IOC Report
H3fwQALXDX.exe

loading gif

Files

File Path
Type
Category
Malicious
H3fwQALXDX.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\H3fwQALXDX.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\H3fwQALXDX.exe
"C:\Users\user\Desktop\H3fwQALXDX.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3141000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
32FF000
trusted library allocation
page read and write
 malicious
3819000
trusted library allocation
page read and write
 malicious
2FAF000
unkown
page read and write
57D0000
heap
page read and write
156D000
heap
page read and write
151F000
heap
page read and write
1770000
heap
page read and write
3283000
trusted library allocation
page read and write
4147000
trusted library allocation
page read and write
647E000
stack
page read and write
986000
heap
page read and write
51E0000
heap
page read and write
49BB000
stack
page read and write
3235000
trusted library allocation
page read and write
7800000
heap
page read and write
5BE000
stack
page read and write
68BE000
stack
page read and write
6B20000
heap
page read and write
E1E000
stack
page read and write
6D9E000
stack
page read and write
66FE000
stack
page read and write
E2D000
trusted library allocation
page execute and read and write
480000
heap
page read and write
C8E000
stack
page read and write
637E000
stack
page read and write
32EC000
trusted library allocation
page read and write
31ED000
trusted library allocation
page read and write
31F5000
trusted library allocation
page read and write
7808000
heap
page read and write
E23000
trusted library allocation
page execute and read and write
490000
heap
page read and write
A46000
heap
page read and write
522000
unkown
page readonly
558000
unkown
page readonly
30AF000
stack
page read and write
4DD5000
trusted library allocation
page read and write
2FF0000
trusted library allocation
page read and write
12B0000
heap
page read and write
4E70000
trusted library allocation
page read and write
69FE000
stack
page read and write
48BB000
stack
page read and write
5C8000
heap
page read and write
5200000
heap
page read and write
5EA000
stack
page read and write
E5B000
trusted library allocation
page execute and read and write
32D1000
trusted library allocation
page read and write
1440000
trusted library allocation
page read and write
FC7000
stack
page read and write
A60000
heap
page read and write
3293000
trusted library allocation
page read and write
661A000
heap
page read and write
6B2E000
heap
page read and write
2FE6000
trusted library allocation
page read and write
2680000
trusted library allocation
page read and write
310E000
stack
page read and write
32A8000
trusted library allocation
page read and write
4DA0000
trusted library allocation
page read and write
5641000
trusted library allocation
page read and write
3208000
trusted library allocation
page read and write
2660000
trusted library allocation
page execute and read and write
37E1000
trusted library allocation
page read and write
562E000
trusted library allocation
page read and write
2A8D000
stack
page read and write
3242000
trusted library allocation
page read and write
4E3E000
stack
page read and write
1447000
trusted library allocation
page execute and read and write
27E1000
trusted library allocation
page read and write
A75000
heap
page read and write
4D96000
trusted library allocation
page read and write
7642000
heap
page read and write
E24000
trusted library allocation
page read and write
65FF000
heap
page read and write
5150000
heap
page read and write
5624000
trusted library allocation
page read and write
328B000
trusted library allocation
page read and write
14E8000
heap
page read and write
ECB000
stack
page read and write
328F000
trusted library allocation
page read and write
6FF000
stack
page read and write
1442000
trusted library allocation
page read and write
D00000
trusted library allocation
page read and write
31F2000
trusted library allocation
page read and write
6D5E000
stack
page read and write
141D000
trusted library allocation
page execute and read and write
4E40000
trusted library section
page read and write
3130000
heap
page read and write
E20000
trusted library allocation
page read and write
2BF0000
heap
page read and write
56BD000
stack
page read and write
285C000
trusted library allocation
page read and write
30B0000
heap
page read and write
8F8000
stack
page read and write
6C5E000
stack
page read and write
7806000
heap
page read and write
2B8D000
stack
page read and write
520000
unkown
page readonly
18D000
stack
page read and write
5270000
heap
page read and write
2C00000
heap
page read and write
3220000
heap
page read and write
31EA000
trusted library allocation
page read and write
683E000
stack
page read and write
1436000
trusted library allocation
page execute and read and write
E40000
trusted library allocation
page read and write
5634000
trusted library allocation
page read and write
5BBE000
stack
page read and write
7804000
heap
page read and write
5A30000
heap
page read and write
1432000
trusted library allocation
page read and write
6E9F000
stack
page read and write
E52000
trusted library allocation
page read and write
CCE000
stack
page read and write
E67000
heap
page read and write
2D03000
heap
page read and write
12B5000
heap
page read and write
5275000
heap
page read and write
27DE000
stack
page read and write
6D1B000
stack
page read and write
143A000
trusted library allocation
page execute and read and write
2620000
trusted library allocation
page read and write
2C10000
heap
page read and write
4DC0000
heap
page execute and read and write
