https://pki.goog/repository/0
unknown
http://crls.pki.goog/gts1c3/QqFxbi9M48c.crl0
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://smtp.gmail.com
unknown
http://pki.goog/repo/certs/gts1c3.der0
unknown
http://pki.goog/repo/certs/gtsr1.der04
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.ipify.org
172.67.74.152
smtp.gmail.com
64.233.184.108

IPs

IP
Domain
Country
Malicious
64.233.184.108
smtp.gmail.com
United States
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
jBpFfg
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
295F000
heap
page read and write
 malicious
5380000
trusted library section
page read and write
 malicious
2D20000
trusted library section
page read and write
 malicious
2E0F000
trusted library allocation
page read and write
 malicious
2E17000
trusted library allocation
page read and write
 malicious
3D91000
trusted library allocation
page read and write
 malicious
2DE4000
trusted library allocation
page read and write
 malicious
56EF000
stack
page read and write
1945000
heap
page read and write
FBD000
stack
page read and write
1989000
heap
page read and write
13A3000
trusted library allocation
page execute and read and write
5630000
heap
page execute and read and write
E00000
heap
page read and write
16CE000
stack
page read and write
6768000
trusted library allocation
page read and write
1A20000
heap
page read and write
1323000
trusted library allocation
page execute and read and write
3E40000
direct allocation
page read and write
EA8000
heap
page read and write
133D000
trusted library allocation
page execute and read and write
2905000
trusted library allocation
page execute and read and write
448D000
direct allocation
page read and write
4489000
direct allocation
page read and write
F30000
heap
page read and write
DC1000
unkown
page execute read
FD3000
heap
page read and write
18E0000
direct allocation
page execute and read and write
E88000
unkown
page readonly
2E0B000
trusted library allocation
page read and write
14E8000
heap
page read and write
44FE000
direct allocation
page read and write
13B4000
trusted library allocation
page read and write
193C000
heap
page read and write
F68000
heap
page read and write
8FA000
stack
page read and write
315E000
stack
page read and write
44FE000
direct allocation
page read and write
426000
system
page execute and read and write
1430000
heap
page execute and read and write
17E0000
heap
page read and write
2BE8000
trusted library allocation
page read and write
11C0000
trusted library allocation
page read and write
1989000
heap
page read and write
3E40000
direct allocation
page read and write
15FC000
stack
page read and write
4489000
direct allocation
page read and write
196F000
heap
page read and write
16D0000
trusted library allocation
page execute and read and write
5370000
heap
page execute and read and write
6340000
trusted library allocation
page execute and read and write
52DB000
trusted library allocation
page read and write
13C0000
heap
page read and write
E40000
heap
page read and write
1945000
heap
page read and write
52DE000
trusted library allocation
page read and write
E12000
unkown
page readonly
119F000
stack
page read and write
BCA000
stack
page read and write
581E000
stack
page read and write
1910000
heap
page read and write
2510000
direct allocation
page read and write
53D0000
heap
page read and write
1517000
heap
page read and write
3F63000
direct allocation
page read and write
591E000
stack
page read and write
2DD3000
trusted library allocation
page read and write
2D10000
trusted library allocation
page execute and read and write
3E53000
trusted library allocation
page read and write
4489000
direct allocation
page read and write
1370000
trusted library allocation
page read and write
4360000
direct allocation
page read and write
E75000
unkown
page readonly
EEC000
heap
page read and write
1953000
heap
page read and write
1A21000
heap
page read and write
53E8000
heap
page read and write
2DE0000
trusted library allocation
page read and write
E83000
unkown
page write copy
68A0000
trusted library allocation
page read and write
1400000
trusted library allocation
page execute and read and write
44FE000
direct allocation
page read and write
6C14000
heap
page read and write
15DB000
stack
page read and write
6754000
trusted library allocation
page read and write
1640000
trusted library allocation
page read and write
11D0000
heap
page read and write
6740000
trusted library allocation
page execute and read and write
163E000
stack
page read and write
2D20000
heap
page read and write
F70000
heap
page read and write
2902000
trusted library allocation
page read and write
14CF000
stack
page read and write
E75000
unkown
page readonly
DF0000
trusted library section
page read and write
5350000
trusted library allocation
page read and write
57CB000
heap
page read and write
1954000
heap
page read and write
2CBC000
stack
page read and write
E34000
trusted library allocation
page read and write
1680000
heap
page read and write
5FDF000
stack
page read and write
55EE000
stack
page read and write
