IOC Report
MT Marine Tiger.exe

loading gif

Files

File Path
Type
Category
Malicious
MT Marine Tiger.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MT Marine Tiger._b1fc61aa0f0ff659922dc1f816562af76c8bcc3_d4dd14a2_f9207a17-8494-4b79-9815-4bb98abb0750\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DB1.tmp.dmp
Mini DuMP crash report, 16 streams, Sun Jun 30 15:19:54 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8EEB.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F3A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\regasm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\MT Marine Tiger.exe
"C:\Users\user\Desktop\MT Marine Tiger.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1968 -s 1044
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileDirectory
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
ProgramId
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
FileId
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
LowerCaseLongPath
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
LongPathHash
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
Name
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
OriginalFileName
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
Publisher
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
Version
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
BinFileVersion
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
BinaryType
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
ProductName
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
ProductVersion
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
LinkDate
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
BinProductVersion
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
AppxPackageFullName
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
AppxPackageRelativeId
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
Size
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
Language
\REGISTRY\A\{402dac20-87bc-72d5-0f64-5abc90269c4e}\Root\InventoryApplicationFile\mt marine tiger.|c67994ed4091bb00
Usn
There are 23 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
30A1000
trusted library allocation
page read and write
 malicious
20D0FBB7000
trusted library allocation
page read and write
 malicious
20D1FD68000
trusted library allocation
page read and write
 malicious
20D0FEBB000
trusted library allocation
page read and write
 malicious
660F000
stack
page read and write
7FFD34876000
trusted library allocation
page execute and read and write
2B90000
heap
page read and write
15F2000
trusted library allocation
page read and write
6FED000
stack
page read and write
7FFD3479D000
trusted library allocation
page execute and read and write
20D0FB9C000
trusted library allocation
page read and write
326A000
trusted library allocation
page read and write
20D0E113000
trusted library allocation
page read and write
FF7000
stack
page read and write
13F0000
trusted library allocation
page read and write
3263000
trusted library allocation
page read and write
7FFD34790000
trusted library allocation
page read and write
15E6000
trusted library allocation
page execute and read and write
7FFD34840000
trusted library allocation
page read and write
1400000
heap
page read and write
712E000
stack
page read and write
3080000
trusted library allocation
page read and write
20D27BB0000
trusted library allocation
page read and write
7FFD34794000
trusted library allocation
page read and write
2BA0000
heap
page read and write
20D28310000
heap
page read and write
4E8ECFF000
stack
page read and write
1390000
heap
page read and write
24A0000
heap
page read and write
20D0DE70000
heap
page read and write
5660000
trusted library allocation
page read and write
31A5000
trusted library allocation
page read and write
277E000
stack
page read and write
27E0000
heap
page read and write
20D1FB81000
trusted library allocation
page read and write
3247000
trusted library allocation
page read and write
21C0000
heap
page read and write
2804000
heap
page read and write
664E000
stack
page read and write
698E000
stack
page read and write
13C0000
heap
page read and write
7FFD34944000
trusted library allocation
page read and write
4E8F2FE000
stack
page read and write
5649000
trusted library allocation
page read and write
2EB0000
heap
page read and write
20D0E1D0000
heap
page execute and read and write
20D0E080000
heap
page read and write
2ADF000
stack
page read and write
50DC000
stack
page read and write
15E0000
trusted library allocation
page read and write
1405000
heap
page read and write
3148000
trusted library allocation
page read and write
40C9000
trusted library allocation
page read and write
2E00000
heap
page read and write
57D0000
heap
page read and write
1600000
heap
page read and write
1692000
heap
page read and write
20D0DEB0000
heap
page read and write
6B4E000
stack
page read and write
1397000
heap
page read and write
20D0DDE0000
unkown
page readonly
1370000
heap
page read and write
20D0DEF2000
heap
page read and write
4E8EDFF000
stack
page read and write
7FFD347B4000
trusted library allocation
page read and write
317E000
trusted library allocation
page read and write
64CE000
stack
page read and write
10C000
stack
page read and write
6C0E000
stack
page read and write
7FFD34970000
trusted library allocation
page read and write
5B7D000
stack
page read and write
15EA000
trusted library allocation
page execute and read and write
56EE000
stack
page read and write
16F2000
heap
page read and write
650D000
stack
page read and write
1260000
heap
page read and write
7FFD347AD000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
5646000
trusted library allocation
page read and write
31E6000
trusted library allocation
page read and write
21D0000
heap
page read and write
4E8F3FD000
stack
page read and write
20D0FB81000
trusted library allocation
page read and write
5C7F000
stack
page read and write
31A1000
trusted library allocation
page read and write
31E2000
trusted library allocation
page read and write
7FFD34846000
trusted library allocation
page read and write
3190000
trusted library allocation
page read and write
20D0E0E0000
trusted library allocation
page read and write
13D0000
trusted library allocation
page read and write
EFB000