51D0000
trusted library section
page readonly
543E000
stack
page read and write
1740000
heap
page read and write
2D04000
heap
page read and write
13F0000
trusted library allocation
page read and write
7222000
trusted library allocation
page read and write
2F8E000
stack
page read and write
1410000
trusted library allocation
page read and write
2FE0000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
323E000
trusted library allocation
page read and write
14BB000
heap
page read and write
77FE000
stack
page read and write
51A0000
trusted library allocation
page read and write
6E6E000
stack
page read and write
52DC000
stack
page read and write
14B0000
heap
page read and write
1413000
trusted library allocation
page execute and read and write
4DBF000
trusted library allocation
page read and write
6A3F000
stack
page read and write
E30000
trusted library allocation
page read and write
69BE000
stack
page read and write
3297000
trusted library allocation
page read and write
5649000
trusted library allocation
page read and write
12AE000
stack
page read and write
51B0000
trusted library allocation
page execute and read and write
5655000
trusted library allocation
page read and write
4EB0000
heap
page read and write
5AB0000
heap
page execute and read and write
13CE000
stack
page read and write
5A54000
heap
page read and write
5250000
trusted library allocation
page read and write
2E8E000
stack
page read and write
2670000
trusted library allocation
page read and write
2CEC000
heap
page read and write
E3D000
trusted library allocation
page execute and read and write
5A3D000
stack
page read and write
4D8E000
trusted library allocation
page read and write
14AE000
stack
page read and write
1414000
trusted library allocation
page read and write
4D91000
trusted library allocation
page read and write
1544000
heap
page read and write
64BE000
stack
page read and write
4D7B000
trusted library allocation
page read and write
47F000
stack
page read and write
3000000
heap
page execute and read and write
1420000
trusted library allocation
page read and write
327F000
trusted library allocation
page read and write
E4A000
trusted library allocation
page execute and read and write
2C9E000
stack
page read and write
51F0000
heap
page read and write
2FCC000
stack
page read and write
A50000
heap
page read and write
4169000
trusted library allocation
page read and write
4D7E000
trusted library allocation
page read and write
5170000
trusted library allocation
page execute and read and write
4D74000
trusted library allocation
page read and write
1230000
heap
page read and write
5A20000
heap
page read and write
2FE4000
trusted library allocation
page read and write
E60000
heap
page read and write
32F0000
trusted library allocation
page read and write
14E5000
heap
page read and write
660A000
heap
page read and write
15AB000
heap
page read and write
14C000
stack
page read and write
4DD0000
trusted library allocation
page read and write
26DE000
stack
page read and write
4DB0000
trusted library allocation
page read and write
5A7E000
stack
page read and write
4D70000
trusted library allocation
page read and write
65BE000
stack
page read and write
6E1C000
stack
page read and write
57C0000
heap
page read and write
14F5000
heap
page read and write
5C0000
heap
page read and write
6B7E000
stack
page read and write
2C5E000
unkown
page read and write
5646000
trusted library allocation
page read and write
E46000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
1240000
heap
page read and write
687F000
stack
page read and write
993000
heap
page read and write
505E000
stack
page read and write
3287000
trusted library allocation
page read and write
A70000
heap
page read and write
6A7E000
stack
page read and write
2CE0000
heap
page read and write
4DE0000
trusted library allocation
page read and write
9B0000
heap
page read and write
5A90000
trusted library allocation
page read and write
D10000
heap
page read and write
4EB3000
heap
page read and write
4DA2000
trusted library allocation
page read and write
1F0000
heap
page read and write
4141000
trusted library allocation
page read and write
1777000
heap
page read and write
5710000
heap
page read and write
537D000
stack
page read and write
67FF000
stack
page read and write
B8E000
stack
page read and write
950000
heap
page read and write
6CA0000
heap
page read and write
32C3000
trusted library allocation
page read and write
56FD000
stack
page read and write
5CBE000
stack
page read and write
65C0000
heap
page read and write
1430000
trusted library allocation
page read and write
2FD0000
trusted library allocation
page read and write
4D9D000
trusted library allocation
page read and write
730000
heap
page read and write
2650000
heap
page read and write
329B000
trusted library allocation
page read and write
2630000
heap
page read and write
3220000
trusted library allocation
page read and write
2690000
heap
page execute and read and write
6F6E000
stack
page read and write
95E000
heap
page read and write
524B000
stack
page read and write
7600000
heap
page read and write
5160000
trusted library allocation
page read and write
43E000
stack
page read and write
5180000
trusted library section
page read and write
3246000
trusted library allocation
page read and write
1400000
heap
page read and write
E57000
trusted library allocation
page execute and read and write
3120000
trusted library allocation
page read and write
1760000
trusted library allocation
page execute and read and write
144B000
trusted library allocation
page execute and read and write
There are 244 hidden memdumps, click here to show them.