5310000
trusted library allocation
page read and write
2DCA000
trusted library allocation
page read and write
EB4000
heap
page read and write
44FE000
direct allocation
page read and write
566E000
stack
page read and write
1670000
trusted library allocation
page read and write
58EE000
stack
page read and write
290B000
trusted library allocation
page execute and read and write
44FE000
direct allocation
page read and write
FAA000
stack
page read and write
7FC40000
trusted library allocation
page execute and read and write
15E7000
trusted library allocation
page execute and read and write
52F6000
trusted library allocation
page read and write
3F63000
direct allocation
page read and write
E20000
trusted library allocation
page read and write
1A20000
heap
page read and write
550C000
stack
page read and write
17B0000
heap
page read and write
448D000
direct allocation
page read and write
19D9000
heap
page read and write
64CE000
stack
page read and write
28E0000
trusted library allocation
page read and write
13BD000
trusted library allocation
page execute and read and write
2D80000
heap
page read and write
13B0000
trusted library allocation
page read and write
3E40000
direct allocation
page read and write
1650000
trusted library allocation
page execute and read and write
4360000
direct allocation
page read and write
E65000
heap
page read and write
2E0D000
trusted library allocation
page read and write
660E000
stack
page read and write
1989000
heap
page read and write
E48000
heap
page read and write
1943000
heap
page read and write
2D70000
trusted library allocation
page read and write
1918000
heap
page read and write
52EA000
trusted library allocation
page read and write
28F6000
trusted library allocation
page execute and read and write
5320000
trusted library allocation
page read and write
3D31000
trusted library allocation
page read and write
52FD000
trusted library allocation
page read and write
1660000
trusted library allocation
page read and write
3E40000
direct allocation
page read and write
1989000
heap
page read and write
56DE000
stack
page read and write
1210000
heap
page read and write
4489000
direct allocation
page read and write
1933000
heap
page read and write
E60000
heap
page read and write
250F000
stack
page read and write
532E000
stack
page read and write
1330000
trusted library allocation
page read and write
198D000
heap
page read and write
C60000
heap
page read and write
595E000
stack
page read and write
DC0000
unkown
page readonly
16E0000
heap
page read and write
448D000
direct allocation
page read and write
1989000
heap
page read and write
155F000
heap
page read and write
196F000
heap
page read and write
1324000
trusted library allocation
page read and write
14E0000
heap
page read and write
445000
system
page execute and read and write
448D000
direct allocation
page read and write
536E000
stack
page read and write
2BBF000
stack
page read and write
1989000
heap
page read and write
319C000
stack
page read and write
52DE000
stack
page read and write
E7F000
unkown
page read and write
EBD000
heap
page read and write
4489000
direct allocation
page read and write
3F63000
direct allocation
page read and write
1390000
trusted library allocation
page read and write
4E8E000
stack
page read and write
65CE000
stack
page read and write
E4F000
unkown
page readonly
2BD0000
heap
page read and write
E4F000
unkown
page readonly
F97000
heap
page read and write
197E000
heap
page read and write
57C0000
heap
page read and write
28F2000
trusted library allocation
page read and write
6330000
heap
page read and write
2E22000
trusted library allocation
page read and write
EAC000
stack
page read and write
1989000
heap
page read and write
13BE000
stack
page read and write
1A31000
heap
page read and write
132E000
stack
page read and write
4489000
direct allocation
page read and write
305F000
stack
page read and write
3F63000
direct allocation
page read and write
28ED000
trusted library allocation
page execute and read and write
5A5E000
stack
page read and write
109E000
stack
page read and write
52EE000
trusted library allocation
page read and write
E07000
heap
page read and write
15CE000
stack
page read and write
1975000
heap
page read and write
150B000
heap
page read and write
1350000
trusted library allocation
page read and write
2D91000
trusted library allocation
page read and write
1956000
heap
page read and write
3E40000
direct allocation
page read and write
4360000
direct allocation
page read and write
2AB0000
heap
page read and write
6C10000
heap
page read and write
1945000
heap
page read and write
135B000
trusted library allocation
page execute and read and write
2A90000
trusted library allocation
page execute and read and write
13FC000
stack
page read and write
4010000
heap
page read and write
3E40000
direct allocation
page read and write
1945000
heap
page read and write
1357000
trusted library allocation
page execute and read and write
131F000
stack
page read and write
5778000
heap
page read and write
F84000
heap
page read and write
585B000
heap
page read and write