stack
page read and write
2610000
heap
page read and write
5641000
trusted library allocation
page read and write
20D0DF23000
heap
page read and write
319D000
trusted library allocation
page read and write
2803000
heap
page read and write
20D0DE80000
heap
page read and write
160B000
heap
page read and write
2E6E000
stack
page read and write
6EEC000
stack
page read and write
20D0FB70000
heap
page read and write
2EAE000
stack
page read and write
2D4E000
unkown
page read and write
7FFD34792000
trusted library allocation
page read and write
29DF000
unkown
page read and write
69CE000
stack
page read and write
22AD000
stack
page read and write
7FFD34949000
trusted library allocation
page read and write
59F0000
heap
page execute and read and write
15FB000
trusted library allocation
page execute and read and write
702D000
stack
page read and write
3160000
trusted library allocation
page read and write
5624000
trusted library allocation
page read and write
20D0DDE2000
unkown
page readonly
6EAF000
stack
page read and write
4E8EFFB000
stack
page read and write
20D28359000
heap
page read and write
4E8EEFE000
stack
page read and write
2FBE000
stack
page read and write
15F0000
trusted library allocation
page read and write
20D0E250000
heap
page read and write
27EC000
heap
page read and write
20D0E165000
heap
page read and write
3211000
trusted library allocation
page read and write
4E8F0FE000
stack
page read and write
7FFD34980000
trusted library allocation
page execute and read and write
13ED000
trusted library allocation
page execute and read and write
20D0DF1A000
heap
page read and write
15A0000
trusted library allocation
page read and write
2780000
heap
page read and write
26F0000
heap
page read and write
3256000
trusted library allocation
page read and write
31EA000
trusted library allocation
page read and write
674E000
stack
page read and write
5680000
trusted library allocation
page read and write
14C000
stack
page read and write
24EE000
stack
page read and write
688E000
stack
page read and write
3070000
trusted library allocation
page read and write
7FF4F2D70000
trusted library allocation
page execute and read and write
6D0F000
stack
page read and write
31EE000
trusted library allocation
page read and write
20D0DEBC000
heap
page read and write
2558000
heap
page read and write
7FFD34960000
trusted library allocation
page read and write
3162000
trusted library allocation
page read and write
7FFD348B0000
trusted library allocation
page execute and read and write
3086000
trusted library allocation
page read and write
7FFD347A2000
trusted library allocation
page read and write
67A6000
heap
page read and write
4E8EAF3000
stack
page read and write
20D0DF1C000
heap
page read and write
243E000
stack
page read and write
13E0000
trusted library allocation
page read and write
317B000
trusted library allocation
page read and write
20D0E255000
heap
page read and write
20D28240000
trusted library section
page read and write
7FFD34930000
trusted library allocation
page read and write
247F000
stack
page read and write
1645000
heap
page read and write
5655000
trusted library allocation
page read and write
273E000
unkown
page read and write
31DE000
trusted library allocation
page read and write
7FFD34940000
trusted library allocation
page read and write
40A7000
trusted library allocation
page read and write
3090000
heap
page execute and read and write
3060000
trusted library allocation
page execute and read and write
20D1FB87000
trusted library allocation
page read and write
13E4000
trusted library allocation
page read and write
23AC000
stack
page read and write
7FFD34850000
trusted library allocation
page execute and read and write
15F7000
trusted library allocation
page execute and read and write
20D1FF3C000
trusted library allocation
page read and write
3199000
trusted library allocation
page read and write
63CE000
stack
page read and write
7FFD3497D000
trusted library allocation
page read and write
7FFD347BB000
trusted library allocation
page execute and read and write
3150000
trusted library allocation
page read and write
40A1000
trusted library allocation
page read and write
7FFD34990000
trusted library allocation
page read and write
6750000
heap
page read and write
20D0E0A0000
heap
page read and write
5720000
heap
page read and write
7FFD3484C000
trusted library allocation
page execute and read and write
20D0E100000
trusted library allocation
page read and write
2550000
heap
page read and write
7FFD347B0000
trusted library allocation
page read and write
6A0E000
stack
page read and write
20D0DEEF000
heap
page read and write
7FFD34793000
trusted library allocation
page execute and read and write
7FFD347EC000
trusted library allocation
page execute and read and write
6BCF000
stack
page read and write
5634000
trusted library allocation
page read and write
252F000
stack
page read and write
5CBD000
stack
page read and write
20D0E110000
trusted library allocation
page read and write
7FFD34950000
trusted library allocation
page read and write
20D0DEDA000
heap
page read and write
4E8F1FE000
stack
page read and write
13E3000
trusted library allocation
page execute and read and write
7FFD347BD000
trusted library allocation
page execute and read and write
20D0E160000
heap
page read and write
15E2000
trusted library allocation
page read and write
562E000
trusted library allocation
page read and write
314D000
trusted library allocation
page read and write
638E000
stack
page read and write
4E8EBFF000
stack
page read and write
1639000
heap
page read and write
31F6000
trusted library allocation
page read and write
1340000
heap
page read and write
67A8000
heap
page read and write
7FFD347A0000
trusted library allocation
page read and write
3243000
trusted library allocation
page read and write
20D28300000
heap
page execute and read and write
2E20000
trusted library allocation
page read and write
2740000
heap
page read and write
52DE000
stack
page read and write
6B8E000
stack
page read and write
3203000
trusted library allocation
page read and write
59CE000
stack
page read and write
31F2000
trusted library allocation
page read and write
51DC000
stack
page read and write
20D0DF8B000
heap
page read and write
6A4E000
stack
page read and write
There are 215 hidden memdumps, click here to show them.