6E20000
trusted library allocation
page read and write
F1A000
stack
page read and write
E70000
heap
page read and write
6320000
trusted library allocation
page read and write
13AD000
trusted library allocation
page execute and read and write
6E10000
trusted library allocation
page execute and read and write
41E1000
trusted library allocation
page read and write
E30000
trusted library allocation
page read and write
400000
system
page execute and read and write
F40000
heap
page read and write
1410000
trusted library allocation
page read and write
D40000
heap
page read and write
15EB000
trusted library allocation
page execute and read and write
2900000
trusted library allocation
page read and write
ACC000
stack
page read and write
6760000
trusted library allocation
page read and write
6750000
trusted library allocation
page read and write
E3D000
trusted library allocation
page execute and read and write
1420000
trusted library allocation
page read and write
1989000
heap
page read and write
6897000
trusted library allocation
page read and write
E1A000
unkown
page readonly
1942000
heap
page read and write
1A31000
heap
page read and write
1975000
heap
page read and write
E7E000
heap
page read and write
28F0000
trusted library allocation
page read and write
2AB3000
heap
page read and write
448D000
direct allocation
page read and write
1504000
heap
page read and write
2CC0000
heap
page read and write
60DF000
stack
page read and write
15E0000
trusted library allocation
page read and write
D45000
heap
page read and write
57DF000
stack
page read and write
DC1000
unkown
page execute read
31E1000
trusted library allocation
page read and write
6890000
trusted library allocation
page read and write
52EE000
stack
page read and write
54EE000
stack
page read and write
2AA0000
trusted library allocation
page read and write
15BF000
stack
page read and write
3F63000
direct allocation
page read and write
2930000
heap
page read and write
2907000
trusted library allocation
page execute and read and write
2A80000
heap
page execute and read and write
EA3000
heap
page read and write
52F1000
trusted library allocation
page read and write
1334000
trusted library allocation
page read and write
2D0E000
stack
page read and write
E88000
unkown
page readonly
52D6000
trusted library allocation
page read and write
14FF000
heap
page read and write
576F000
stack
page read and write
4ECE000
stack
page read and write
2A7E000
stack
page read and write
448D000
direct allocation
page read and write
E7F000
unkown
page write copy
F7F000
heap
page read and write
F60000
heap
page read and write
53E0000
heap
page execute and read and write
57B2000
heap
page read and write
13C5000
heap
page read and write
67BD000
stack
page read and write
586E000
heap
page read and write
1460000
heap
page read and write
1350000
heap
page read and write
E33000
trusted library allocation
page execute and read and write
1956000
heap
page read and write
2D1E000
stack
page read and write
4360000
direct allocation
page read and write
4360000
direct allocation
page read and write
2920000
trusted library allocation
page read and write
210E000
stack
page read and write
1989000
heap
page read and write
52CF000
stack
page read and write
2690000
heap
page read and write
4360000
direct allocation
page read and write
132D000
trusted library allocation
page execute and read and write
28E3000
trusted library allocation
page read and write
4014000
heap
page read and write
E7A000
heap
page read and write
44FE000
direct allocation
page read and write
193C000
heap
page read and write
2D31000
trusted library allocation
page read and write
17C0000
heap
page read and write
6E50000
heap
page read and write
584A000
heap
page read and write
684F000
stack
page read and write
E10000
unkown
page readonly
D90000
heap
page read and write
3F63000
direct allocation
page read and write
121E000
stack
page read and write
FFE000
stack
page read and write
52E2000
trusted library allocation
page read and write
7050000
heap
page read and write
FC6000
heap
page read and write
31D0000
heap
page execute and read and write
52D0000
trusted library allocation
page read and write
13A4000
trusted library allocation
page read and write
1330000
heap
page read and write
1989000
heap
page read and write
16D0000
heap
page read and write
3E90000
trusted library allocation
page read and write
560C000
stack
page read and write
1989000
heap
page read and write
DC0000
unkown
page readonly
58AE000
stack
page read and write
E40000
heap
page read and write
E30000
heap
page read and write
E10000
trusted library section
page read and write
2EC8000
trusted library allocation
page read and write
5770000
heap
page read and write
1945000
heap
page read and write
670E000
stack
page read and write
F8A000
heap
page read and write
632D000
trusted library allocation
page read and write
28FA000
trusted library allocation
page execute and read and write
6770000
trusted library allocation
page read and write
9F8000
stack
page read and write
There are 334 hidden memdumps, click here to show them.